hxxps://datanodes[.]to/yoi3wnbfrco7/Football-Manager-26-HyperVisor[.]rar

Analysis

user interaction
yes
max time kernel
898s
max time network
901s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 15:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://datanodes.to/yoi3wnbfrco7/Football-Manager-26-HyperVisor.rar
Sample260825-s8ydwavepb

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2200	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321465329263479"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{2827F335-9BBC-424A-97D2-FAF52A24026C}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3812	msedge.exe
3812	msedge.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 4588	2964	msedge.exe	84
PID 2964 wrote to memory of 1684	2964	msedge.exe	86
PID 2964 wrote to memory of 2200	2964	msedge.exe	85
PID 2964 wrote to memory of 1684	2964	msedge.exe	86
PID 2964 wrote to memory of 1684	2964	msedge.exe	86
PID 2964 wrote to memory of 4392	2964	msedge.exe	87
PID 2964 wrote to memory of 4392	2964	msedge.exe	87
PID 2964 wrote to memory of 4304	2964	msedge.exe	88
PID 2964 wrote to memory of 4220	2964	msedge.exe	89
PID 2964 wrote to memory of 4304	2964	msedge.exe	88
PID 2964 wrote to memory of 4304	2964	msedge.exe	88
PID 2964 wrote to memory of 4220	2964	msedge.exe	89
PID 2964 wrote to memory of 4220	2964	msedge.exe	89
PID 2964 wrote to memory of 3392	2964	msedge.exe	90
PID 2964 wrote to memory of 3392	2964	msedge.exe	90
PID 2964 wrote to memory of 3392	2964	msedge.exe	90
PID 2964 wrote to memory of 1008	2964	msedge.exe	91
PID 2964 wrote to memory of 1008	2964	msedge.exe	91
PID 2964 wrote to memory of 1008	2964	msedge.exe	91
PID 2964 wrote to memory of 1056	2964	msedge.exe	97
PID 2964 wrote to memory of 1056	2964	msedge.exe	97
PID 2964 wrote to memory of 1056	2964	msedge.exe	97
PID 2964 wrote to memory of 2412	2964	msedge.exe	98
PID 2964 wrote to memory of 4352	2964	msedge.exe	99
PID 2964 wrote to memory of 2412	2964	msedge.exe	98
PID 2964 wrote to memory of 4352	2964	msedge.exe	99
PID 2964 wrote to memory of 4472	2964	msedge.exe	100
PID 2964 wrote to memory of 4472	2964	msedge.exe	100
PID 2964 wrote to memory of 4472	2964	msedge.exe	100
PID 2964 wrote to memory of 5028	2964	msedge.exe	102
PID 2964 wrote to memory of 468	2964	msedge.exe	108
PID 2964 wrote to memory of 468	2964	msedge.exe	108
PID 2964 wrote to memory of 468	2964	msedge.exe	108
PID 2964 wrote to memory of 2400	2964	msedge.exe	112
PID 2964 wrote to memory of 4844	2964	msedge.exe	113
PID 2964 wrote to memory of 4128	2964	msedge.exe	114
PID 2964 wrote to memory of 4472	2964	msedge.exe	115
PID 2964 wrote to memory of 4472	2964	msedge.exe	115
PID 2964 wrote to memory of 4472	2964	msedge.exe	115
PID 2964 wrote to memory of 4344	2964	msedge.exe	116
PID 2964 wrote to memory of 4344	2964	msedge.exe	116
PID 2964 wrote to memory of 3448	2964	msedge.exe	117
PID 2964 wrote to memory of 3448	2964	msedge.exe	117
PID 2964 wrote to memory of 3448	2964	msedge.exe	117
PID 2964 wrote to memory of 4876	2964	msedge.exe	119
PID 2964 wrote to memory of 4876	2964	msedge.exe	119
