hxxps://soft98[.]ir/software/desktop-tools/614-stardock-windowblinds[.]html

Resubmissions

11/08/2026, 07:42

260811-jjnzgaam6w5

11/08/2026, 07:40

260811-jhwb6avvby3

11/08/2026, 07:32

260811-jde5dayerc3

Analysis

user interaction
yes
max time kernel
381s
max time network
385s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
11/08/2026, 07:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://soft98.ir/software/desktop-tools/614-stardock-windowblinds.html
Sample260811-jde5dayerc

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1836	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134309071953398192"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2058276091-3280583803-376660292-1000\{8C8F2597-D8BD-4016-8B95-3F519206B803}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2116	msedge.exe
2116	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 4484	1668	msedge.exe	83
PID 1668 wrote to memory of 1836	1668	msedge.exe	84
PID 1668 wrote to memory of 612	1668	msedge.exe	85
PID 1668 wrote to memory of 612	1668	msedge.exe	85
PID 1668 wrote to memory of 612	1668	msedge.exe	85
PID 1668 wrote to memory of 3836	1668	msedge.exe	86
PID 1668 wrote to memory of 3836	1668	msedge.exe	86
PID 1668 wrote to memory of 2432	1668	msedge.exe	87
PID 1668 wrote to memory of 2432	1668	msedge.exe	87
PID 1668 wrote to memory of 2432	1668	msedge.exe	87
PID 1668 wrote to memory of 4612	1668	msedge.exe	88
PID 1668 wrote to memory of 4612	1668	msedge.exe	88
PID 1668 wrote to memory of 4612	1668	msedge.exe	88
PID 1668 wrote to memory of 4044	1668	msedge.exe	90
PID 1668 wrote to memory of 4044	1668	msedge.exe	90
PID 1668 wrote to memory of 3864	1668	msedge.exe	91
PID 1668 wrote to memory of 4044	1668	msedge.exe	90
PID 1668 wrote to memory of 3864	1668	msedge.exe	91
PID 1668 wrote to memory of 3864	1668	msedge.exe	91
PID 1668 wrote to memory of 2160	1668	msedge.exe	96
PID 1668 wrote to memory of 4980	1668	msedge.exe	97
PID 1668 wrote to memory of 2160	1668	msedge.exe	96
PID 1668 wrote to memory of 4980	1668	msedge.exe	97
PID 1668 wrote to memory of 4712	1668	msedge.exe	99
PID 1668 wrote to memory of 2904	1668	msedge.exe	100
PID 1668 wrote to memory of 2904	1668	msedge.exe	100
PID 1668 wrote to memory of 2904	1668	msedge.exe	100
PID 1668 wrote to memory of 5064	1668	msedge.exe	109
PID 1668 wrote to memory of 1816	1668	msedge.exe	110
PID 1668 wrote to memory of 1564	1668	msedge.exe	111
PID 1668 wrote to memory of 5052	1668	msedge.exe	112
PID 1668 wrote to memory of 5052	1668	msedge.exe	112
PID 1668 wrote to memory of 5052	1668	msedge.exe	112
PID 1668 wrote to memory of 2336	1668	msedge.exe	113
PID 1668 wrote to memory of 2336	1668	msedge.exe	113
PID 1668 wrote to memory of 2336	1668	msedge.exe	113
PID 1668 wrote to memory of 4864	1668	msedge.exe	114
PID 1668 wrote to memory of 4864	1668	msedge.exe	114
PID 1668 wrote to memory of 2916	1668	msedge.exe	115
PID 1668 wrote to memory of 2916	1668	msedge.exe	115
PID 1668 wrote to memory of 2916	1668	msedge.exe	115
PID 1668 wrote to memory of 5064	1668	msedge.exe	116
PID 1668 wrote to memory of 5064	1668	msedge.exe	116
PID 1668 wrote to memory of 2644	1668	msedge.exe	118
PID 1668 wrote to memory of 2644	1668	msedge.exe	118
PID 1668 wrote to memory of 2644	1668	msedge.exe	118
PID 1668 wrote to memory of 2116	1668	msedge.exe	119
PID 1668 wrote to memory of 4524	1668	msedge.exe	120
PID 1668 wrote to memory of 736	1668	msedge.exe	121
PID 1668 wrote to memory of 4524	1668	msedge.exe	120
PID 1668 wrote to memory of 736	1668	msedge.exe	121
PID 1668 wrote to memory of 1140	1668	msedge.exe	122
PID 1668 wrote to memory of 1140	1668	msedge.exe	122
PID 1668 wrote to memory of 3496	1668	msedge.exe	123
PID 1668 wrote to memory of 3496	1668	msedge.exe	123
PID 1668 wrote to memory of 3496	1668	msedge.exe	123
PID 1668 wrote to memory of 4124	1668	msedge.exe	124
PID 1668 wrote to memory of 4124	1668	msedge.exe	124
PID 1668 wrote to memory of 4124	1668	msedge.exe	124
PID 1668 wrote to memory of 1812	1668	msedge.exe	125
PID 1668 wrote to memory of 1812	1668	msedge.exe	125
PID 1668 wrote to memory of 1812	1668	msedge.exe	125
PID 1668 wrote to memory of 4000	1668	msedge.exe	126
PID 1668 wrote to memory of 4000	1668	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://soft98.ir/software/desktop-tools/614-stardock-windowblinds.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffc50c5c188,0x7ffc50c5c194,0x7ffc50c5c1a0
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2004,i,1102092903692173525,1320463788918097151,524288 --field-trial-handle=2376,i,2964150447575165675,12718738572237416815,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1876,i,624767155476299451,2990149466822406595,262144 --field-trial-handle=2376,i,2964150447575165675,12718738572237416815,262144 --variations-seed-version --mojo-platform-channel-handle=1848 /prefetch:2
  2⤵
