hxxps://nsktrgroup[.]com/

Resubmissions

22/05/2026, 14:32

260522-rwmk6sdz9m3

22/05/2026, 14:28

260522-rtesjsdz2m3

Analysis

user interaction
yes
max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/05/2026, 14:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://nsktrgroup.com/
Sample260522-rtesjsdz2m

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3748	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134239337433820250"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2904698490-2540843659-2047741361-1583039222-628509060-1343416660-4183458959\Moniker = "cr.sb.xrf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2904698490-2540843659-2047741361-1583039222-628509060-1343416660-4183458959\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.xrf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.xrf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{B1B793B0-A3B1-42DF-9E17-37E28EAE8B30}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2904698490-2540843659-2047741361-1583039222-628509060-1343416660-4183458959	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2904698490-2540843659-2047741361-1583039222-628509060-1343416660-4183458959\DisplayName = "Chrome Sandbox"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5756	msedge.exe
5756	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
640	Process not Found
640	Process not Found
640	Process not Found
640	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 3964 wrote to memory of 2708	3964	msedge.exe	88
PID 3964 wrote to memory of 3748	3964	msedge.exe	89
PID 3964 wrote to memory of 384	3964	msedge.exe	90
PID 3964 wrote to memory of 384	3964	msedge.exe	90
PID 3964 wrote to memory of 384	3964	msedge.exe	90
PID 3964 wrote to memory of 3164	3964	msedge.exe	92
PID 3964 wrote to memory of 3164	3964	msedge.exe	92
PID 3964 wrote to memory of 536	3964	msedge.exe	93
PID 3964 wrote to memory of 536	3964	msedge.exe	93
PID 3964 wrote to memory of 2612	3964	msedge.exe	94
PID 3964 wrote to memory of 536	3964	msedge.exe	93
PID 3964 wrote to memory of 2612	3964	msedge.exe	94
PID 3964 wrote to memory of 2612	3964	msedge.exe	94
PID 3964 wrote to memory of 376	3964	msedge.exe	95
PID 3964 wrote to memory of 1720	3964	msedge.exe	96
PID 3964 wrote to memory of 376	3964	msedge.exe	95
PID 3964 wrote to memory of 376	3964	msedge.exe	95
PID 3964 wrote to memory of 1720	3964	msedge.exe	96
PID 3964 wrote to memory of 1720	3964	msedge.exe	96
PID 3964 wrote to memory of 4864	3964	msedge.exe	99
PID 3964 wrote to memory of 4864	3964	msedge.exe	99
PID 3964 wrote to memory of 1964	3964	msedge.exe	100
PID 3964 wrote to memory of 1964	3964	msedge.exe	100
PID 3964 wrote to memory of 4124	3964	msedge.exe	104
PID 3964 wrote to memory of 4124	3964	msedge.exe	104
PID 3964 wrote to memory of 4124	3964	msedge.exe	104
PID 3964 wrote to memory of 4324	3964	msedge.exe	105
PID 3964 wrote to memory of 4832	3964	msedge.exe	106
PID 3964 wrote to memory of 4324	3964	msedge.exe	105
PID 3964 wrote to memory of 4832	3964	msedge.exe	106
PID 3964 wrote to memory of 4872	3964	msedge.exe	107
PID 3964 wrote to memory of 4872	3964	msedge.exe	107
PID 3964 wrote to memory of 4872	3964	msedge.exe	107
PID 3964 wrote to memory of 3056	3964	msedge.exe	109
PID 3964 wrote to memory of 980	3964	msedge.exe	110
PID 3964 wrote to memory of 980	3964	msedge.exe	110
PID 3964 wrote to memory of 980	3964	msedge.exe	110
PID 3964 wrote to memory of 4556	3964	msedge.exe	113
PID 3964 wrote to memory of 4556	3964	msedge.exe	113
PID 3964 wrote to memory of 5660	3964	msedge.exe	123
PID 3964 wrote to memory of 5660	3964	msedge.exe	123
PID 3964 wrote to memory of 5708	3964	msedge.exe	124
PID 3964 wrote to memory of 5708	3964	msedge.exe	124
PID 3964 wrote to memory of 5884	3964	msedge.exe	125
PID 3964 wrote to memory of 5884	3964	msedge.exe	125
PID 3964 wrote to memory of 5932	3964	msedge.exe	126
PID 3964 wrote to memory of 5932	3964	msedge.exe	126
PID 3964 wrote to memory of 5352	3964	msedge.exe	127
PID 3964 wrote to memory of 5352	3964	msedge.exe	127
PID 3964 wrote to memory of 5764	3964	msedge.exe	129
PID 3964 wrote to memory of 5728	3964	msedge.exe	130
PID 3964 wrote to memory of 5732	3964	msedge.exe	131
PID 3964 wrote to memory of 5384	3964	msedge.exe	135
PID 3964 wrote to memory of 5384	3964	msedge.exe	135
PID 3964 wrote to memory of 5756	3964	msedge.exe	139

