hxxps://kikoff[.]com/dashboard/credit-account/statements?statement=GMLYEN7FG4GO7RH4

Analysis

user interaction
yes
max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 23:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://kikoff.com/dashboard/credit-account/statements?statement=GMLYEN7FG4GO7RH4
Sample260804-3sraqsad89

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2540	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303608365621433"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{9BAC0EDB-2C73-47D3-8034-CF71674C4A11}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5712	msedge.exe
5712	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 2364	1528	msedge.exe	86
PID 1528 wrote to memory of 2540	1528	msedge.exe	87
PID 1528 wrote to memory of 692	1528	msedge.exe	88
PID 1528 wrote to memory of 692	1528	msedge.exe	88
PID 1528 wrote to memory of 692	1528	msedge.exe	88
PID 1528 wrote to memory of 3068	1528	msedge.exe	90
PID 1528 wrote to memory of 3068	1528	msedge.exe	90
PID 1528 wrote to memory of 2064	1528	msedge.exe	91
PID 1528 wrote to memory of 2108	1528	msedge.exe	92
PID 1528 wrote to memory of 2064	1528	msedge.exe	91
PID 1528 wrote to memory of 2064	1528	msedge.exe	91
PID 1528 wrote to memory of 2108	1528	msedge.exe	92
PID 1528 wrote to memory of 2108	1528	msedge.exe	92
PID 1528 wrote to memory of 1728	1528	msedge.exe	93
PID 1528 wrote to memory of 1728	1528	msedge.exe	93
PID 1528 wrote to memory of 1728	1528	msedge.exe	93
PID 1528 wrote to memory of 3344	1528	msedge.exe	94
PID 1528 wrote to memory of 3344	1528	msedge.exe	94
PID 1528 wrote to memory of 3344	1528	msedge.exe	94
PID 1528 wrote to memory of 2444	1528	msedge.exe	98
PID 1528 wrote to memory of 2444	1528	msedge.exe	98
PID 1528 wrote to memory of 2444	1528	msedge.exe	98
PID 1528 wrote to memory of 4160	1528	msedge.exe	99
PID 1528 wrote to memory of 4160	1528	msedge.exe	99
PID 1528 wrote to memory of 4160	1528	msedge.exe	99
PID 1528 wrote to memory of 4456	1528	msedge.exe	100
PID 1528 wrote to memory of 1584	1528	msedge.exe	101
PID 1528 wrote to memory of 4456	1528	msedge.exe	100
PID 1528 wrote to memory of 1584	1528	msedge.exe	101
PID 1528 wrote to memory of 4048	1528	msedge.exe	102
PID 1528 wrote to memory of 4048	1528	msedge.exe	102
PID 1528 wrote to memory of 4048	1528	msedge.exe	102
PID 1528 wrote to memory of 3304	1528	msedge.exe	103
PID 1528 wrote to memory of 3304	1528	msedge.exe	103
PID 1528 wrote to memory of 3304	1528	msedge.exe	103
PID 1528 wrote to memory of 3096	1528	msedge.exe	104
PID 1528 wrote to memory of 3096	1528	msedge.exe	104
PID 1528 wrote to memory of 3096	1528	msedge.exe	104
PID 1528 wrote to memory of 2832	1528	msedge.exe	106
PID 1528 wrote to memory of 4940	1528	msedge.exe	107
PID 1528 wrote to memory of 4940	1528	msedge.exe	107
PID 1528 wrote to memory of 4940	1528	msedge.exe	107
PID 1528 wrote to memory of 3300	1528	msedge.exe	109
PID 1528 wrote to memory of 3300	1528	msedge.exe	109
PID 1528 wrote to memory of 3300	1528	msedge.exe	109
PID 1528 wrote to memory of 5188	1528	msedge.exe	119
PID 1528 wrote to memory of 5188	1528	msedge.exe	119
PID 1528 wrote to memory of 5188	1528	msedge.exe	119
PID 1528 wrote to memory of 5248	1528	msedge.exe	120
PID 1528 wrote to memory of 5248	1528	msedge.exe	120
PID 1528 wrote to memory of 5248	1528	msedge.exe	120
PID 1528 wrote to memory of 5456	1528	msedge.exe	123
PID 1528 wrote to memory of 5464	1528	msedge.exe	124
PID 1528 wrote to memory of 5472	1528	msedge.exe	125
PID 1528 wrote to memory of 5912	1528	msedge.exe	128
PID 1528 wrote to memory of 5912	1528	msedge.exe	128
PID 1528 wrote to memory of 6096	1528	msedge.exe	129