  PID:612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2400,i,16492458668467841234,11921011142242685548,524288 --field-trial-handle=2376,i,2964150447575165675,12718738572237416815,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,17871766399032926372,1891876750578000450,2097152 --field-trial-handle=2376,i,2964150447575165675,12718738572237416815,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,16675919205928696170,5149006098514491221,2097152 --field-trial-handle=2376,i,2964150447575165675,12718738572237416815,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4116,i,7690348768730027057,17261185973814434051,2097152 --field-trial-handle=2376,i,2964150447575165675,12718738572237416815,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,8627099160356289538,8975710388023598622,2097152 --field-trial-handle=2376,i,2964150447575165675,12718738572237416815,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:2
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,8656917017782827933,7869840977523873125,524288 --field-trial-handle=2376,i,2964150447575165675,12718738572237416815,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,4927358531664483020,7599513100996469559,524288 --field-trial-handle=2376,i,2964150447575165675,12718738572237416815,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,3614024120268624221,631571690799072992,524288 --field-trial-handle=2376,i,2964150447575165675,12718738572237416815,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,3614024120268624221,631571690799072992,524288 --field-trial-handle=2376,i,2964150447575165675,12718738572237416815,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6180,i,16425985119484655897,5744393775178970046,2097152 --field-trial-handle=2376,i,2964150447575165675,12718738572237416815,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,10822138910146144348,10695219832335606386,524288 --field-trial-handle=2376,i,2964150447575165675,12718738572237416815,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:8
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,982118898479334059,18189802476285814759,524288 --field-trial-handle=2376,i,2964150447575165675,12718738572237416815,262144 --variations-seed-version --mojo-platform-channel-handle=600 /prefetch:8
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2704,i,12470746681452420600,14258427264566813361,524288 --field-trial-handle=2376,i,2964150447575165675,12718738572237416815,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3460,i,5994996851323956238,16590374032962601001,2097152 --field-trial-handle=2376,i,2964150447575165675,12718738572237416815,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4252,i,372034474268928200,11871764058472092976,2097152 --field-trial-handle=2376,i,2964150447575165675,12718738572237416815,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3916,i,11974553951431299326,18180221255781478999,524288 --field-trial-handle=2376,i,2964150447575165675,12718738572237416815,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:8
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3788,i,15998725465700168287,4057907630212626730,2097152 --field-trial-handle=2376,i,2964150447575165675,12718738572237416815,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6800,i,6026114427271248198,10808975439510342937,524288 --field-trial-handle=2376,i,2964150447575165675,12718738572237416815,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:8
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6556,i,5932714043386590738,12828673003613210495,2097152 --field-trial-handle=2376,i,2964150447575165675,12718738572237416815,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6504,i,2123192011290372416,3598707778780969363,262144 --field-trial-handle=2376,i,2964150447575165675,12718738572237416815,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,7969604845726045972,10848408872014868795,524288 --field-trial-handle=2376,i,2964150447575165675,12718738572237416815,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:8
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1364,i,5342833451346579774,1117928046614897344,524288 --field-trial-handle=2376,i,2964150447575165675,12718738572237416815,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,12518486248749690580,14185482053621064600,524288 --field-trial-handle=2376,i,2964150447575165675,12718738572237416815,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:8
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6380,i,7193915722101892100,13059508375232073487,2097152 --field-trial-handle=2376,i,2964150447575165675,12718738572237416815,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=4852,i,14759700518658808325,14933235465627567659,2097152 --field-trial-handle=2376,i,2964150447575165675,12718738572237416815,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7024,i,14837139349889684980,12996763300574690785,2097152 --field-trial-handle=2376,i,2964150447575165675,12718738572237416815,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3740,i,16657130385720568882,1558006526382189843,524288 --field-trial-handle=2376,i,2964150447575165675,12718738572237416815,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:8
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,14233990075684170197,4442756009647211133,524288 --field-trial-handle=2376,i,2964150447575165675,12718738572237416815,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:8
  2⤵
  PID:5056

