hxxp://verdent[.]ai

Analysis

user interaction
yes
max time kernel
1048s
max time network
1049s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 02:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://verdent.ai
Sample260804-c4yaba1aka

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2996	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302847329774608"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{B486CF35-120A-4069-AC1D-3ED48453C889}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4504	msedge.exe
4504	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 1728	2880	msedge.exe	86
PID 2880 wrote to memory of 2996	2880	msedge.exe	87
PID 2880 wrote to memory of 1584	2880	msedge.exe	88
PID 2880 wrote to memory of 1584	2880	msedge.exe	88
PID 2880 wrote to memory of 1584	2880	msedge.exe	88
PID 2880 wrote to memory of 2272	2880	msedge.exe	89
PID 2880 wrote to memory of 2272	2880	msedge.exe	89
PID 2880 wrote to memory of 2780	2880	msedge.exe	91
PID 2880 wrote to memory of 2780	2880	msedge.exe	91
PID 2880 wrote to memory of 2780	2880	msedge.exe	91
PID 2880 wrote to memory of 1492	2880	msedge.exe	92
PID 2880 wrote to memory of 1492	2880	msedge.exe	92
PID 2880 wrote to memory of 1492	2880	msedge.exe	92
PID 2880 wrote to memory of 4644	2880	msedge.exe	93
PID 2880 wrote to memory of 4644	2880	msedge.exe	93
PID 2880 wrote to memory of 4644	2880	msedge.exe	93
PID 2880 wrote to memory of 1560	2880	msedge.exe	94
PID 2880 wrote to memory of 1560	2880	msedge.exe	94
PID 2880 wrote to memory of 1560	2880	msedge.exe	94
PID 2880 wrote to memory of 972	2880	msedge.exe	96
PID 2880 wrote to memory of 972	2880	msedge.exe	96
PID 2880 wrote to memory of 972	2880	msedge.exe	96
PID 2880 wrote to memory of 1676	2880	msedge.exe	98
PID 2880 wrote to memory of 2720	2880	msedge.exe	99
PID 2880 wrote to memory of 1676	2880	msedge.exe	98
PID 2880 wrote to memory of 2720	2880	msedge.exe	99
PID 2880 wrote to memory of 2496	2880	msedge.exe	101
PID 2880 wrote to memory of 1056	2880	msedge.exe	105
PID 2880 wrote to memory of 1168	2880	msedge.exe	106
PID 2880 wrote to memory of 3348	2880	msedge.exe	107
PID 2880 wrote to memory of 5052	2880	msedge.exe	109
PID 2880 wrote to memory of 5052	2880	msedge.exe	109
PID 2880 wrote to memory of 5052	2880	msedge.exe	109
PID 2880 wrote to memory of 4152	2880	msedge.exe	110
PID 2880 wrote to memory of 4152	2880	msedge.exe	110
PID 2880 wrote to memory of 4152	2880	msedge.exe	110
PID 2880 wrote to memory of 3940	2880	msedge.exe	111
PID 2880 wrote to memory of 3940	2880	msedge.exe	111
PID 2880 wrote to memory of 2972	2880	msedge.exe	113
PID 2880 wrote to memory of 2972	2880	msedge.exe	113
PID 2880 wrote to memory of 2972	2880	msedge.exe	113
PID 2880 wrote to memory of 4504	2880	msedge.exe	114
PID 2880 wrote to memory of 2352	2880	msedge.exe	120
PID 2880 wrote to memory of 536	2880	msedge.exe	121
PID 2880 wrote to memory of 2352	2880	msedge.exe	120
PID 2880 wrote to memory of 536	2880	msedge.exe	121
