4677046995d7f81bdbc66d96ea5451c8d410f0182709ef9c30753ae3e072f363

Analysis

user interaction
yes
max time kernel
301s
max time network
301s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 03:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NORDEN_II_Setup_v1.0.1.exe
Size 122.4MB
Sample260802-dpbcnscd65
SHA256 4677046995d7f81bdbc66d96ea5451c8d410f0182709ef9c30753ae3e072f363
MD5 573103a29d9fa6861fe640d157ccbf05
SHA1 6edbdad1c2af0073c1b222b89b69fa07c5b0ad62
SHA512 b182bc152d86ea475f5cfbeaf1e868435091c4e45593ba86a1507aa55740b188e7f27062d7462c87aeb87e97062c237da28f0da1b45e36504c69ab331ecc3348
SSDEEP 3145728:vCRAgsYFwvEmwycGC69uq8CnbgJ1D0fzRXNnErovFPzuQ:6RJsiwvgMgkMDaN+o5zT
TLSH
T1555833D8DFE1A7F3D7574432889DE2C7181380920770DBEC913AF85E96997AB0A60F94
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2160	node.exe

Loads dropped DLL 2 IoCs

pid	Process
4900	NORDEN_II_Setup_v1.0.1.exe
4900	NORDEN_II_Setup_v1.0.1.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
1512	wscript.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Vanguard C4\NORDEN II\arm\eurofighter (1).png	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\data\aircraft\norden_cpr_base.csv	NORDEN_II_Setup_v1.0.1.exe
File opened for modification	C:\Program Files\Vanguard C4\NORDEN II\sandbox3d\assets\index-DDuWtIU3.js	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\spc\spc.js	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\arm\index.html	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\assets\rules\phase2_dependencies\damage\2x_engine_fighter_metaparts.blkx	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\assets\rules\phase2_dependencies\damage\dm_parts_additional_dependency_map_b_52h.blkx	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\assets\rules\phase2_dependencies\damage\hit_visualization.blkx	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\assets\rules\phase2_dependencies\damage\projectile.blkx	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\assets\rules\phase2_dependencies\damage\secondary_shatter_presets.blkx	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\combat-board\index.html	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\sandbox3d\index.html	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\assets\rules\phase2_dependencies\damage\explosive.blkx	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\assets\rules\phase2_dependencies\damage\jet_fighter_metaparts.blkx	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\sandbox3d\assets\index-qV54Vuhm.css	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\combat-board\style.css	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\data\integration\doctrine_armament_authority.json	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\server.js	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\assets\doctrine\loft_toss.png	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\assets\icons\StoreLogo.png	NORDEN_II_Setup_v1.0.1.exe
File opened for modification	C:\Program Files\Vanguard C4\NORDEN II\assets\icons\Square71x71Logo.png	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\node\node.exe	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\assets\rules\phase2_dependencies\damage\metaparts_flat.csv	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\assets\rules\phase2_dependencies\phase2_dependencies\README_NORDEN_LOADOUT_RULES_PHASE2.txt	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\assets\rules\phase2_dependencies\phase2_dependencies\norden_fuel_conflict_seed_v1.csv	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\assets\rules\phase2_dependencies\phase2_dependencies\norden_rail_adapter_inventory_v1.csv	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\assets\ui\norden_icon.png	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\data\resolvers\norden_aircraft_speed_authority_v1.csv	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\loadout\style.css	NORDEN_II_Setup_v1.0.1.exe
File opened for modification	C:\Program Files\Vanguard C4\NORDEN II\NORDEN_SOLVER_V1\data\aircraft\norden_preset_slot_refs.csv	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\assets\rules\phase2_dependencies\damage\damage_system.blkx	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\assets\rules\phase2_dependencies\damage\dm_parts_to_avionics_parts_map_f_5.blkx	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\assets\rules\phase2_dependencies\damage\fm_engine.html	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\assets\rules\phase2_dependencies\damage\us_an_alr_56m.blkx	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\data\norden_weapon_effect_reference.json	NORDEN_II_Setup_v1.0.1.exe
File opened for modification	C:\Program Files\Vanguard C4\NORDEN II\NORDEN_SOLVER_V1\data\doctrine\norden_cpr_base.csv	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\model-viewer.min.js	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\assets\doctrine\unified_attack_release.png	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\sandbox3d\assets\index-DDuWtIU3.js	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\data\norden_target_effect_health_matrix.json	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\sandbox3d\__manus__\debug-collector.js	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\vendor\model-viewer\README_MODEL_VIEWER_OFFLINE.txt	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\arm\arm_threat.png	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\assets\doctrine\pop_up_attack.png	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\assets\rules\phase2_dependencies\damage\us_agm_65e2.blkx	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\NORDEN_SOLVER_V1\data\stores\norden_final_loadout_master.csv	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\mac\index.html	NORDEN_II_Setup_v1.0.1.exe