PID 2964 wrote to memory of 3812	2964	msedge.exe	121
PID 2964 wrote to memory of 1420	2964	msedge.exe	122
PID 2964 wrote to memory of 2040	2964	msedge.exe	123
PID 2964 wrote to memory of 1420	2964	msedge.exe	122
PID 2964 wrote to memory of 2040	2964	msedge.exe	123
PID 2964 wrote to memory of 2448	2964	msedge.exe	124
PID 2964 wrote to memory of 2448	2964	msedge.exe	124
PID 2964 wrote to memory of 4956	2964	msedge.exe	125
PID 2964 wrote to memory of 4956	2964	msedge.exe	125
PID 2964 wrote to memory of 932	2964	msedge.exe	126
PID 2964 wrote to memory of 932	2964	msedge.exe	126
PID 2964 wrote to memory of 4912	2964	msedge.exe	129
PID 2964 wrote to memory of 4912	2964	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://datanodes.to/yoi3wnbfrco7/Football-Manager-26-HyperVisor.rar
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffe8ea5c188,0x7ffe8ea5c194,0x7ffe8ea5c1a0
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,4929027635848888019,18015771648409468709,524288 --field-trial-handle=2308,i,14666292556667140347,12654917026294158857,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,7538708074936538923,7730960769650230885,262144 --field-trial-handle=2308,i,14666292556667140347,12654917026294158857,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2312,i,3289940761341435775,16702676013629711088,524288 --field-trial-handle=2308,i,14666292556667140347,12654917026294158857,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:8
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3392,i,10858590787683551704,2770081656571713786,2097152 --field-trial-handle=2308,i,14666292556667140347,12654917026294158857,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3396,i,12026037544504235846,8371909083019454441,2097152 --field-trial-handle=2308,i,14666292556667140347,12654917026294158857,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,8093879652697879977,10060444708658706719,2097152 --field-trial-handle=2308,i,14666292556667140347,12654917026294158857,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,18117743328767352649,3934355600472771372,2097152 --field-trial-handle=2308,i,14666292556667140347,12654917026294158857,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:2
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5380,i,3899190891451705355,10553793809595496592,2097152 --field-trial-handle=2308,i,14666292556667140347,12654917026294158857,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,13819850638793217967,10816433059476144887,524288 --field-trial-handle=2308,i,14666292556667140347,12654917026294158857,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,8132670587977974511,9385766452301430347,524288 --field-trial-handle=2308,i,14666292556667140347,12654917026294158857,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5732,i,2666707511662482535,6293483301533160143,2097152 --field-trial-handle=2308,i,14666292556667140347,12654917026294158857,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,17067331828385618569,2904770160386374759,524288 --field-trial-handle=2308,i,14666292556667140347,12654917026294158857,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:8