PID 2880 wrote to memory of 4592	2880	msedge.exe	123
PID 2880 wrote to memory of 4592	2880	msedge.exe	123
PID 2880 wrote to memory of 2836	2880	msedge.exe	125
PID 2880 wrote to memory of 2836	2880	msedge.exe	125
PID 2880 wrote to memory of 3452	2880	msedge.exe	126
PID 2880 wrote to memory of 3452	2880	msedge.exe	126
PID 2880 wrote to memory of 1704	2880	msedge.exe	129
PID 2880 wrote to memory of 1704	2880	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://verdent.ai
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x218,0x248,0x7ffcdd16c188,0x7ffcdd16c194,0x7ffcdd16c1a0
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,17849168506153443387,16729689503377343208,524288 --field-trial-handle=2280,i,7692407858548449914,162985284187359694,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1860,i,5161831090738141938,18158035631289462951,262144 --field-trial-handle=2280,i,7692407858548449914,162985284187359694,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,9441637320630261571,3604248856608257369,524288 --field-trial-handle=2280,i,7692407858548449914,162985284187359694,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,16375100840209890194,15021372699269464578,2097152 --field-trial-handle=2280,i,7692407858548449914,162985284187359694,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,13027002293843685983,17680722744734543365,2097152 --field-trial-handle=2280,i,7692407858548449914,162985284187359694,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,5229928747066660973,4255047527360333104,2097152 --field-trial-handle=2280,i,7692407858548449914,162985284187359694,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,14895728962302805243,8423664937936816653,2097152 --field-trial-handle=2280,i,7692407858548449914,162985284187359694,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3668,i,3293948679556808533,14044140947604695788,2097152 --field-trial-handle=2280,i,7692407858548449914,162985284187359694,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,5247057006590378309,11806116910712546655,524288 --field-trial-handle=2280,i,7692407858548449914,162985284187359694,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:8
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,9590238540341864661,12973233785419152737,524288 --field-trial-handle=2280,i,7692407858548449914,162985284187359694,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:8
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,5801497630380086923,3949070997147054360,524288 --field-trial-handle=2280,i,7692407858548449914,162985284187359694,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:8
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,5801497630380086923,3949070997147054360,524288 --field-trial-handle=2280,i,7692407858548449914,162985284187359694,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:8