PID 1528 wrote to memory of 6096	1528	msedge.exe	129
PID 1528 wrote to memory of 5712	1528	msedge.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://kikoff.com/dashboard/credit-account/statements?statement=GMLYEN7FG4GO7RH4
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a8,0x7fff7126c188,0x7fff7126c194,0x7fff7126c1a0
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,10920959179913160954,4472189255285561241,524288 --field-trial-handle=2176,i,9288781537701987236,10126746429363863813,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,14489252572481384919,18295515873560913715,262144 --field-trial-handle=2176,i,9288781537701987236,10126746429363863813,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,3647599026331002431,1537608476425788529,524288 --field-trial-handle=2176,i,9288781537701987236,10126746429363863813,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3284,i,2343200488630649681,10522763991650691198,2097152 --field-trial-handle=2176,i,9288781537701987236,10126746429363863813,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,10147200513807480588,3087184862138627867,2097152 --field-trial-handle=2176,i,9288781537701987236,10126746429363863813,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,10733149752788367702,18131581744132785580,2097152 --field-trial-handle=2176,i,9288781537701987236,10126746429363863813,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,13344816967185254515,13163947818905145872,2097152 --field-trial-handle=2176,i,9288781537701987236,10126746429363863813,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3592,i,3410472551622784579,8563340265831013695,2097152 --field-trial-handle=2176,i,9288781537701987236,10126746429363863813,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3600,i,16518558457777774362,4624666294913280236,2097152 --field-trial-handle=2176,i,9288781537701987236,10126746429363863813,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,5989031330921459203,4155949323383805732,524288 --field-trial-handle=2176,i,9288781537701987236,10126746429363863813,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,2437959436749037831,4223003058757776403,524288 --field-trial-handle=2176,i,9288781537701987236,10126746429363863813,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5840,i,16721656860476312541,17618143777521579165,2097152 --field-trial-handle=2176,i,9288781537701987236,10126746429363863813,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6056,i,17482645119439964347,345696547309342569,2097152 --field-trial-handle=2176,i,9288781537701987236,10126746429363863813,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6224,i,2009254238570848539,3542251197600826763,2097152 --field-trial-handle=2176,i,9288781537701987236,10126746429363863813,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,11521201595001190226,12994053483437072379,524288 --field-trial-handle=2176,i,9288781537701987236,10126746429363863813,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:8
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,11521201595001190226,12994053483437072379,524288 --field-trial-handle=2176,i,9288781537701987236,10126746429363863813,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:8
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5248,i,12747289697459027540,4141140571695137391,2097152 --field-trial-handle=2176,i,9288781537701987236,10126746429363863813,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5348,i,4065653776517815920,17521039530553223062,2097152 --field-trial-handle=2176,i,9288781537701987236,10126746429363863813,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6828,i,14227505943369191398,16142135298949333200,2097152 --field-trial-handle=2176,i,9288781537701987236,10126746429363863813,262144 --variations-seed-version --mojo-platform-channel-handle=7344 /prefetch:1