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,17067331828385618569,2904770160386374759,524288 --field-trial-handle=2308,i,14666292556667140347,12654917026294158857,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:8
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4224,i,18210426060298999429,4436084304333195212,2097152 --field-trial-handle=2308,i,14666292556667140347,12654917026294158857,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,12801068164765200219,8952220292012861522,524288 --field-trial-handle=2308,i,14666292556667140347,12654917026294158857,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:8
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,9892604177382314006,10727284713265095487,524288 --field-trial-handle=2308,i,14666292556667140347,12654917026294158857,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:8
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,15571283538844659283,11170754693465348052,524288 --field-trial-handle=2308,i,14666292556667140347,12654917026294158857,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:8
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6792,i,2108842711991268877,15581299921171843744,2097152 --field-trial-handle=2308,i,14666292556667140347,12654917026294158857,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6948,i,17731488537777435394,12263014685433068398,524288 --field-trial-handle=2308,i,14666292556667140347,12654917026294158857,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6952,i,4810031111631715617,7552740672617994966,2097152 --field-trial-handle=2308,i,14666292556667140347,12654917026294158857,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,14081968771020206169,12460754283423382795,524288 --field-trial-handle=2308,i,14666292556667140347,12654917026294158857,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:8
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6804,i,3213429696644882733,5259311599562110626,262144 --field-trial-handle=2308,i,14666292556667140347,12654917026294158857,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,8295045410295557054,5603082251738457578,524288 --field-trial-handle=2308,i,14666292556667140347,12654917026294158857,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,10952252631852613928,2552194429986350479,524288 --field-trial-handle=2308,i,14666292556667140347,12654917026294158857,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3552,i,17564241050219968060,9429959808679578177,524288 --field-trial-handle=2308,i,14666292556667140347,12654917026294158857,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:8
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2836,i,6592380703844301374,8089602356642417811,524288 --field-trial-handle=2308,i,14666292556667140347,12654917026294158857,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:8
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,5087569138356189868,8482173571859995534,524288 --field-trial-handle=2308,i,14666292556667140347,12654917026294158857,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:8