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:644

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bef2abef429b2e044995f7a595717f46f019ceadf2e0b2c78a215770abbf30c9
MD5 9125172975a36b000ddb85b68c859a4f
SHA1 1a8847140af9e3697b87dcd5c8d0b04351eb2c3f
SHA512 ef97819989809e40cae7efc612988470e369f58a2119aac65d7a1d1743985a6f199b3291e903061a5a399850e7a1a455e081903f525bdcac10dce22c36e23b6c
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7F:fwUQC5VwBIiElEd2K57P7F
TLSH
T10EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9991c48ed8914879dae4effcec150d36bec17d010668f447d8f9cade2568ef52
MD5 2b78928af0525d555cba6be0800700cd
SHA1 c47480c0d63ca33a357bdeae4e0a2b4778e4464d
SHA512 6bc6c0cf883cc43a054d194fde4d18e99c2cbbeb4a8d8d02877029180da59e5d35cf8681da958469d6f20c0b488cb0657a9b8230375256327c3a614ac9ee7298
TLSH
T18AD01236BA1AA404E61A8231A42E87019A1A59A014964B06A254D42C96B409862AF593
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 25702f00b9ae3e59191c9934c14d23ed967e0529851788b808888646dea4d732
MD5 ffa356b657a3409019fc8a239c32c6a4
SHA1 0d51c84aa86ab7959c598cad1154ad13f00af759
SHA512 c83ea8fc753dc36b208df6ad992709ac8598c211965482ecabbc7cb3003aa09cf7cf7dd16ddb5bb30a93ef60e91ddc256b634830a8856ba86888c4fe6d173b24
TLSH
T126D080367B5EB404E71BC231A42EC701DB1A59F014968B07E254D42C97F40DC63EF593
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 1af5e2dda7e7fcc52b88463cdce1abf975a992ecc0b5968112cef9ac626951d3
MD5 d714e9c5547d0a9d4189ceea89e0110f
SHA1 faba2e4cb6ec0d3acd5344f2ed67ba7b9135eedf
SHA512 97d77beff1c26ad68574577c053f066905017815fc7717e5be36ffc0bc9021b420d73bf0e6654e26a12af1d883478584aaa8b9b11359b815aa5d3a5555b92ba6
SSDEEP 192:2jUlEddo7X///QQJJ6jGSVH+8PpO9kF5j0qpMiLO:2jUlEddo7X///QQJJ6jGSVH+spO9kF5I
TLSH
T1E0E14043C2D5C7ABDF1512CB9DE4625D10B07709EBECE60803ECD9DE348E4AAB5A6690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000072