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,6033505942038367581,9477495287323711709,524288 --field-trial-handle=2280,i,7692407858548449914,162985284187359694,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,436972428025197965,16647040584556470281,524288 --field-trial-handle=2280,i,7692407858548449914,162985284187359694,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,14018056837359021192,10097451774067420642,524288 --field-trial-handle=2280,i,7692407858548449914,162985284187359694,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5252,i,8150031831185484063,2383792702360204738,2097152 --field-trial-handle=2280,i,7692407858548449914,162985284187359694,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5572,i,7885254092303216077,2150654226227549232,2097152 --field-trial-handle=2280,i,7692407858548449914,162985284187359694,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,4294127783968679591,7279062235484362320,524288 --field-trial-handle=2280,i,7692407858548449914,162985284187359694,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:8
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6592,i,16679112747479529664,13171815955249995599,2097152 --field-trial-handle=2280,i,7692407858548449914,162985284187359694,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5616,i,11315473892137185791,8578295486635310473,262144 --field-trial-handle=2280,i,7692407858548449914,162985284187359694,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,9166963484724254082,8949697998102732028,524288 --field-trial-handle=2280,i,7692407858548449914,162985284187359694,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,17946251798390813322,16584853440654708788,524288 --field-trial-handle=2280,i,7692407858548449914,162985284187359694,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,12799480090987562015,8932607942209878102,524288 --field-trial-handle=2280,i,7692407858548449914,162985284187359694,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:8
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,7164957321448469180,2881722545811653122,524288 --field-trial-handle=2280,i,7692407858548449914,162985284187359694,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,7976075476535517399,12168625000170892878,524288 --field-trial-handle=2280,i,7692407858548449914,162985284187359694,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:8
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,9146161050744556811,12304669657539224129,524288 --field-trial-handle=2280,i,7692407858548449914,162985284187359694,262144 --variations-seed-version --mojo-platform-channel-handle=4036 /prefetch:8
  2⤵
  PID:1704

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 1fe65dd88e905125f0fe0975dd292827a1ca52403738a77f7c2f051c91e6a77d
MD5 df267ee81dd4141104df7a63f184bc90
SHA1 eeb08693f3534f9a03920f39d2bfbe940a3ecbce
SHA512 a2943548255303b2c59b915e78dd8f1052b7dfcff68db50ef5ab4d0a1b23486575c385ce3ffff755cca7b30e9f3d908a9bcceed728ac91fdbcf1ed2b67171e6c
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7W:fwUQC5VwBIiElEd2K57P7W
TLSH
T1E7B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