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://nsktrgroup.com/
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff9dc3ac188,0x7ff9dc3ac194,0x7ff9dc3ac1a0
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1632,i,6074052299581016188,499264037449232788,524288 --field-trial-handle=2384,i,18140692630493287728,3084341968726331844,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,3638880355874495835,9289562016508969980,262144 --field-trial-handle=2384,i,18140692630493287728,3084341968726331844,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:2
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2616,i,5281893946631189198,10304208887549241594,524288 --field-trial-handle=2384,i,18140692630493287728,3084341968726331844,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3500,i,14150818068195106119,10256503775733579492,2097152 --field-trial-handle=2384,i,18140692630493287728,3084341968726331844,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,15663690091017384281,5762045079105180622,2097152 --field-trial-handle=2384,i,18140692630493287728,3084341968726331844,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,13817062175854823508,1891008933575535644,2097152 --field-trial-handle=2384,i,18140692630493287728,3084341968726331844,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4308,i,6585659780084790911,9032418274564251794,2097152 --field-trial-handle=2384,i,18140692630493287728,3084341968726331844,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:2
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,9974854607480041958,8920958047594787199,524288 --field-trial-handle=2384,i,18140692630493287728,3084341968726331844,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:8
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3684,i,15051647452676894100,9692928440123853284,524288 --field-trial-handle=2384,i,18140692630493287728,3084341968726331844,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5352,i,9482513929667787027,14216957583543743262,2097152 --field-trial-handle=2384,i,18140692630493287728,3084341968726331844,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3540,i,12074640838134027797,18202647796012819973,524288 --field-trial-handle=2384,i,18140692630493287728,3084341968726331844,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,8829258541490885095,17926829130272664927,524288 --field-trial-handle=2384,i,18140692630493287728,3084341968726331844,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:8
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5700,i,9418994123530278928,9144189891766192418,2097152 --field-trial-handle=2384,i,18140692630493287728,3084341968726331844,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,1248202887331731305,12558948537470528819,524288 --field-trial-handle=2384,i,18140692630493287728,3084341968726331844,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,1248202887331731305,12558948537470528819,524288 --field-trial-handle=2384,i,18140692630493287728,3084341968726331844,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6204,i,10175861684106935831,7668895325772184847,2097152 --field-trial-handle=2384,i,18140692630493287728,3084341968726331844,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=device.mojom.XRDeviceService --lang=en-US --service-sandbox-type=xr_compositing --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6944,i,1982638415193115827,305853329086804483,524288 --field-trial-handle=2384,i,18140692630493287728,3084341968726331844,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:8
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4892,i,15740947358656194482,10202756835167707408,524288 --field-trial-handle=2384,i,18140692630493287728,3084341968726331844,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:8
  2⤵
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,18163272937978440676,17312693194779748406,524288 --field-trial-handle=2384,i,18140692630493287728,3084341968726331844,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:8
  2⤵
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,4748206132930373710,9710247422230511131,524288 --field-trial-handle=2384,i,18140692630493287728,3084341968726331844,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:8
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,6861203992337825438,5107026370694266355,524288 --field-trial-handle=2384,i,18140692630493287728,3084341968726331844,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:8
  2⤵
  PID:5932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6808,i,13788180865872161023,379625698531233837,524288 --field-trial-handle=2384,i,18140692630493287728,3084341968726331844,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:8
  2⤵
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7136,i,6815175498060195255,5771783978445639251,524288 --field-trial-handle=2384,i,18140692630493287728,3084341968726331844,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:8
  2⤵
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3544,i,6842812286511977659,2481505408652800800,524288 --field-trial-handle=2384,i,18140692630493287728,3084341968726331844,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:8
  2⤵
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,14892477571894427578,14889721500972188808,524288 --field-trial-handle=2384,i,18140692630493287728,3084341968726331844,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:8
  2⤵
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,3025329664965684343,12586900154957087069,524288 --field-trial-handle=2384,i,18140692630493287728,3084341968726331844,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:8
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3468,i,15139431005335634058,7179027470434225319,262144 --field-trial-handle=2384,i,18140692630493287728,3084341968726331844,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5756