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000072
Size 335KB
SHA256 4a653066039b6337157980bce12b9e33fd585642c8b0d9b7123b8f4d50f9b4b5
MD5 fcef3614f2be47b096c8100388b9207a
SHA1 e16e890c7116802af3efb78fbcf3d72d82151800
SHA512 e51ba5ee31a74e8241cddb338eb23adc7ad1bcd99035e9cb1b4a461152800ca6cb51f667d6488a840b03512f232cbb923a913f2076392c792b21cd12ab28ea9b
SSDEEP 6144:Oy8WP8ZNJzXaa1Ua6mPPdN2GojupGH/pkq40Yhj3yOcBPEpmlo/5:Oy8lZPzX9UDmdz0ukx14L3yOcpTlo5
TLSH
T1B27423AFF47A74BF732D8DC5D62D6DC122C826B0F28E59C4B80EC13542CD661149ADAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4079bbbe674c3724f1eb9f2091982db3d3115bea95d1a764d3cb5c0dbf7343bc
MD5 0e296fd03f95f525f047789bdfcbca51
SHA1 74a020058f48df44e3df98b1b04c862e11c6a3c1
SHA512 a18b0fc3abbd124a53b77f669db3982dad69340ceb8610ff854206767b82b15780a6f1a81afe3b709d2af6ab567c4a5cc539acc1293b1591b64f021c19ae31bf
TLSH
T161813D25809E7841E3AC723860F3311B7571A5BBFDD32E7D3250587D9A3E7F6544088A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 83da6b92d5e08bdb69cd9bbc1856b7263e2a39c75a869c4ea68c5ac995fc5d44
MD5 1a3590767019e3a6de2c68b7f8e697ab
SHA1 9303242bdb938a6bcdb9c6234a99de67f1389e27
SHA512 d38bdef937048ef6c59f796af5f1444f4bdf8308f67930f5702718591c72bc29404b690fee03902f9dd5f8367e8dc12aa6f971ac3d0adb3c52428d7533137fd3
TLSH
T12F71F825819E7852E3AC7238B0F3311BB97192B7FDD31E7D3114587D563E7E2940088A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58dc61.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58dc61.TMP
Size 3KB
SHA256 0fae557b47a2768162f52b167cea1080c784af0eb23cb66edc6fa0fab338a8d1
MD5 2dfe12076db2be5d68384c97fc1f6a22
SHA1 902e50873d250a4a62e2f16d502ecd4c19088077
SHA512 d7812d753935e3d2cf6f030a24de480a8d7811e882cd9303bbf470ab35119742b8b0994e195f79041ebfa081307482840a37c857aca9cbf15b7ad9c736e5c82c
TLSH
T19C711825819E7850E3AC7238A0F3311FB9B192B7FDD32E7D315454BD963EBE2944088A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 2e01e3d6050e7d2101fd720f6f58d8dde71d05f85fd24e314a0ce2504973889c
MD5 3ecffc933cd772c4fdfb1344f76dd414
SHA1 bdf245753245eca321191433ae7b1e061b50e89b
SHA512 38df2432609267136af71f70425790c9f212a075ee46f38594a4cdae54602f948f70365df9db77b16b984adf3481c6da8d5bafe211d6c488666bccb5a9096e38
SSDEEP 96:D/Obee85New6JW+AVzZDh2ORtR6Bq6uWb4fkx2xwBj4/E5:DWie85Aw6JXolDh2iLKq6uaEmokj4c5
TLSH
T124819CF787E5812DD92152F06A14FE17CF9E0410876C3DB58AD4AF4693E2272E206B5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 7538c32bcbf8eec7d4559b073c5ce3fc24272bf3cbd467070b707e8a7f928865