000003.ldb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.ldb
Size 330KB
SHA256 c512d6ead3cca3c353150a6a0f482a16e14146b6e5ee15ecd71b7ba04ecb5fa3
MD5 f22972ef2fc0752a972f07f27a204d7a
SHA1 43fddd2cf289985a01b58ae02a26da6bef978682
SHA512 9b95815e9b5c2ddc9fa48fba3323fa72a9d3f33522b8f9b2aac99342ec676a7cd29b8805321f9e130c5d06287b8fb81178f935f32e820388e474873728b20c9d
SSDEEP 6144:lrJal6K1U8TCEI97rUfbBDWEIYoIuxCgs08MnIznfRzwA1hJnys/vCkH3:lrcllWPEIegZrxCHj2I7fRzwA1hNri23
TLSH
T11A7412F36C75D34B41B643CBD5FE74C6F6A98AD4640094FB610E4724A10F7827AE13AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 70f675603e3fef44571ec3788a76a6cff3b229fc8fa1b74a5582f915a7a7a5ff
MD5 b62781181d5c5a1496a588b5d7d8cb1d
SHA1 97007e6746c9d6e8a3792558927dd6f3d2330fd8
SHA512 bab6c89bd4e1c55456fdf0f3041a556024b8db8b991623fd46c24f69e22224f77e1deae5d8478e14ec272da05bec1e9efd9722144aa8143ba5addf95d1d578b0
TLSH
T152E078C409C4C39ED515644761E8470C45D0360FEED4FDD577289C4C3083450F6D597D
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 96f79ae22aa3806a388c7e65a3e6a87c945972d3571b24b50a9eabdcc91d0cc3
MD5 a32afa991137ed3d1b156e48eb3c0e02
SHA1 d28997c56fc907fec270485475086181b0cfab3e
SHA512 0a042d033271aad3878dd1d43367888b5b8e54d538d1cbc98427e6d3ca4a8a5ec804cd48583e18eadeb7f3c00c0d97ca24e5a476bb1457b14c503766c755b74a
TLSH
T131E0208816C4D26D9500644B72E4530C42C0370EDEC4E9C517548C883082550E39AA74
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 8ba7d35bd6877fe6f246aab01772cc197e41b0bad2152816ae02d187ac339a50
MD5 adc60ba19081cb49770428f78c5996b9
SHA1 2680acab87b061451c4ca04bc29cb7d7e685a02f
SHA512 996f7a0f2a13b5005ac73ea13eae25d75c5077ce707cabf3a29381b86d17f5da403c6762600eff24212acec980b33ecf94aa570df0950ff62702b04a8656d223
TLSH
T147E0D88912A5C1B55D03DF47B059421481A8771FBE4CECDA3378A88E2442C055197CBD
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 3162af488c283bbdb6565f4200727821b4e60ce0c47948b8d5b3655271a2625a
MD5 7b9f1e9c5ca7be7a0fd051116a616b72
SHA1 8a88b30a2e0c8a2c94e5512f0a5bb56573a6d8b9
SHA512 2c13705b178f640305a8b7685e6b6a7e49374c53b0713e7e54da2205c3c290a3f79ad3280c111728c5383ffc23941c73a23b34049e67b876aa1915e6e2992364
TLSH
T183C08058798C845DC280187FA726F400177155115817962705A1FCD031406A01F2D124
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 2200f6ca558fd8eecd3143a56f985a647042f3c9e43ee179804a8c48043ab52b
MD5 4756ef33c57ed9167b1f1aba37931369
SHA1 c82b4ae8c2a9d2c2a3e1c5af0c14e02f84c6c356
SHA512 9db847a292e7852c25f3e1daf16a1f2eff80266981bd0385556ef28bba4ff549bd89619f4e14ddad9a7a116a5d7b3361420e52f7c8f3981fad26caaa31b676c9
SSDEEP 48:OdrS00fp+tTnHvpY0SUYL5p3FyPv5w0Ey5xnnyRUYClTwWyLUO980tNXmqJoRP5K:otyWPyKYlPUqxWntcUOvXmqUP5CJUu8i
TLSH
T15CA16F7D2A6549FBFBE82171F0E00A6735F0C6D1AF979EA11C51C4FE2116F0184AA0AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 d6ad56c88c95bc3ebcd6f27b5d83b389c722fdf96787824e06df464079260feb
MD5 09f85276b0d4c1afc32f3c142b1e700b
SHA1 0d3229838e7f62b262cb896394db1f7c5b7fdeea
SHA512 25032a6d91ed568fedcc3adea9505c555521dd32007816baec3bdb3d1f3de66553fe005199b09b1392ad221a6b274036bd8c3a5ad3510e5b1808ad40acfd64eb