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1512,i,11557157259354006039,6905846362044386213,524288 --field-trial-handle=2308,i,14666292556667140347,12654917026294158857,262144 --variations-seed-version --mojo-platform-channel-handle=3988 /prefetch:8
  2⤵
  PID:4912

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 ae53e618032c667892ed21a0d220c217b0a8d7911b3dee86b08e6a49f9b5961f
MD5 f9f19468189111f8249d81621e4a102d
SHA1 fa68cce6f26f82bf96fb875ff427a4ef9e9673b2
SHA512 d53cb2328cd19d1ba8512d1ff3633af39c02eed400e5983853154f5b66c3341ed3d1103439b7c80316b2363de07a7530588d76f9e262920e057331d68d3f3bb7
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7h:fwUQC5VwBIiElEd2K57P7h
TLSH
T18DB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 328B
SHA256 d41d13ebc14d71b2387b3f160aa7988766c5a97cc93f8b90ac5a714cd8724fd4
MD5 71ef9e783645339b69439518ee4db9bf
SHA1 91db14ad6daa2ce57e7055cc059d404df163d895
SHA512 28221da5fa59dd75fdfd6a11207e94abc259ccdb20d2776276592d3b2f47d6eb190926fac469b44d48f31b944aee1758138111e9aa4a57a21686d0c5a91aa09d
TLSH
T1C5E086D629DEC76F9744B88753A9570CC394370E97E8AD8E1704C4897281D58B3A2594
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 0071d7fd6ddefbacc90cc494e09fe7cf38be231bac466bc5904db2e100632f7e
MD5 4535bddce721cbe74e5be3f0aca9c06b
SHA1 475135783aae7b012739bdc1e43f419d0265d27f
SHA512 39249cee5365374c889a4c5f53f1ca0f5e86383bb19311c8da90b644d9a712eebecfe96ea803c0121f6c8b95823949c4b6c127391cd3d61088cc3ee329168442
TLSH
T10DE0268504CAC22F9648A48751B8573CD380370BDAC8BD8A17018CC8B00105CAABB5D0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f57bb6dd1e39b28aa0a53a2fc39230e5ecdb6083a4cbf7a56563092d46ad6dac
MD5 94a96acf7e076d618278e3298e9b3392
SHA1 4394245c137e7720b29dfac6258ec0268e32ab02
SHA512 847ecef9b2fd61f89eec54385db2723440ac333f9b0ead2c513400720f8ed879ad02cc9bd172f93aa4a3682fe6cad5de7512ca22bf8ac086cd6dc153f2ac4b77
TLSH
T149713F3A028FC061F3A5C67296C11D4D3A7E50D31B8F8E59C3B739FC9A29BA594A3448
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586b96.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586b96.TMP
Size 3KB
SHA256 4e6894d54cd1990d4a46390d949aeeffe8cc370780ec9bf7491b64bcdc7d59de
MD5 65dceebdd487dacf2da6c191581a1c04
SHA1 78bb208ddb1489cde95ed153951c03ab711f93e2
SHA512 a8c8d49951bce52d3d9e61584d75d04825ccc54a87d3140304e10d8be3e60dada26d7e155856aaceac47815c813c67c6a33920a0d15c72064837b8416984529e
TLSH
T1E6611C3A028FC160F3A0C572A5D11D0E3A7F40970B4F9EA5D3B379FC961A7A595A3448
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 6e9b00c70e8baf8dd27d8ff08b467823c396f2d54312cd460df818a04f6b9ec6
MD5 895deaca242a6ca4856bec4bd1f73a9f
SHA1 7bf53cdca72ab73d6e85fd67d1852309059cf9e4
SHA512 c89153fcdc22416ff04a64158ff64fc06a2bd65b8ef2b8534b34dbd81d488b490e7790166f8376368ee5719ddb8b0b2ed25511b916ffd5125a12f5bc1b159454
SSDEEP 96:DVOsVta2wJvx/tRzpnMbhM4wVrZ2hbyCANA56AwQ:DYsva2wJvx/7FnMbhM4wVrZg+CANA5vT
TLSH
T101D18EB7D7D48A2DCC1216F4AB146E2BCE2D0D1542283D2AC9D9DF4F97E2471E11164F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 47786b3cddfb8e99ae2d4ce552e8239dc5a8b0127eaea889029f4b18e47ae02b