File opened for modification	C:\Program Files\Vanguard C4\NORDEN II\NORDEN_SOLVER_V1\data\stores\weapon_display_names.csv	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\comparison\style.css	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\data\integration\weapon_intelligence_spc_active.csv	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\arm\pantsir_1rs2.png	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\assets\rules\phase2_dependencies\damage\4x_engine_bomber_metaparts.blkx	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\NORDEN_SOLVER_V1\data\doctrine\optics.csv	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\NORDEN_SOLVER_V1\data\public\public_scores.csv	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\data\aircraft\public_scores.csv	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\docs\NORDEN II #U2014 Mission CPR Reference.docx	NORDEN_II_Setup_v1.0.1.exe
File opened for modification	C:\Program Files\Vanguard C4\NORDEN II\assets\icons\Square44x44Logo.png	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\assets\doctrine\single_pilot_technique.png	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\assets\rules\phase2_dependencies\phase2_dependencies\aircraft_spc_capabilities_v2.csv	NORDEN_II_Setup_v1.0.1.exe
File opened for modification	C:\Program Files\Vanguard C4\NORDEN II\assets\icons\StoreLogo.png	NORDEN_II_Setup_v1.0.1.exe
File opened for modification	C:\Program Files\Vanguard C4\NORDEN II\assets\icons\Wide310x150Logo.png	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\icons\loadout_console.png	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\assets\ui\kneeboard.html	NORDEN_II_Setup_v1.0.1.exe
File created	C:\Program Files\Vanguard C4\NORDEN II\NORDEN_SOLVER_V1\data\stores\weapon_core_v1_internal_MODEL_RESOLVER.csv	NORDEN_II_Setup_v1.0.1.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1278016123\extraction.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1557560175\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1557560175\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1557560175\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1557560175\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1557560175\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1557560175\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1557560175\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1557560175\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1557560175\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1602956479\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1959359524\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1557560175\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1557560175\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1557560175\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1557560175\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1557560175\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_903744853\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1557560175\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1557560175\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1557560175\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1557560175\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1557560175\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1229797033\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1557560175\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1557560175\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1557560175\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1557560175\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1557560175\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1278016123\automation.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1557560175\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1557560175\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1557560175\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1959359524\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1557560175\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1557560175\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1557560175\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1557560175\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1557560175\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1557560175\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1557560175\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_5004_1727111211\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1557560175\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1557560175\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_903744853\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_903744853\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1557560175\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1557560175\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1557560175\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1557560175\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_740160676\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1557560175\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1557560175\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1557560175\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1557560175\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1557560175\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1602956479\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1278016123\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1278016123\travel-facilitated-booking-bing.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1557560175\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1557560175\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1959359524\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1557560175\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_1557560175\offscreendocument.html	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NORDEN_II_Setup_v1.0.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5140	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301152799512120"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{658A9AAC-FCB9-4EFA-9069-007BF55E3B7D}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4480	msedge.exe