  2⤵
  PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=3644,i,6403048203552595503,18370489232679458937,2097152 --field-trial-handle=2176,i,9288781537701987236,10126746429363863813,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
  2⤵
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7280,i,17109182813535275582,4422486080439233544,524288 --field-trial-handle=2176,i,9288781537701987236,10126746429363863813,262144 --variations-seed-version --mojo-platform-channel-handle=7504 /prefetch:8
  2⤵
  PID:5456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7576,i,8692413097955861825,3331100192547204321,524288 --field-trial-handle=2176,i,9288781537701987236,10126746429363863813,262144 --variations-seed-version --mojo-platform-channel-handle=7592 /prefetch:8
  2⤵
  PID:5464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7588,i,3534190236643674006,8214878222862582857,524288 --field-trial-handle=2176,i,9288781537701987236,10126746429363863813,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2912,i,1674620380474023636,2676132562887472093,524288 --field-trial-handle=2176,i,9288781537701987236,10126746429363863813,262144 --variations-seed-version --mojo-platform-channel-handle=7640 /prefetch:8
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,4876348874776590704,4183025034462216960,524288 --field-trial-handle=2176,i,9288781537701987236,10126746429363863813,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:8
  2⤵
  PID:6096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4768,i,5398268768228397787,10610631044652348167,262144 --field-trial-handle=2176,i,9288781537701987236,10126746429363863813,262144 --variations-seed-version --mojo-platform-channel-handle=7076 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5712

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 12104dd3c2fda03eed8e9fe97d1c8c331237df73b825255f2c8a4424f9eee8fc
MD5 0272cacbbb6ed8ce74e6c664a085e187
SHA1 e18e3d395cae9ca66345f804f048f752074420a7
SHA512 d7df299a22bf1ed1d6757011261fcc585bb9aee7db699aa7f37cf58e7bd5302ee7ae45218f61624dc842a99548b44160f0e1bd6af1382db157a77eea1ddef3c1
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7e:fwUQC5VwBIiElEd2K57P7e
TLSH
T175B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 e690ece84cfdff56989bc80519c79c156effac6131a0c4b3afdb013c299971a7
MD5 ed78162449f59a9aca12360e2a5b38f6
SHA1 afb277ab21029cee640ddb88fffd60db562d641a
SHA512 1745358dbe94473c003dd3a8f45c593b5a95b3b22f733e8715c6f062e3f4a17508b68e00f21263b93b4e78ab30f7ef8dccda5e9f0b4c63446cfa1ec89fdbe786
SSDEEP 48:VpVYdGSzMIfMGfNJsHxmTqP4OWIBCivpo7fgWDn4WaWePj4NcjElUcjYtVNHAMte:W1vfM2MEkTDC1rFD4TcijElUn1HAZ
TLSH
T1FBB1D77276A231C1FB52877E0ED09911387C41D7FC1BEFA292B065B50BBA3A34814277
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5937ee.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5937ee.TMP
Size 3KB
SHA256 2471a7f6d14460b259b96a8fb3bc95e544451fcc2161d6cb7bb35d579f27b344
MD5 95165f4406df3944e8182c8414b22bf6
SHA1 e72088c92798c49597ac9ba0ea752e1afbbf35cd
SHA512 d26a0c371a7fb93a7e7a3972bbf1afc3b7bc68333cab4c0025b234f9aa6a72736da5921b42c620dbac56dd3f78ef59b3a647815a49d510b7427dd9e1118ffb31
TLSH
T1FE7151354B4200A2F75203B162D0D2067DBC81DBFD23EE01D3B4A9BA5BBA3534D69387
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 25KB
SHA256 64ef8f0469f5d4067cfabbe585faf9b63f9b9d325ec0330b427b892dcc36f9a3
MD5 3fda986dd8e6eb4ee79655caff17f73d
SHA1 0ac24591dc4c4dff3dd94b7d53d4d13d1136f3ff