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 4970154c03e71372a250182be039e454337be64d232075875a85fe45679e9791
MD5 f5c5af3b32bf2f99864931d9fb64fb42
SHA1 f24e357193c4d16a3e2dd7ccb217f49678a9ab6f
SHA512 e13cff7f429aabbf53f978beb247cb48c5b6dc77f3bd5cc5401dd0008d1b0788c163e99967285b341713f8d21e369c5402e6a1776cbc28df24efbcdd678eba70
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
TLSH
T11EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 95a2cfe1dffd9d2384eb60756eab418eaee499884a3baef5598cdff829712e0b
MD5 8b8d9c4161873eb79aa9d900e02b86b7
SHA1 f0ce0e974052f9228466d0a58633ace30de4d75f
SHA512 b594c40ea5d1dea943739b32218fa8ed10cdca59044af97b6a691a68aa0d091bb2b13864a5a33a25c852c1be5022b94782532270312af455fa01a4e4f2078e9a
TLSH
T101711A584A92099DD3513230EDEE1F5A71718BC41F5B8E023F74D8BDA52A7F389E28E4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b4e4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b4e4.TMP
Size 3KB
SHA256 49908b416bfcb45843f9a345e52cefd6b5adb08e6f3daa234a7fab73691f81e1
MD5 2213902d818bd185fbe030fa85ae0d7f
SHA1 21957e1bba0bc2afc7ea76da8d662c114b5971b5
SHA512 295a7cdafee860ac019b59044236ec1f53c115afaacb92f1e077fc1e5ea8be31cfc2a2618eed6d9348d226fb3d8ccbf76a605614bb5d9440f8ba92a9d1354e42
TLSH
T19C711A584A96099DD3503230EDEE1F5A71718BC41F5B8E023F7488BCA5257F789E28E4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 b65f996c460b8fb9b0d8098135e95cbd681fc85677131084c693178446ca01b1
MD5 9280901e269c8b35711252c5b723bc20
SHA1 a4f142191caedf6c99f1277a1e28c58528a427e7
SHA512 d7eb0a638a39808de710bd4913db04e2c40657a9b33759e2cd85c1b65a3797c38a08c817a885e9eec7c8360c819e70046a0769a50a6351da4be261393021f97e
TLSH
T1B681D0E3C2F9C62DC92152F0BB286E3ADE1D091557283C5A89E5EF4F67E2471D10164F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 9ed962a196bc451b35b3390a5dd6d2b0089ced6df935a2022ae61eb4e4bdeabb
MD5 5a8841750617c859395a8e98a1fe2fac
SHA1 d8579c9dd8735875a4570a10a5cf3be4a8f87b89
SHA512 33890b31b102824885445d6f4710c6a1d033cf9d1149a227b2b281a034b31ed951d26902eed9f2f4b34bb14d02a9000cbbba3d604b7489922d55bca2f739396c
SSDEEP 192:sxZEDROyM/jK1Ml8MkL/fisAtF2Idp2oHW6+WNuVYG/zlLK2opIg4J:sxZEDYML/fisAtF3THbA/oPc
TLSH
T1C852E852AA345977CCDBD20DF955BB53D6F50472A2900E44AAFCDA0C04E6BED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 e6620e59e1bf314250da305d0d56ec40f2880bae212eac1b799beb65fffdb3ef
MD5 05278630892c706124c9f8fafad43ee6
SHA1 dc538ec171d0166a85cddf8db4a046235b477d8c
SHA512 cf62c8fbb9cb27021c37adf60460a6cbf2adff05c0c386c60c074ae30c842d8a3bd631096c86a6eaa895ef30f5269e4a97bf3f693cd837e91bf27234fdff6fae
SSDEEP 192:sxZEDROyM/jK1Ml8UQwkL/fisUntIxBIdpooHW6+WNuVYG/zlLWopIg5dJ:sxZEDYqDL/fisStI09HbA/Vt