MD5 9a2015f0c433473940e495ae5126f832
SHA1 0ec3794eed2d29e3b0db0a523f2a6201955c2349
SHA512 8cd94f6885e446ec3e6f2c1100e63b76e67485a6345abbd588c92ff308367c06210664f147f8d96fddfd1c8672a8bdb06ba8072d43886867e6c72c38a92c7263
SSDEEP 96:DSOzeWwEpAe2bfJ17zZ/W17OftR6B86wKifWb4fke25:DRqWw4n2bfJdl/W17cLK86TSaEZq
TLSH
T1FBA1ACF2C7D8812DC86256F06B24BE17CE5E4954C7283DB6CAD8AF4B93E2171E20175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 8e257e2d72b8fa889d4dfc1338e7af61da998f32bb528e711cb6398a502fdc31
MD5 67000b980f8a5d8738203d1520016c4f
SHA1 cac9cb10a62be903941c46a0852333cc64478744
SHA512 6370d6e2c9e45c4801c20fc90a2b0e49f3aa7edc4aab24fe8c3fe88065e0b15fe1a567cf73ec975d6ff55ba777e9b80491e847361d0192fec5403cebdda95ec1
SSDEEP 192:sxZIRfyM/jK1Ml8M9r/fbsC2Y0lIdpDnHW6+WND7SV7dYrjZRs42Ig5YCJ:sxZIJ1r/fbsCbRjHbnMduILOe
TLSH
T15C52D812AA345977CCDBD20DFA45BF63D6F55472A2900E54AAFCDA1C00E6BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 724fcfb2c5d7a31aa097b833092401ce60d9baaf2979b366481afeaa789832ec
MD5 6a65ba2c91919e521de25aaadbe73d54
SHA1 71345916919bb5ee84e06fc52e6c7f099eef83b4
SHA512 fd0453894f429759f967049017f03d45bc6c2dbe5b66141aee3aeca09adf621770bc63faccfe4cf53b0d8ea2a6aa53de23499a40db428a503d4f7d5681a3dc05
SSDEEP 192:sxZIRfyM/jK1Ml8UQ79r/fbsC2Y0lIdpDnHW6+WND7SV7dYrjZZs42Ig5YCJ:sxZIJqJr/fbsCbRjHbnMduILOe
TLSH
T14352E912AA345977CCDBD20DF941BF63D6F55472A2900E54AAFCDA1C00E6BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e82037a956d6436a94b7b9a583194a8a183044dbe1ba58caacff0becc9ff6973
MD5 3616a87168c4397fce0cb93438abc962
SHA1 0e049b8d45efee19c83e0ccbad381f8502406c24
SHA512 8d4ed7fce037667053a73b3d456a28ff699167a50b5d2b4ce5fb7d85827aa42281bc87dc3661bb2b2b466f324260e964f3ba91d08ad61e0e1b834811c5621302
SSDEEP 192:sxZIRfyM/jK1Ml8Mkr/fbsi2h6lIdphPHW6+WNGtd/YrAZ2s42IgrJ:sxZIPMr/fbsiarVHbG/P1L9
TLSH
T19A42E811AA346977CCCBD209BA45BF63D6F55572E2900E54A9FCDA1C00E6BEC2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 95a72c3a5fa7984bc71178bfa7d03d047593f38557453b744590b116be7dda7e
MD5 99d63bfeaf10105ecea12bb01b485637
SHA1 2dc163382076f9cc7e72fe4feb284d319183cf35
SHA512 6653a60e8ce97d8fde5d33f341c54f197b9c10f4890d612821013b03707fad8f955c3b0e68da3c4fdc33901cff68d03cffbf53aea7e5d6acb27a97d2b5dc435b
SSDEEP 192:sxZIRfyM/jK1Ml8Mkr/fbsC2h6lIdphPHW6+WNGGqXYrtZ2s42Ig5uCJ:sxZIJMr/fbsCarVHbOXG1Lge
TLSH
T1EF52F811AA346977CCCBD209BA45BF53D6F55472E2900E54AAFCDA1C00E6BEC2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 df8c0682bada7220d1020dde96b5403e25fc8f20d3c0a5a6521628be9655d7a1