4480	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5004	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 1512	4900	NORDEN_II_Setup_v1.0.1.exe	90
PID 1512 wrote to memory of 2160	1512	wscript.exe	91
PID 1512 wrote to memory of 5004	1512	wscript.exe	93
PID 5004 wrote to memory of 1672	5004	msedge.exe	94
PID 5004 wrote to memory of 1216	5004	msedge.exe	96
PID 5004 wrote to memory of 5140	5004	msedge.exe	97
PID 5004 wrote to memory of 1216	5004	msedge.exe	96
PID 5004 wrote to memory of 1216	5004	msedge.exe	96
PID 5004 wrote to memory of 5028	5004	msedge.exe	98
PID 5004 wrote to memory of 5028	5004	msedge.exe	98
PID 5004 wrote to memory of 1252	5004	msedge.exe	99
PID 5004 wrote to memory of 1252	5004	msedge.exe	99
PID 5004 wrote to memory of 2972	5004	msedge.exe	100
PID 5004 wrote to memory of 1252	5004	msedge.exe	99
PID 5004 wrote to memory of 2972	5004	msedge.exe	100
PID 5004 wrote to memory of 2972	5004	msedge.exe	100
PID 5004 wrote to memory of 2876	5004	msedge.exe	101
PID 5004 wrote to memory of 5840	5004	msedge.exe	102
PID 5004 wrote to memory of 2876	5004	msedge.exe	101
PID 5004 wrote to memory of 2876	5004	msedge.exe	101
PID 5004 wrote to memory of 5840	5004	msedge.exe	102
PID 5004 wrote to memory of 5840	5004	msedge.exe	102
PID 5004 wrote to memory of 4672	5004	msedge.exe	104
PID 5004 wrote to memory of 4672	5004	msedge.exe	104
PID 5004 wrote to memory of 1208	5004	msedge.exe	105
PID 5004 wrote to memory of 2408	5004	msedge.exe	106
PID 5004 wrote to memory of 1208	5004	msedge.exe	105
PID 5004 wrote to memory of 2408	5004	msedge.exe	106
PID 5004 wrote to memory of 1604	5004	msedge.exe	109
PID 5004 wrote to memory of 1604	5004	msedge.exe	109
PID 5004 wrote to memory of 2936	5004	msedge.exe	112
PID 5004 wrote to memory of 2588	5004	msedge.exe	114
PID 5004 wrote to memory of 2588	5004	msedge.exe	114
PID 5004 wrote to memory of 5088	5004	msedge.exe	115
PID 5004 wrote to memory of 5088	5004	msedge.exe	115
PID 5004 wrote to memory of 6020	5004	msedge.exe	116
PID 5004 wrote to memory of 6020	5004	msedge.exe	116
PID 5004 wrote to memory of 5968	5004	msedge.exe	117
PID 5004 wrote to memory of 5968	5004	msedge.exe	117
PID 5004 wrote to memory of 4556	5004	msedge.exe	118
PID 5004 wrote to memory of 4700	5004	msedge.exe	119
PID 5004 wrote to memory of 1292	5004	msedge.exe	120
PID 5004 wrote to memory of 1388	5004	msedge.exe	121
PID 5004 wrote to memory of 1388	5004	msedge.exe	121
PID 5004 wrote to memory of 1332	5004	msedge.exe	125
PID 5004 wrote to memory of 1332	5004	msedge.exe	125
PID 5004 wrote to memory of 5216	5004	msedge.exe	126
PID 5004 wrote to memory of 5216	5004	msedge.exe	126
PID 5004 wrote to memory of 4480	5004	msedge.exe	127
PID 5004 wrote to memory of 4184	5004	msedge.exe	128
PID 5004 wrote to memory of 4184	5004	msedge.exe	128
PID 5004 wrote to memory of 5780	5004	msedge.exe	129
PID 5004 wrote to memory of 5780	5004	msedge.exe	129
PID 5004 wrote to memory of 260	5004	msedge.exe	130
PID 5004 wrote to memory of 260	5004	msedge.exe	130
PID 5004 wrote to memory of 3360	5004	msedge.exe	131
PID 5004 wrote to memory of 3360	5004	msedge.exe	131
PID 5004 wrote to memory of 4576	5004	msedge.exe	132
PID 5004 wrote to memory of 4576	5004	msedge.exe	132
PID 5004 wrote to memory of 3168	5004	msedge.exe	133
PID 5004 wrote to memory of 3168	5004	msedge.exe	133
PID 5004 wrote to memory of 6008	5004	msedge.exe	134
PID 5004 wrote to memory of 6008	5004	msedge.exe	134
PID 5004 wrote to memory of 2148	5004	msedge.exe	135

C:\Users\Admin\AppData\Local\Temp\NORDEN_II_Setup_v1.0.1.exe
"C:\Users\Admin\AppData\Local\Temp\NORDEN_II_Setup_v1.0.1.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Program Files\Vanguard C4\NORDEN II\NORDEN_Launch.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1512
- - C:\Program Files\Vanguard C4\NORDEN II\node\node.exe
    "C:\Program Files\Vanguard C4\NORDEN II\node\node.exe" "C:\Program Files\Vanguard C4\NORDEN II\server.js"
    3⤵
    - Executes dropped EXE
    PID:2160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://localhost:8000/
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x358,0x7ffa962ec188,0x7ffa962ec194,0x7ffa962ec1a0
      4⤵
      PID:1672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1940,i,6523596092278183280,10225812027832668857,262144 --field-trial-handle=2648,i,15137161127412355116,12858457801061038750,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:2
      4⤵
      PID:1216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2144,i,695657138803158150,739834055956138419,524288 --field-trial-handle=2648,i,15137161127412355116,12858457801061038750,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:11
      4⤵
      System Time Discovery
      PID:5140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2380,i,536136457625754140,7144324999802736089,524288 --field-trial-handle=2648,i,15137161127412355116,12858457801061038750,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:13
      4⤵
      PID:5028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3564,i,15341043588386689043,1015421686561348336,2097152 --field-trial-handle=2648,i,15137161127412355116,12858457801061038750,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
      4⤵
      PID:1252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3576,i,13416073491824266998,2506180917746785271,2097152 --field-trial-handle=2648,i,15137161127412355116,12858457801061038750,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
      4⤵
      PID:2972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,8464566033844914933,5821062729128616961,2097152 --field-trial-handle=2648,i,15137161127412355116,12858457801061038750,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
      4⤵
      PID:2876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,6567912790758725613,17377198364941701385,2097152 --field-trial-handle=2648,i,15137161127412355116,12858457801061038750,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:9
      4⤵