TLSH
T14452C756AA385977CCDAD20DF945BB63D6F5147296900E44AAFCCA0C00E6BED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 0bc69faeecfe1b71bb5010665825e0958b5cc30a9d6f61366b7245fb0b4ec983
MD5 a8ed9a4fc64cf97cc7af06079799b550
SHA1 43d439ab8b1f2367d37383bbeb187c623fbf16bb
SHA512 b2dc93dc0e01bd1b2b21c382d12ad5c846689a2ea2c514587de7cbf4c66d063b9d771e533254d0f0b88118c21a7d9258e70feba8e61df98522e62e91910b552c
SSDEEP 768:iAs6pD1WvxzUj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNRroeI:iAs6pD1WvxzUju1jahILIsNqeI
TLSH
T1CCE2FA3B680CCB7E4F841E5CAC2AAF967DD801CBAB94895447FA484C03C77EA51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 3006c146929bc1824414baefcc6fb4d23c520360297303a2f91fbeca5c1d1056
MD5 dd2f3f846b538411b689ac30bbb3d703
SHA1 ffb24ed35a1ccc121afad2b41dfc6f2bf17c5db6
SHA512 5b70bf944a8d80c7fdac247f521be792f4e1cf76dadc6ef374bcd56e6cdd5ed25b590ebb12b08dd68d61c6f3e76edec39c6e88cf02202563faa60cbf6469bd8e
SSDEEP 96:KUAAKtePe9OKW06aMgKtS6ioK3K+qKcKD6z:iiRlHWr3Y
TLSH
T1C3E1130231BF0A123D7E6A189255C77B4B92B563301DA42B7BE940714E6AE380DFCDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5934c2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5934c2.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 dd176970198d7cfbced949402d61eabc7b344330419a84c32913499f3e72459e
MD5 06c8b43ca201c0757aa0996d1ef8bf1a
SHA1 0ef12b7ffc9d1736dd73f484f66fefc679d4d35b
SHA512 261ed6082e6f2b43973f3d5314c1a57f69d7ace6fb410d8b99e73277c73da56f0339fa78957189b1616b5b692e45e6bb75af1faad5aa69844e41fba5fb6807ed
SSDEEP 384:nAqiF1tNnNnb9crsNQ8TUNTUlIlutpChf/wYft2Sw9xOsHeFmhg2GlP7Vfn:KF1jZbqJwgoOQ61wrOqeFm2lPJfn
TLSH
T1D6D2F7F158E78977D9AE4B87A73E3E525EBCC1A3B4811980BBC8590DCC472BFD206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4aada763a41e6508f6eeb421fc176f045138a6df6a997a69c9bb95c41d640683
MD5 2a966259de04b2c96d141adc2f70be4c
SHA1 7f05597de5e064eda372f413ca6a768e663fca76
SHA512 bc992edabd5d96149409aa0fb8ef5a9a54e1f1dd26a01de38d0fa0354c0d8ac21b617fd8a47ccced3937334093341b695b436d35c32e038e1bec2de7975a14fb
SSDEEP 192:qONQ6O7+3hQmiUy9vGttb0sO2b/WgG7rU6:qONQ61uGt9xOsIfU6
TLSH
T1CE02E7357C286CB78EF2AD45FA8727275FA5107BE9952F40DAE81E0C00D765C2347C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 e58ea64de6ed01f41b2c410cd7e77fb6ce454a1eefe14d0c6a1bb11735b73690
MD5 8f981f91608c89563b50abca52b7b07b
SHA1 4edee961563c6831403521d691ebd8ab1d12af08
SHA512 790c21c5285f785e45453d1a1dbe6c3e083625ccba4dfea1f24608376426da5b75063af9ce211371982ed89df5eb624b632d706665f2db477c9097054f4b6819
SSDEEP 192:uuBzsNQ7QzuJC7+3vDNQmiU1POQ4atb0sO2b/H5EqLM4/zewg5VL2PAZFLPeOV1r:nBsNQ7tpPsfa9xOsHeTmhg2GlP7Vt