MD5 ee9260aaeb30bcb19e33b74a1402fa23
SHA1 33aadca2f4f63c59a7dc6cea5540e653b17a2048
SHA512 063dd7639bce5428c8b93010128dcb42f4cd0b9f698e874f1d33268336d360c6cf0618540da54752264803dc40e11f1be176f976c4908c888f37743b474d25fc
SSDEEP 768:xOgL6XeWviSZq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXJLlZzaRWroWZrTOGv:xOgL6XeWviSZqu1jaSJL7+RtWwGv
TLSH
T137D20A3B680CCB7E4F840E5CED26AF976DD801CB6B984D9447FA494C03C76EE512A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0aa4aff0-8770-4a0e-a37c-41fffd10e664\index-dir\temp-index
Size 1KB
SHA256 2fdd8629af3f020642909ee131eed8f0fe2b30e2009d621a2a5447dbe1534232
MD5 9c81720edfc056fb1976342bbef41d7b
SHA1 5b33a497fbbd3bd591ef0f499bc70196c907f7d5
SHA512 4603f813fa942af3e4be0fe52215820be597c81b078b7e490922643a13df03cf72af3a6f49092d4678d1b1d24081b9d595c6870e7c13950e397e1a779966b895
TLSH
T1EC31634A9E91CD9BF96445B2167664A8737084CD4721A313887C32323E3735E274B8CC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d1dcc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0aa4aff0-8770-4a0e-a37c-41fffd10e664\index-dir\the-real-index~RFe5d1dcc.TMP
Size 1KB
SHA256 d22e6c272c9b02bf62bbbe7770abd2a1ae89dd74eb75dccc3383d3161ea029ce
MD5 79c8ca2f2f44810111f1f5976918b53d
SHA1 5139511f67f7fec9a3656e7085693f6dbcbdd9fd
SHA512 5cd93545f7e5e1dd991525b5d4c6199d0fc55be8857691026fd796670bc6ad700ac878c7ffcde66b1e1a771f476c639f903d2f896ffcae7e4a2f370ded213641
TLSH
T1D231424B4AC18D1AF4C4507B1A67B4B8733588408321B793987C6239AD25B9E1E5F0DD
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 5d34262fc4c2ca212859ce2e97044bd7a750abd0d418d4fb9203cf44d7dcf6ef
MD5 ce895933e97d5cc380aaaab9df8a639e
SHA1 84faae56fd5bb41d207f216d9d5a8a60ef4abf68
SHA512 7b46e95894ced3284562ef93d9394cbb2a140da64a1e1994fe7075cd204b4fa1c58cd90bef3ada893c0816cde7cbef27c49acd55a1f9c5e67d9a575c0b979aee
TLSH
T1D6E020B32CDB1A14ECBFD3D7143358B441457999C949ED4E5015F68351F1359305DC71
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 74cce4dfc7b3f9d45786dfe0e861909059234968565b18b447b751604ab74ffd
MD5 c0b621c7dd0edf5450e1a54813393b8b
SHA1 8d6fcfb1351eb806f7c5e5804f3aac247e234200
SHA512 5709643b05dc6f2fc776c8176f1acdfde931bd63fe7f480cb70b65801321f6752400d041c7e8318e89fce4c7ff75e7fd1aa43bcdd2782ea44c20f16b467bb315
SSDEEP 48:KsWT8Ae0k1VIRIIqo1K3E/u1r2lQ58VIdKuA4Xy5+IvKvK4CxkxVxYxExWxOxOxH:KwX+KUsyV2KuAS6+cKvKUw
TLSH
T1D5910201707E021338FD280896A69A379E46316B7534A57F3FBC54A64966E112FFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