SSDEEP 48:mdrS00Pp+tTnHvpY8UYL5p3FyPv5w0Ey5xnnyRUYClTwWyLUO980tNXmqJotP5Cz:QtCWPynYlPUqxWntcUOvXmq8P5CJUu8y
TLSH
T152A16F7D2A6545FBF7D82171F0E0066735F0C5D1AFA79EA01C51C4FE6116F0284AA1AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 fe435ff1b27ae74d42d2f15ca0244543002b8b5a90538d1b96cba0b1a23ffdfa
MD5 5f5f6a1bd185a96ff4c4596aa60bdfda
SHA1 ea224b40e539ff3dc59713da8ef92062c4bc6a5f
SHA512 5aee627f329309b3025a103cc006a49cd1b0e899bfb9a7a9752fdea52ea86fd4c107f76bc2ca6b2eefc4fe57a72d1dbaa58c81dd16344b09472aac05057ffc95
SSDEEP 96:xJy+CAxjl9Kqk1ntbvLqXmq+zH5ChJhuM9e:xJy+CAxjuqkXbzqXmq+zcuL
TLSH
T1BFA1727D2AA554FBFBE82171F0E00A6635F0C5D5AF979A621C11C5FE311AF4180AA0EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58f613.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f613.TMP
Size 3KB
SHA256 b20ff72e6644fc6bca8852ce875054849392cd95354b7ae4dc5bff4a3860432f
MD5 dd6abb7c0ca0e72454532898c0c27a6c
SHA1 16cd501af5d5f510e3607099175dd6a20568c714
SHA512 b55ac574c561c892290025f3e8366ee1edd142eaffa2a7f5ffed052aff20d3cc0ed8d6afedd38dec8536cecb7a16176ce2f08aa3e2ebdd0e36c62697cd478b15
TLSH
T1FB6109360E5688B7F3A81171F0F4066B7571C5862FA7EA761D14D6FE311AF1680D21EC
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 ef0757d3bccfe4aeba7065f7cb2383f9347f9ae13f587a1fc9d28908d93c9108
MD5 8a6481696df581d92a52e57deab40053
SHA1 50263d0f6806ec1c479f79a0f4099ea941e5de49
SHA512 7cfab51ce6074f87d8b9a4a073dfbac022c9324e3fee34473a699c72a55ee00661f8ce47a1e78b30fbbb364bfdeeb8993d9fd56ce2ba94fb38dca192dca318e9
SSDEEP 192:DWxcr+06ebJLe4lvioGggYNLmGCidBxI5dYR1YGjdFqZt1VRc3LkxoyMbRZI/Gjf:DWxt06ebJLe4lvioGggYNL5CidHI5dYl
TLSH
T1B7F17DFF43F0862EDB1592F8AA69AD2BCF690418475C387A89F16E5753F1071E101B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 a43ca6530a4f57a24233fd5cee48d6bb22d38322d885a242eb57e591d31a842b
MD5 b9d04f1c62757252cf63a884b49c4bf3
SHA1 74b42b48454aa215ed51d368e2320302f8281f78
SHA512 c080b548ed1f80adc133dc9e2e21e0bc29cfc9791ec16c4653bc05cdb7b04bf67df296c0e3f0333904f55d12ddb82f05ca2214c5cce649d14a4bbeb26bc1033e
SSDEEP 192:D/Izr+77ejcSe3WZw4AyLmGCblBxI5eYah1K1bR71jdovWwZZMt1VRoEZUx:D/I+77ejcSe3WZw4AyL5CblHI5eYah1F
TLSH
T1CC12A0EB83E4452DCA5596F86A75AD27CF6E051843683C36C5F5AE4B53F1471E200B0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 ce5efafc0b51ab2cde42d7d46a1831321cbb3fc1b00d421ecc9875249fcaad22
MD5 3cdebb10a088096a642c476279e5b458
SHA1 45c75a05baebd3859d9ca0c8776f6b1af08ef400
SHA512 0c6838e9546537472da07fd9bb7315f266ecd8020b42325216cb03c25b7d6e2f1d39605c7f18b520c5b984ae60d6f5b11c11687e8b90d327915cc697ae8c989b
SSDEEP 192:DWxcr+06ebJLe4lvioRgcoNLmGCidBxI5dYR1YGjdFqZt1VRZ3LkxoyMbRZIjj4y:DWxt06ebJLe4lvioRgcoNL5CidHI5dYt
TLSH
T104F18CFF43F0862EDB1592F8AA69AD2BCF690418475C387A89F16E5753F1071E101B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 07b685db5e651e0911610cbc7a2a2201ee916a76794538a8473970bc50fd4fef
MD5 de4597a55f09bf47221d46d59d792fdc
SHA1 613b6b247e8b138b868e1d3a76f62b44356ce6a7