MD5 9668a4ffb05ea13ff4f164486555f689
SHA1 8c0f63650f049934d49d7e8d3c56a0170a029cf5
SHA512 5bc42e8d77bb04fb7825567f8134e5e93b6c6754d0fb0d087c13669973140fe01fa1572dc20de3284b06e49fd71cfbf56d53fdb37cd863b2b4774ddd2a87e4a2
SSDEEP 96:D/O9AtNaj1DF5OvYzpnkuNq4wVR6eA96AwBj4/Qjwx:DW9uNaj1DF5AYFnkuNq4wVR6eA9vkj49
TLSH
T1DDA18AB797E0966DDD1257F0AA18AE2BCE2C0915422C3D3AC9D99F4BD7E2071E011B4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 9b70c95eb18d077c35c352d3bebec2359ad957fcebd9c393a727b231bf703287
MD5 9f09194502d570704403af441100ff00
SHA1 baaeafc8b942d520dcd3f9d6f1a2ef24aaa7770f
SHA512 e2a4e9cbd7eae812f6aa103a49c22d117629c90caba73b4ea938ff80615685a6925ef906d90320914148537bae55067bb143bcc2f903f8561a5e5cd023515f8c
SSDEEP 96:D/O9AtNa1DF5Ov57OzpnkuNq4wVR6eA96Aj4/QwBzje:DW9uNa1DF5A57OFnkuNq4wVR6eA9vj4e
TLSH
T1A5B1ABB797E4966DDC1256F0AA18AE2BCE2C0915422C3D3AC9DA9F4FD7E2071E01174F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 2960d70e086fb1951d49eab02f564a37fae56ef432e69429154e57690823009b
MD5 450ea28068bbdb8650cbaf9549a9b7a1
SHA1 fcc0b2073c0b18cb9321b8b9ae336186dfe803fa
SHA512 f6ab05428bf790fd5787c766b9b54133c965c5e12ebb8da86f71e2d952c36ee08e59b9449becda66af9e829d9cbf4d6fe84b5995e8d2a142c647210d90e6f03e
SSDEEP 96:D/O9AtNa1DF5OvcfzpnkuNq4wVR6eA96AwBj4/4jwx:DW9uNa1DF5AcfFnkuNq4wVR6eA9vkj41
TLSH
T104A199B797E0966DDC1256F0AA18AE2BCE2C0915422C3D3AC9D99F4BD7E2071E01174F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 debecbc142f712c4141d075c020007641c067a14f206a0f031b7c6015a510af7
MD5 e6d19835bb958c50f8508e2b54ef7f10
SHA1 38a6efe553bc13a4d76d030d391972306fd38a7d
SHA512 c462479fef14fd15fb8021c94c50ec097c1ce4b06f45f9f48d1db96d58e63b67f93cf65bd490b7e73a022d2599d42355a604741648190f61d80896ddf3aac3d1
SSDEEP 192:sxZ4RDyM/jK1Ml8Mk7/fSsgJ6IdpZlqHW6+WNAe8/YHD/p4IgrJ:sxZ4lM7/fSsgJTuHbS//9
TLSH
T16852D7126A38A977CCCBD309FA55BB53D6F50472D6900E44AAFCCA1C04E6AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 66d43ff4cb95e3ff8f4cb032954ad9d9f6096dcaf4bb8846ea443c66ee18e40e
MD5 de22c2ff59c45d1bcf099a95e5d7d12b
SHA1 989322d65bfe8ebbc2ac369cada4e5c82f6dc8e6
SHA512 0810788ade05ead262d037b9750494a352bcdd92dd606ea19354c56f2868cdff8b5c6fac19cffd603c29c5837145d8742aa3b71f3b634fded71e6c5382e84a8e
SSDEEP 192:sxZ4RDyM/jK1Ml8UQb97/fSsm56Idpbl59HW6+WN+5Z6bZYHvuv4Ig5YSJ:sxZ4lqp7/fSsm5T1HbbZOD
TLSH
T14C62D616AA389977CCDBD209FA45BF53D6F5447296900E44AAFCCA1C04E6BED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 51d7e7f75740e0e871e4e37702c797f9e6d68ff7f84be0cfa0e00c6f0359ac3c
MD5 a0bb3d38f76b1a0b0b79561d50b296da
SHA1 92d782439aabbe31a8ce22771d726c861358e6ca
SHA512 8e7f0d037f17ef67844a742a43943cd76fcd5e042714711811a3ff8f7841a0be410f8b2bd8b1182092889738fac1ba4ae29703f403edc02a2517085b384a3b6e
SSDEEP 192:sxZ4RDyM/jK1Ml8M97/fSsm56IdpZl59HW6+WN+5ZVrXYHA1p4Ig5YSJ:sxZ4l17/fSsm5TbHbsXAD
TLSH
T15452C6166A38A977CCDBD209FA41BF53D6F55472D6900E44AAFCCA1C04E6AED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 76e95a0db0b87795630c0d9432e8d247924af7425fdb11ee45573ac96ed0afee