863a84fb-f328-45cc-b0c7-9fa26929cb23.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\863a84fb-f328-45cc-b0c7-9fa26929cb23.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 22785e8b1fc6a605a9c595ab2572539dd43286734c5e6bd8ed65bfc859845dd6
MD5 4c647c2d12f09c478132786996aff6d6
SHA1 3f542c8800e4a65458d74ec6fc64aa08feae6fb0
SHA512 a8a6cce6db7424a1150358d06d807b77cc53f6028bec955ba167c65bdb1ca20a2289a5f4699616859b39390437c86502f6b13b83e0f602c4613c3f4d9e6b7142
SSDEEP 384:PiFPZcIAFsNX8TUNTUlIlAey1zg8dHF29uO8KmYq38OOPrXLpe8C/JY:aFHe4wggFonLmYq38Oi9P2Y
TLSH
T1CBD21BF288D79836EDAE5B47A77D2E164EBCC163F5806A50B3985A0CCD861BFC306D11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 e983d8c745db22f1502b5364d2b358927367d806dadcc3252df98e7e7e6fad6f
MD5 bb7e50a88fe66b3489c4af102cc0100c
SHA1 ee505dbff9c217b3502921406baca64ea9d96178
SHA512 414f211a57ddc4b1486cbf21b63d636544901503d0ad17dd17f1d2ec3f9203ac5d581c03c6ec1a6210e5e62a166f64c4ab8936dcf0ef96166a9151bc347a69bb
SSDEEP 384:rZcIAzsNgkey1zg8UHF29uO8KmY438OOPrXLpe8C/JY:zcfFonLmY438Oi9P2Y
TLSH
T106C23AF198E75832D8AEA747A77E2E164E7CD023B5842A50B3D86B0CCDCA17FC316911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 50f9ebd0f2cd7c4b1aae7b847b5fca30990f6558f4f7dd6bfe105d7d55317385
MD5 c7e10f5850766c8d9df0b20983a15cbc
SHA1 a276dbe25500a93becc0d5d98a4eae910b08ace0
SHA512 70e97177a9341d5c241f2db1fdd651440c579a216874cd567b595e4e67574d2089e901e857d006abf619293b0f6b07d6670ca39af218f97bb349117a9a5a5a6b
SSDEEP 384:4ZcIhsNgkhy1zg8UJU9uO8KmYt38OOPrXLpe8C/JY:GhqWnLmYt38Oi9P2Y
TLSH
T17D929E72D8786C336DF6A684F98736178FB89023F6C43B64D6EC6B0C05CA598031BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 50ae77e24aaa0f587249c68d877c208d769d0de19c9712420a1179d4a251c5a3
MD5 01e890fab121682c46e541ddea598d9b
SHA1 da11f9e38e1679c36a7b31a184d4de906eef53f7
SHA512 b6b5fc2929133e81189b2e98937eec455fb10615783ffc04c7f904d3f81a82f2bf00285f6ee06b303c6caa9b295052377863c25b3d142990673ead181448cdda
SSDEEP 384:PiF+ZcIAJsNX8TUNTUlIlAey1zg8dHF29uO8KmYq38OOPrXLpe8C/JY:aF8m4wggFonLmYq38Oi9P2Y
TLSH
T1DDD22BF288D79836EDAE5B47A77D2E164EBCC063F5806A50B3985A0CCD861BFC306911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4007fd58b96dd02dcc8e20d6d37471d31caca6454e7789fc2bbd4fff1b923c76
MD5 337ef07dbbafab3c5bdb79acdeb5fecf
SHA1 efbb164acf0b2754560b9bf2f579f225d9019e8c