SHA512 96b5ff8303949c8a2c04852b2401074b58bb12da23de4e4519ef88c7ef875ab00b688679f3aa6a31c32007225208d0367d6a61f4fd1a4f43af1ddd8792a95288
SSDEEP 192:D/Izr+77ejcSe3WZw4UgcyLmGCblBxI5eY+1KGjdFwZt1V1c3wGkxPyebRR6tAx:D/I+77ejcSe3WZw4UgcyL5CblHI5eY+E
TLSH
T14F129EEB87E4852ECA5592F86A65AD27CF6E051843683C3AC5F5AE4B53F1471E200B0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 de48f02fe95c42ac52689135c20d03c51102f993610319a522cc7db53a3d8257
MD5 af340eda11b43a1be06d67b10de489ea
SHA1 5bae98b8ec6eb264e96f9b24ad6e4d83ea8b3c14
SHA512 359159f1123b737de6b8b2be234d79db0c91667ed8f7a1d2ec61d1643535de9e990807cc0e42d6f763caa919bf601a269a60d608c943efd09fdf9b885dc497f7
SSDEEP 192:sxZxRuyM/jK1Ml8Mki/fNsYez5EEdpj3HW6+WN/sL/YHfNNIgrJ:sxZxMMi/fNsY27zHbI/y9
TLSH
T12642F9156B34A977CCDBD21DF951BF53D6F90472A2900E44AAFC9A1C04E7AEC621381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 15ec3b79dba174129687adee2d4b89cd7040e9a36a83b213826198ad5615e525
MD5 de6c64db0950a66e1b1a57c09c9c75f2
SHA1 ec6e7418e7dfe25bc9fa5411c7929c542e405a6c
SHA512 caff44af934b1b629eba5948f042e84c5220bd29f7f8843c9745da588964c3e508ad33ce9b7bb4b8ef9a14933a4141ff72cc71f0d65c0286d6af98a9f5a19fb2
SSDEEP 192:sxZxRuyM/jK1Ml8UQkki/fNsneM5EIdpV3HW6+WN/yRxYHuOmNIg5fJ:sxZxMq/i/fNsnpddHb8x/j
TLSH
T1E852F9156A74A977CCDBD20DF941BF53E6F50472A2A00E44AAFCDA1C04E7AED620781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 df3e540787c5cfd0dd63a677cf1c5c47ce02f90bf80de0e05aedd4f84e1dabf6
MD5 5a8ec6427a574c4c65362456ea015a9c
SHA1 d9599dc077c996c3769c549632a7116829874294
SHA512 476de218e8ee301423ff3ad4db274e4cc50c3dd28aa9ed166d53136aebbaa4519f65b5bbfc6515418b42ffb1043d067a350eb30e1288ee8d5e40d5f41894b5f8
SSDEEP 768:4bUZYTMWvg09o8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RTroVE0Q:4bUZYTMWvg09ou1ja7eLZmRghQ
TLSH
T11EE20B3F280CCB7E4F844E9DEC2A6F863DD801CB5A584D5447EA894C03C76EB512B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index
Size 1KB
SHA256 ed109400550794df94703ef0a920a23393f707b05eccc101efb5dfae204dea9c
MD5 026a9e0e3c8dbe2bba2e3422cf192e3d
SHA1 6ccbe1d430b9422f8b72c5050a2ece9b2724cc63
SHA512 8c512aede36b900b43bee47b4ee4a0d6d8025b36c2b619fdc8d15b0697f1dbd54bce052422f63865e05dc1b466f32dc6170451d881b1b045af81e734b6d4f291
TLSH
T11931338D8EA0D99FF4A481B11176A1A47770D8DD4B25B7138C2C31317E2735E291B5DD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cafa0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index~RFe5cafa0.TMP
Size 1KB
SHA256 48c1b56a9a7c2c5e028767f7dfeb746f4f78435579a2c66a0542dd65bfd019f4
MD5 14e1b9a2cfefbdf941d09a4d4885c8bb
SHA1 73adc5ab2df8b3ab37e8cf25266ab357532af49b
SHA512 e2de721f40761585a974ba661f86e17ee414a2396c27aabb329d1e12546e50a9051b98b5bd9133bbd689033fa3661cb3429ea333ac0819a9f14af9cd1beb1644
TLSH
T14431424A4AC18D1AF4C4507B0EA7A8B87335C8404321B793A87C62399D25B8E2E5F0DD
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 99691a7437dd2ccf5d6e750e8282bf3ffb7836b5c5c6bad0d5aae8c40dc551e1
MD5 f4c831116f7f1a60274737f7f85d399c
SHA1 e334a80b6101402f6a9d542e21e866942c0035e5