MD5 2f738d9f8878d99468c876fd7451d67e
SHA1 e8c2eb50a3b1876303703b3e98c8420b6f64e53d
SHA512 f02ceb2a3c3f4d533dd2a24a633f6fcdbda386c0b703ff07eb1b76f57917d4bc6df4af1e859f7ad6e908751636704745650137556e0c20482c871c04e1b1cf81
SSDEEP 768:YkL6UZYTMWvg09o8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RLsroVc0+:YkL6UZYTMWvg09ou1ja7eLZmRL3p+
TLSH
T1A1E20A3B280CCB7E4F844E5DEC2AAF963ED801CB9A584D5447EA894C02CB7EF511759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index
Size 2KB
SHA256 d5a9a093283f9d703a2cc159a3157b6e456dbe7a1d172d46f9fe607ba04ffee4
MD5 5df093ddc11790795e92d91634be61ad
SHA1 cd04549e9cf237e8564662c07bbc0c601b80308c
SHA512 fc7c8bd74a51ed953d9ae618906a6f201d4b95ddc5f1e2dfff55ed33f6d8618ff27e04ae03afc8b4ab9f1cf182c3e0a97458ff4b824d3dc3a4a5688ea04e72f8
TLSH
T19551A64E4D618A5AECB845B304B2A4903B38ECCC4A559A1368FC2232BD4772D295B6A9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5c9cb5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index~RFe5c9cb5.TMP
Size 2KB
SHA256 ad4db06ffd722d7cfb1ca4c14e5d22a45a22a0d308474bf25f2d5e5796ce53fa
MD5 32aff5d3fe1a5f436c0811e6422ea35c
SHA1 d0fee3941d7a7897036d34800deefcf122396be2
SHA512 c3bd246893eb3a8113a9eae3e0d04bd811d186a0a27d017b0fddd376546ce26fe80eb38a7590afc9530a8e18726e50dfbbb29f03066ee0cbc44117da1d671dbc
TLSH
T1A951994E4D418639E9C441770DE3A4B4373965008715BF5374FC5636AC927AE3E1E2D9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 7741105df9d20739c178c9783255e76cb880e2aa1b7c1f575b8a9ff391be598b
MD5 1ea89f946e2e77b17feda094b0788c35
SHA1 44f1f34af13341cc22ab60e9cf308e8347663cec
SHA512 a541e98d22be812acc31d1ae1434e2e342b7a6346a4634eef85b488bfe4dd6d7309f5cdf7c2c9a019c846f832aa639dead0b244ddaf36f847d0ab6d09559997e
TLSH
T113E0C0F73EFB1810AD7FC3D74471A4A405113CB8C64CAD8E00AAB2A310B23002806C72
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 09f01366a6837b62f20fff40aa69492a820ae03c3c8d1707314b6048a4785daf
MD5 36e0391343bd6b21076219224c2d746f
SHA1 217616915a3b4b096a97816a5853ea727f42bb42
SHA512 6147fff382bc79eaf1deef68ef84b4afe4df85baa053c39e9d432178f217f8197b33c1af87270078154e006e45f8f38ae341b7abad412749e1910349c448ba77
SSDEEP 96:KA1eK2AYPOKQo+G1CKG0vLsfrZhR2ThC9Rr2KpTRd2tjLaNLnWNqK+0G:Ect51j5H
TLSH
T147D1064270F622013D7E3B0882A497575E45F163311CA96B7BAC14B64E2AE21DDFF8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.usage

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\.usage
Size 24B
SHA256 fac0a85e4f5907c8036b0052214b777ddbacea9420e5903526272dc76bd4c7b6
MD5 e1edf83f1dbe0a1640e5800ef2f44b90
SHA1 58e8f31a1282e84a05c6960d6ab461d6ccef42cc
SHA512 151b19bcb34d72c304d02f2830f577036c5d2156499cb998643a87a3010544e5a4c236f8458786ea4b3416aaa4fd1ea96fc3bfe1ab0c5baebeac29e5427ca417
MD5 SHA1 SHA512

Submit Download

00000000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\00\00000000
Size 1B
SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
MD5 93b885adfe0da089cdf634904fd59f71
SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
MD5 SHA1 SHA512

Submit Download