SHA512 a5323ab03cf195a8698b95c7333faa44ddd44f5171a78b6c8451357a625b95d854ef098009f4f407bfcad397190c5a5a2e58558cae1555e3bfdeff26d2a099c1
SSDEEP 384:Dp2iGedWe/mKY/Z/DvldRQ5v8ZOyROzBeZ1ALLqTGw3Qo0rQg2v8EDx3oPHsm1dO:vJX81SeaY
TLSH
T171B287F787E6822DDA1156F09F55AE1BCF181628032C383A89D4BE56F7E3862E10175F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a80dbe5e3916b896c302be249a9995d7897c652b5fb6f5d51a4e33d167a5e785
MD5 2a038c0b78616f0302fe28005aa4e1ed
SHA1 4ae947c50086cde759a8ce1564febcc6562cb4cf
SHA512 2e0df274b78249ed04283ace56b32f7827c44b239ee9bc0be86a5d601880b08b9eedef1b5aa24775e67d2770c6707bc2392b4741a38a66a36b2b7968414e1992
SSDEEP 192:sxZpkR+yM/jK1Ml8Mk0/fG/sMSOt9IdpyQHW6+WNhzw/Yz31+LIgrJ:sxZpkUM0/fG/sMSOIHHb2/L9
TLSH
T15642D712AA34A977CCCBD209BA557F53D6F9147392900E54A9FCDA1C04E7AED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6456128366b476ab785065879a351714b68312d6493a3b4f008439dcf6d12155
MD5 ac3b5ad0d1b23963972f614165a5016f
SHA1 3a2ec21d262f2320d381a6048183c4988fc0a9b4
SHA512 209fae249cf7f22ce7efb69e8f9b0b3549760e8ca809b0062031c5227fa68f6cf32d3bd0df5961b6a6dd85c39cd8d0bdcb6ff4c7b9c265e751c91e5b12ec0c61
SSDEEP 192:sxZpkR+yM/jK1Ml8Mk0/fG/smSXtSAdpyQHW6+WNhRFXYzOn+LIg5KJ:sxZpkkM0/fG/smSXQQHHb5X0o
TLSH
T13852D711AA346977CCDBD209BA517F53D6F5147292900E54AAFCDA1C05F7BEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 18c894684a397449ac65b37b4d7908fa7c65c8d3b5ea1aae2e9839016f3bbfb4
MD5 d38cda57a188cb482008c99bac2c4846
SHA1 d23684e320ca1de37435c41600521ba3709aa163
SHA512 2e11e40bcd1912c0352bad4b3731c3913951c91715d6213887722258af7626d926a069e62bad054dfc418757ec87359ae9062f6c86aa375a7f53229fd35fc4ce
SSDEEP 192:sxZpkR+yM/jK1Ml8UQ1k0/fG/smSXtSAdpEQHW6+WNhRFXYzeQ+LIg5KJ:sxZpkkq+0/fG/smSXQQtHb5XHo
TLSH
T16652E851AA349977CCDBD209BA517F63D6F5147292900E44A9FCDA1C05F7AEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 0141d6a3ba49fcd7a5cc99fb50d42336df28f302cdbe33f235f60390004e22fe
MD5 ba54948fe763f5a253c41be7eaba755a
SHA1 a1921dbcdbb3e3cc50a3a3a627bc48a63e82710b
SHA512 f00d253e5ac631a99f201da66b003e04fa712256bda532f1e0e329b0b85a55e445c7c8e9b349da65f7c17a81100f1b3272033b2eddc8b29a8f050772d703cc44
SSDEEP 768:RgW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjuroICiTYV:RgW7kf0Wvqidau1jaa5LA3jl1V
TLSH
T1D7D20B3B680CCB7E4F841E5CEC266F966ED801CB66988D5447FA884C03CB6EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 7240b9b68952c7cba1b2245d411d49cb124e322d4896dde1dcf6ca4d191e2278
MD5 af16040718bf5fda334e6b11109709f0
SHA1 182227621de33110c037ebeadbbfd87253278b7c
SHA512 1c6a7ebe864742ee309d57952cd21c3f56d52f6ca661830a651d9d6e714313fa2a9923273e9e5fba5eec2d4364224329a18d5a3d29360396e8bb45608d1f0996
TLSH
T1FBA0021111545191C40102FEDE4202C9222099900341321284FC0055C864640AE32419
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c9a4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58c9a4.TMP
Size 48B
SHA256 5640d1cc83a9ad0bcc583d8c873c00f924492f09d6f9b4586f2c93a74042428e
MD5 095093c3a7045b17b544994061726f22
SHA1 2b1d70e550b910c2d1fa8fc7d2db0d4869b6cfb5
SHA512 0f856e1073ef092c738cf6768eeded75c58f04cb14d56acd01b93897f4ca9e3fea87883bb3734731c8296264c021b692dd78e96fa71a2201fb68ab64912f923f
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e35bbb0d6bb42eb333d97bc517f47b7c50f091f0080785f4c6dd1c51d7266163
MD5 accdf49b8197e558b8414c8ad2ee1bb0
SHA1 c972747f486c2eace7886758232ab8ccb261924c
SHA512 64c00b7730488eac816fe372e66ca91f2b41a402bf1473494cf446627a0ad24b62ce56027f5f1243899c96ec927e348dd6223fb80a90a040c9750abffada128e
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTnnIFK8sgHyNzIhKowUxin2CwYY+CollILi+K4Lgk+8W:KIbCKcnnGK8siGziKowP9qKGoag
TLSH