SHA512 dc96bf3b8f9c5b8a2a05f441504ae1c176b7bf998c3cff3f07300e9ea77464d0e75b471bfb270c23818ad4c694201c2897d9b68584c2ba04873f3188f1f1f5c3
TLSH
T1F4E0C0F37DFB1820AD7FC3D75471E4A402013CB8CA4CAD8E00AEB2A310B23102806C32
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 df575c23ba8fa7c27eac8a11dbedbcee79c3a0fb5bfb19ad64a43a7fac615e79
MD5 c1aef0709f13a004049d514cf8f19d28
SHA1 af35536ec0e513e11ce847c6569832990f08b059
SHA512 e88535d804a918cebd3c4a86ae7b6bce59862e884b195fa0bb8f00a3056ae82b284351216671906d6a9d49e17a43eee5822e019c5d8e4b49992c7a23d4b19866
TLSH
T19FA0021101954955C2D46370D0833189A714CEB0C3A5335740A402A59DD45946E66815
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587356.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587356.TMP
Size 48B
SHA256 c0b01b1ca92845b60f02e526b2f60ccea36a0c97f7dae77812e3e33253ab32d1
MD5 e7160654667aec22ae75f7349bf9bed2
SHA1 f0ae0096e44525f1bf14b0362a640d114b190176
SHA512 3346ec6a4c4fb18e645400c03730a0340680352c2488ae77bbc22429b274ca78b29b9c3559d1b0fe6e04343a637be5cb821bd3a436039a1ff587746e194cbd70
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 05021434e779d1ded3f8e889ca95adae11afe8cd2d1016d4c06c4a2cdd16d741
MD5 0cb8bc59489ecfc96a00ab37a3f8b191
SHA1 aaa8a2d12ab16753ed366bedc1961d7efc2c808e
SHA512 ee8913c9fdbbe7a2a962432f2c69fbfd1d4dd854d415c2fccbec274a72e19f240756b143afb77159ec3c2224cb5655f582b6c665805cd1c4c49f66b43a7cf806
SSDEEP 96:KA1eK2A08AK92uywgK1WKN2KeI6SUwKJGJ:EuvzgxDy
TLSH
T186D1295670BA03417C7E2A4D836487169FC1B2973028A46B7FAD05B25D27E21DEFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

.usage

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\4\FileSystem\t\.usage
Size 24B
SHA256 fac0a85e4f5907c8036b0052214b777ddbacea9420e5903526272dc76bd4c7b6
MD5 e1edf83f1dbe0a1640e5800ef2f44b90
SHA1 58e8f31a1282e84a05c6960d6ab461d6ccef42cc
SHA512 151b19bcb34d72c304d02f2830f577036c5d2156499cb998643a87a3010544e5a4c236f8458786ea4b3416aaa4fd1ea96fc3bfe1ab0c5baebeac29e5427ca417
MD5 SHA1 SHA512

Submit Download

00000000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\4\FileSystem\t\00\00000000
Size 1B
SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
MD5 93b885adfe0da089cdf634904fd59f71
SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\4\FileSystem\t\Paths\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5909ba.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5909ba.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 f5ba4a7f05f1ec635f39d743b2e5925e97036dae6da3f4efe9013ff529a68953
MD5 805162781311a3f7592c125a40a013eb
SHA1 62f8853cb6ff3c41558b51922568b91bec443180
SHA512 7666f518a3a10309745058c5ce45fdbe199a5770a434f02eee263278fd195eee10ff053cfd5a58b688de033c51bb45e8845213dd325d00d2d7eaa68cd568b33c
SSDEEP 192:uqLsNulQdaftKVxQmiU1tft4zX5Obd+jVjzorrAXKi4QiqC67hNIo:rsNul6aFWnizX5od+F8rAXPi6lr
TLSH
T1AF422A35A878AC674DE3F555F44B32178FF840A7E6886F90D6EC2B1C009B6AC534B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cd8f3c4c23549b450c6779f06a10b58aa4c486b40df8a1ff888d5f300373ab75