9afc5cf5-8253-4cdb-9717-7a477b1cf811.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\9afc5cf5-8253-4cdb-9717-7a477b1cf811.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 8c5c5f695dcff72672743c945047d3098d72c223748340ab54d6874bc0b789b3
MD5 88b9017c130bf2b7bb73db28d5ea6936
SHA1 dd2a5eb41a53f22f2f20ad2b4e2911f932830d04
SHA512 0548f13c11ea1a02cc576df30e048dac03df0963cd6f73129f1a98c1ec9d92f754803cc482413888246b2369c70d8bc2c06c5e001a4a89a05ce4f0e4cbb237a7
SSDEEP 384:bZcIhsNQA7oK+LzX5od+W8yLXBUiv2uooU:DhOsPOtBUi+uo3
TLSH
T1B4827D729938AC675DE2E285F54732175FB85027DBC96F8092ECAB2C00DD6AC131BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 075442d23fd54a48cf97363058f3426437e62f1133c07c3384cdf9b978013cf8
MD5 229769f2f7c06801862c908a786d42c7
SHA1 805d84675eebed9fab15bc112857f0baffca5341
SHA512 eebf67ade4310ca23777065bac3dbc51887675bab8331e6ac8136501b2b6bd3c408eb43a552f62d859401fec8b86d97e929313a9d8916c8cec2d424efd3642a8
SSDEEP 384:7iFiZcI7sNQ8TUNTUlIlp7oKxM2zX5od+W8yLXfUiv2uooU:WFQ7JwgzXMqOtfUi+uo3
TLSH
T1A5C218F248D79876DDAD9747A77E2D024EBCC063F985AA40B3985A1CCC9A1BFC306C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c6e6a14b08f4c22b43c1d33dd3c46b40fdd53242674aa9c749a8abc452a488a2
MD5 bf023ebb9837b7d6aadae7940d3db9ba
SHA1 0bde8e8caab02ec33991758b4fca4ee4ec2f3268
SHA512 c608ca416ca8067b76589fc4d65aad1059f208187b404cae8e8b1188044a9a6a737fc5cf78ddebb5dd865fff18dbfc6a2753c419609bea8184df99bd4df0a0c8
SSDEEP 192:yON861VWQmiUy4ZgGX5Obd+j2jzoryXm0/a33mDU6:yON86WvgGX5od+W8yUmDU6
TLSH
T1F802D835A8687CAB8EF2BE49B58737135FA82067EA552F84D6E81B1C00D765C2346C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 3d50563b548562e788729526cff807a8c28ba7dd9d1f09e85df254348f53294f
MD5 93fb5c74fd0caae9c670fce0f732c4e4
SHA1 27fc507ef455518f819d588e992689325ef1cae3
SHA512 ec7968a514a139eb707903e1a62619ca1bd142bc55cb18d5acaabed7afd7a262929b406646bb3b1fe12b89ad94c45b0ccaa353c1e82e739e5d72dd909df64b9b
SSDEEP 384:LZcIhsNQp7oKcM2zX5od+W8yLXBUiv2uooU:ThxOMqOtBUi+uo3
TLSH
T10A827D719928AC671DE2E685F54732175FB85027DBC96F8092FCAF2C00DD69C131BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d81d422dd5c15bce830a559c6d6a0e2f23bc9bf898b083b5d71ffa4411c6b00c
MD5 21a4635d6309a9bb9ec3a05ee7a60ab1
SHA1 c5b4c884208ee4d796991216909cab8795743d88
SHA512 c2bdd0ebac0c09e659f3a56bed0e2f7e96596636da17e4fe05815f5cf3c549470bde3c34ecb8acabd50e3ca25bcf013cb30d45cca3a37a81e309c95718bc1b3d
SSDEEP 192:+ONp61TWQmiUyAZJGX5Obd+j2jzoryXmOXY7xjJ5qlrU6:+ONp6oNJGX5od+W8yLXqUU6
TLSH
T15E12E832A468BC6B5DD2B985B44B32135FA95167EF497FC092EC2B2C00DB69C131BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

351e7a12-af0d-4937-898b-1f4f5734a600.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\351e7a12-af0d-4937-898b-1f4f5734a600.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2d4ec6484394caab8a805668defef75e61d3437a54ee27c56adb0ed06a41a755
MD5 e03a0c8bda09c5c0836a447067b134cb
SHA1 384dc72ca341c3020e7fac043469d7ceb8567a2a
SHA512 ef7c22cb35ff71d587f5932152eb58e8b5f0f655b40502d998a0c71fee6a0324442e3aa8e68bf9284083993853f40b99df7a1200047e9503fd5975edc9cbd209
TLSH
T1ED412A58A6FA104CF3B76E566BF6A46D887A78772E06D45D10120E4E0623B40CCA2B3B
MD5 SHA1 SHA512 TLSH

Submit Download