SHA512 c39db0b02b937386707b4a1d9ba5680916be7a399d8dc70bcfacb1cc008553942dc6d86b738c82ca9a668b4467eef42508af500aa0be6dd956f3d5dd2449d9ca
SSDEEP 384:PiFjZcIAEsNg8TUNTUlIlAey1zg8vHF29uO8KmYJ38OOPrXLpe8C/JY:aF7jJwg6FonLmYJ38Oi9P2Y
TLSH
T1B6D22BF288D79836EDAE5B47B77D2E164EBCC163F5806A50B3985A0CCD861BFC306911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 e38fe7a6138d5bfa483ca1d90a79abd624f8658da2f9be6065862e693911a365
MD5 490424c2194347646a0851cdaca7b77e
SHA1 788cf699e711facfc029209d7d812ef241029a42
SHA512 87adcdc3f74672c26f78137daab9d4124719450e5b40ead493b416a909ba31e94e2c78c2a53bae09335c88193b79253faa8f421228bbf05d968a8fe36d4e99ba
SSDEEP 384:PZcIhsNgkey1zg8UJU9uO8KmYt38OOPrXLpe8C/JY:HhRWnLmYt38Oi9P2Y
TLSH
T1DD929E72D8786C336DF6A684F98636178FB89023F6C43F64D6EC6B0D05CA598031BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 601635c58a1b43bae22421bcc536264cb374bd546705b65edb88da0fb1ecd6bc
MD5 d86cb7cf3101b8a0c2c9421873573650
SHA1 8929a46337a5d5615279c5c3fb05c052703364ce
SHA512 c4987e555c368b5218fb3cf64eb2c0d574796a03be544e7140c1b6a579338df095eda1052e67cb06f0636e02f398f95565145f1102d8de114b5308bf1780fda9
SSDEEP 192:YONt6LCWtDQmiUy7VILSuOCzpgmsE31RU6:YONt6mg10ImuO8Km3bU6
TLSH
T1AC02E93AAC786C779EF26E44B8873B275FB4212BE5902F54DAE82F0C05D764C1306936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2e913963abb54cf3c2ecb7da4cbed323b3c0b2ad7b1719e47c41ca973884bb2a
MD5 3d8a2eaad039247e6d3e7518405dfbb8
SHA1 040c5080e564cd6e0de17b7661ca2ab820879e56
SHA512 d3ca1bccf61eb92ca38c0f8d9922b2b476d0dbf2b2d37b2ba72dcfbcbc9497e4282cb08293b65afb6f467ae5013357f626a54698b5690bb5d9a678668fab540f
SSDEEP 192:cONx6LCWtPQmiUy2V0LSuOCzpgmY3zEI/3TqDU6:cONx6mgRn0muO8KmYP38U6
TLSH
T13112F93BA868A8375EE27980B88736175FB45127EA843F94D6DC2F1C05DF68C530A927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

54172af2-bd05-45f3-8724-82eab90d189b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\54172af2-bd05-45f3-8724-82eab90d189b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3ec501d94f1fac14628bcb94501a469a83e8bb261f6146609cc0152fe61a66bf
MD5 4effa7ef818d453b03b668829a706bf7
SHA1 3d59c52fb09aaeafa8e77158cfc66cafd3e0f7e0
SHA512 a394300761c2036cae8475ee62ece50db76548b49f3af7b26e6c512d23ad3184c9944f91f7484efa569389ce685785e68b42822e9e067c2ce97e9b72cc062a52
TLSH
T1ED41075DAAE91148B3B77E1A9BF7A87E487EB8772E07949D10010E4E4663A00CC61B37
MD5 SHA1 SHA512 TLSH

Submit Download