T1D3A17505B17A12013C3E2D68A2AB86371F4771A33418A5EF7FB924610EABE515DFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 7bd7fc7e1415d433f04e02aed042e6527805081ccd0b7198626e9ababa250a06
MD5 ca40020eaf349ad5059f65b35230e38d
SHA1 0cac253618890f13a6f62fe7ea5410c1120b86a9
SHA512 f5c6019da5f66901d4751e8b405ec22421f797c9ff0622b837dba7c99fdc05b2094511f686287e55df0897ada6cfae798b0c01243b1c593e79cdd1ee95f70af9
SSDEEP 192:uCALsNgFQH6BBb5+GQmiU1Y6Td4aGBPKnX+FdG4m0PbFC1SJrEQdNNq+4U8:VWsNgFdfbQiLyLdXm0CEJr/iU8
TLSH
T17B321B316C749C6B5DA3B195F4873A139FF4413BAA842F54E6EC6B1C05EB7AC230A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 749379dbfabac2933475729bd08d4750fbeda2b5a449dbbc50fb7f5c138352ec
MD5 db53803ce08203cbf74f370330f1324d
SHA1 fe6c626700b6bef5deed969fd70ebf452d5d124a
SHA512 a3e12a613c5873b6e87f1a76765390dc4c0624e9551d7d8efdadc3127d0a3b3314696aeb738e8297423ee21d1b9ebd79916db57411842db2ac572dd667b92790
SSDEEP 384:ZjZcIhsNgAdfbQsPLyLdXm0CEJr/iBeRs9JKgqijUqhOGN:Z7hwf0cwvh/iTjKgqmUqhOGN
TLSH
T16A929E3058355D7BA9E7F181F4863B174FF89037EAC46F94A2ECAF1C019B698131A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 49e375945ee85a082a51b9fe2dce2229603f99430a8e62ed8e5d5d797256f84d
MD5 06d45678d309a592d110dd17a740feb8
SHA1 24713241c16f0b078cdfbfb53098fa532a1a80ca
SHA512 76a4a04d61f72785634e23110b831f40192440eecb9a4dc8b8381218bdb86bb65a400d049a2c4163af341e3232e6d9ff3369908c352585debe4e5750d177db33
SSDEEP 384:hriFiZcIizsNg8TUNTUlIlAdfbQsPoyLdXm0CEJrsiBeRs9JKgqijUqhOGN:hGFQqxwgqf0LwvhsiTjKgqmUqhOGN
TLSH
T11CD23BF148D7893AE9AEA743E77D2E124EFCC067B5806A54B3D8990CCC561BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f934e1b034245fb9d060e0d30afbe98f5633bcd5ffcb996d28f20448017c6357
MD5 c359f5032abf651caac7310fa6a80c5e
SHA1 36371ab3408a2f6ea27ae0a382bc8a75865fafcc
SHA512 f207af3165de24fd7060a8f137407c8778d06e42e000a562e2eb5a0d3a041b72cbe31124390cf413f47269f00926fd908eeda214dfa94717ea5576d73a2b5e19
SSDEEP 192:MONq64BAQmiUyE1rW5GBPKnX+FdG4m0+aDyOU6:MONq6eAL1WMdXmgJU6
TLSH
T15602E935AC786C7B9EB2AE45F4873B175FD8113BA5842B44EAE82B1C009764C234282B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 b2ea0c7a9e529c58e2411fd3c8d1cfc6c87bfc3148231b539db2eb1155920d2c
MD5 7a73f2d410c498272c8da6d6926f1315
SHA1 9edb4b82e343402d3cdac7ed8b2b5771103de45b
SHA512 a819b4ee66b9afe4524a728f04c1b6a0e1bba190ba20e3989d5a1630b712f60921c39052a57de9c6df88a5d1f8cb479382384f3ce592baebb199d2d80e1f52b5
SSDEEP 384:ZWsNgydfbQsPLyLdXm0CEJr/iBeRs9JKgqijUqhOGb:ZWCf0cwvh/iTjKgqmUqhOGb
TLSH
T183726D3058799D67ADE7B1C1F0873B135FF4447BEAC42F94A2ECAF0C019B698630A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 22367c0c686427ee5eda2af941d5c00eecca2a264ae7b20c2206da8ade8e8afe
MD5 1106a755502766d84998b01138bdd2c6
SHA1 fb5cbe692736172e099d5159dcbd8f73d893e407
SHA512 e8c260f780fa902d6a2a2f8f40e8f594f2df5b0256a45866f2c281e4d86e548812320672492652a7c62deb92baa7bc5bd3eb2f71b74df307061f97f58b658b59
SSDEEP 192:5ONZ64BOQmiUyLru5GBPKnX+FdG4m0PbFC1SJrEvWwNq+4U6:5ONZ6eKuuMdXm0CEJreiU6
TLSH
T14E123B31AC74AC6B5DA2B191F4873A135EE4422BFA846F40F6EC7B1C01EF79C2306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c1f31696-70df-421b-be2b-f699099a003d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c1f31696-70df-421b-be2b-f699099a003d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 11418f9be08a7ee036a08ff4ea0cee562a96281ca160f8e9cede239e347afa5d
MD5 a8e35b4e7a11b61a5c2f9fb267793270
SHA1 5f3c6c34d8c85bd34dca3e624f026f62c4f32a5a
SHA512 4fd4be9e68cf262bd2d382ff1bb0d45e090bfe534b9f6570f68458d634b6f1837af377b4f1e80ef81e779ef98bd55ab1c21324421209f6729fb85bf8203d2ecd
TLSH
T1D441C458B6F91148B3B7AF16ABF6A86D487BBD672E06D4AD00110D4F0A23A41CD62737
MD5 SHA1 SHA512 TLSH

Submit Download