TLSH
T179724A756C385CB39AB39946B94B36235FB410B7E9841E41DAE99F0D00CB2AC2347D2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 687f0332c6fc624767a7074a134733d0a9b7deeb66ec290da62b710c556121a3
MD5 0805d3878545fea7744d8989b04553c1
SHA1 ab4f001daef6045410c2b9148a5bd9614eb27065
SHA512 0a97dfddc50c062a539ee46db1725019a55fddd791b9c57dfdafd3613c1af716002d0dca93e54c9f3aca94ab4e2a9304cc1518343759de5d19b3043268961f33
SSDEEP 384:nVtNnNnb96sNQ7tpCsfa9xOsHeTmhg2GlP7Vfn:VjZbUhLyrOqeTm2lPJfn
TLSH
T13F925B7569386DB39AB39D46B50B36536F7411B7D9802E81DEDC9F0E00CB69C234782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 92506b2d2ceff6dcf8a798883eb84a2c60a3ce033800455d4b02dab4832b1468
MD5 b0fd0327faa2f71a7db54ffd42101012
SHA1 d4ea5455ae2125023be533cb530e7b79173d1074
SHA512 2bc43fb2dda8c73b46d986617de9e73349d8afbe806181c6ac23f19b28164daab70f3b003a6df5f167b611f403433d97372d56ce42ee2eae28bf9b92795e74fc
SSDEEP 384:n4LtNnNnb96sNQutpCbfa9xOsHeTmhg2GlP7Vfn:CjZbUmcyrOqeTm2lPJfn
TLSH
T1FC926B7568386DA39AB39D46F50B36536F7411BBD9842E81DEDC9F0E00CB69C234782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 eb4ca4394b310ad67314a968126b2d2eb35892b21e2dc9cda14349dde802a3a8
MD5 270146c43aa56b5bbb3d8fba68b77f6c
SHA1 ba2471232e50a944077e2420210002c17f6a157c
SHA512 e9bcfa69ba834489d07b7c6bdd3f8074ff76170d45b1284cb8af68d302e4c3baa98da3b2d98ed55fc58eb88131094553440314d0570608692d7ed1ca308e4094
SSDEEP 192:qONZ6O7+3BQmiUyOv9ttb0sO2b/H5EzcN4/zU6:qONZ6xb9t9xOsHeImU6
TLSH
T15512F97578386CB79EF2AD46F98727179FA5107BE9862E40D9E81E0C00CBA5C2347C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e04ce1d7e837a1330e343482943c037881c11797d0cfae953aa6d685ad92c591
MD5 8a1bc2d777dd048fe1dc937aada85b3b
SHA1 546a47cb12d2bb6407bb40ac8d30fedf0093a1f7
SHA512 cfedb0d66f59635794f5c4f7d99e20f6dfcafdf435c5385d15b8e1ee70ab571733b1e172efcc65c762dd7655edc427e9c655799c2080426309aaf9e6f5096557
TLSH
T101410959BAEA1548B3B76F1A9BF6A46D487BBD372E06D49D00110E4F4663A80C861733
MD5 SHA1 SHA512 TLSH

Submit Download

6592a9b8-93dc-4c7a-a5bf-79319a910a3c.tmp

Path C:\Users\Admin\AppData\Local\Temp\6592a9b8-93dc-4c7a-a5bf-79319a910a3c.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d0359dfb-3f8e-4ed1-bc39-7b796bac204b.tmp

Path C:\Users\Admin\AppData\Local\Temp\d0359dfb-3f8e-4ed1-bc39-7b796bac204b.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3964_1687760271\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f270a73f-e040-45c6-add6-63f7b17e8277.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3964_1687760271\f270a73f-e040-45c6-add6-63f7b17e8277.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download