MD5 8612ba597ae6d60b773cda2fa91c28b1
SHA1 7379890b52296ebb3463dae2a483979873edc717
SHA512 a27b08ae9c3b61256a6459e6c184068e6c27506dbe43b708a0d5a6f65f37fdd9c6e1856e3a7e5146f70335fe72b27e1fe87ff480820f5d4792d6f8aa6fbbd491
SSDEEP 192:yONr61VWQmiUyclgGX5Obd+jVjzorr+/aA3GSU6:yONr6WHgGX5od+F8rN1SU6
TLSH
T1B602C93568686CA78EF2BD49B48737235FE51067EA552F80DAEC1B1C00D769C2346C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5ce619d959815623ba2925b6fe2841e5f6d9bcddd8aefcb95cf51d5460049539
MD5 99ef3f9a3c2dac5aae1bc23fbe163df9
SHA1 ce2b3b2c3d7e73088364d21dfc01d089d29523c2
SHA512 4945039db18e5bd5cf046bf61de3358b0185fc96aae67cbd05e41e1335d6b94d86130142b72b3d6c7901eec095af97fcf57faf5c162130da926478bc68c8888f
SSDEEP 192:wON/61pWQmiUyvl+GX5Obd+jVjzorrAXKRjJiqCU6:wON/6SO+GX5od+F8rAXQiU6
TLSH
T172121A35A468AC678EE2B455B48B31139FE55167EB847FC0D6EC2B1C00DB59C634AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 da740cfb66b414a18a17ccd4725f8f86fefe78be7746c0f65f0c46eadf2b97a5
MD5 26dc6fd8aee35a60b8e01cbf49887bb1
SHA1 58b0ba0c4e6cae26b4a7b95950d51e851d6414dc
SHA512 cc76e0a9692e84713bfe4c48644c71d3d4731ebeb0d3615106094e69bbbfb16501ba2329b0042f7307b4c0cdbea6f3e4ba0096e17c11982d5edb10c177cba94e
SSDEEP 384:EZcIhsNuN6aFWlizX5od+F8rAXPiBeRs9JKgqijUihOGp2:ihdmWOIPiTjKgqmUihOGp2
TLSH
T1B2928D309878AC6799F3B585F48A36078FF88067E7C46FD092FC6B1D019B59C531B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 1feb3bcfeee5a51fdc0ab8e29ad682f90ce4290268ec209a114d13ca39e9d380
MD5 f743d63ab0389436c5a97f087069ea1a
SHA1 ec0adc26e1f246657ca669611b7b3629bdb6ef06
SHA512 5a241ea93e2fd9fa6e33fae849f44742acefe3e57c1fce636b008c81d1b5005a8f8bd9d5cc8626216745acc5d83ea9b5e6149356cba79bac849ef1ad5f3558f3
SSDEEP 384:IZcIhsNug6aFWlizX5od+F8rAXPiBeRs9JKgqijUihOGp2:2homWOIPiTjKgqmUihOGp2
TLSH
T173928D709878AC6799F3B581F48A36078FF88067E7C46FD092FC6B1D004B59C531BA26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 3dc7b8f1be094858af7cc11b47403cb4c0a50527527d85f4417423f0fda49918
MD5 1523963ebe00fa9edd9884bd443b6939
SHA1 824b8a115be18c97fd4437660b873db4493eed4d
SHA512 297372d80a58fea002042d50a57e89e30540ac83cc1b2ba14a586bbca7c42ccdafdd0aabc43206235ed7aa7d4cb682f5aecfa1a5fe413ae8f5813139e2635c31
SSDEEP 384:0iFiZcIvzsN+8TUNTUlIlg6aFWlizX5od+F8rAX1iBeRs9JKgqijUihOGp2:PFQLjwgEmWOI1iTjKgqmUihOGp2
TLSH
T1F8A26D7288A8D97B9EF6BA85F54A32178FF44067D6D4AF90E2EC6A1D00570DC130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a369fa39-f0c1-4ded-843d-13983a2c0331.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a369fa39-f0c1-4ded-843d-13983a2c0331.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7d7e45940849fe9582a4628aff56f351e490e7f9c085d7f0931b6b5286321eb9
MD5 6f948ab94c970405480dbde4c0a46a6e
SHA1 969a8c497c9ec180f6c2475a7b3869e1912862b1
SHA512 ad85c8d20b176275f9fb8b906a673ea50b766646092975f25edb9a8fbcaa6b8f9e4dc1f7c452be4c2cf23acb55efcf4e304b0d4baa26f6bdd6c4d4d0e44a4d78
TLSH
T1E041F698B6FA1058B3B76F5AABF6A46D487EBD332E46D45E10110E4E0627B40CCB1737
MD5 SHA1 SHA512 TLSH

Submit Download