      PID:5840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,14247014737275861601,9641521603362585650,524288 --field-trial-handle=2648,i,15137161127412355116,12858457801061038750,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:14
      4⤵
      PID:4672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,3697839791766478103,4815349999815449878,524288 --field-trial-handle=2648,i,15137161127412355116,12858457801061038750,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
      4⤵
      PID:1208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,6119514131988437470,10059402474551791829,524288 --field-trial-handle=2648,i,15137161127412355116,12858457801061038750,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:14
      4⤵
      PID:2408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,9062153852372407263,689650896200267685,524288 --field-trial-handle=2648,i,15137161127412355116,12858457801061038750,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:12
      4⤵
      PID:1604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,123509826841096329,3091493388207349091,524288 --field-trial-handle=2648,i,15137161127412355116,12858457801061038750,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
      4⤵
      PID:5884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,123509826841096329,3091493388207349091,524288 --field-trial-handle=2648,i,15137161127412355116,12858457801061038750,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
      4⤵
      PID:2936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,17742638390924281785,17487070950863875868,524288 --field-trial-handle=2648,i,15137161127412355116,12858457801061038750,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:14
      4⤵
      PID:2588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,16157273883443917803,18292037745134744523,524288 --field-trial-handle=2648,i,15137161127412355116,12858457801061038750,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:14
      4⤵
      PID:5088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4568,i,2674776457582269386,1933307272992500022,524288 --field-trial-handle=2648,i,15137161127412355116,12858457801061038750,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
      4⤵
      PID:6020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,14879606658811698292,617796819501715431,524288 --field-trial-handle=2648,i,15137161127412355116,12858457801061038750,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:14
      4⤵
      PID:5968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,1981576749132886060,14486754183720836937,524288 --field-trial-handle=2648,i,15137161127412355116,12858457801061038750,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:14
      4⤵
      PID:4556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,9472699370517062235,3234402150076384699,524288 --field-trial-handle=2648,i,15137161127412355116,12858457801061038750,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:14
      4⤵
      PID:4700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6732,i,9329207454528439464,11475083615531029610,524288 --field-trial-handle=2648,i,15137161127412355116,12858457801061038750,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
      4⤵
      PID:1292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,12607552236051037872,3594416319601587118,524288 --field-trial-handle=2648,i,15137161127412355116,12858457801061038750,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:14
      4⤵
      PID:1388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6916,i,5924948723838688399,13373850129350497722,524288 --field-trial-handle=2648,i,15137161127412355116,12858457801061038750,262144 --variations-seed-version --mojo-platform-channel-handle=1456 /prefetch:14
      4⤵
      PID:1332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=924,i,2702227579560900157,7302777112727792956,524288 --field-trial-handle=2648,i,15137161127412355116,12858457801061038750,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
      4⤵
      PID:5216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5996,i,7348954767097212823,6876652799795055163,262144 --field-trial-handle=2648,i,15137161127412355116,12858457801061038750,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7004,i,15779156851323282704,3518171520394576120,524288 --field-trial-handle=2648,i,15137161127412355116,12858457801061038750,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:14
      4⤵
      PID:4184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3280,i,15268541892312766438,16229100693198925928,524288 --field-trial-handle=2648,i,15137161127412355116,12858457801061038750,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
      4⤵
      PID:5780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,6577244916528366415,12992411427529621427,524288 --field-trial-handle=2648,i,15137161127412355116,12858457801061038750,262144 --variations-seed-version --mojo-platform-channel-handle=1312 /prefetch:14
      4⤵
      PID:260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,3287357980839190880,9680678284581487388,524288 --field-trial-handle=2648,i,15137161127412355116,12858457801061038750,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:14
      4⤵
      PID:3360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,203443811354073528,9888969896457616055,524288 --field-trial-handle=2648,i,15137161127412355116,12858457801061038750,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:14
      4⤵
      PID:4576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,5846695810166345541,17862962763170460721,524288 --field-trial-handle=2648,i,15137161127412355116,12858457801061038750,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:14
      4⤵
      PID:3168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,8579000139632744647,14852571169646903136,524288 --field-trial-handle=2648,i,15137161127412355116,12858457801061038750,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:14
      4⤵
      PID:6008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6820,i,18422167014489763644,1797887485837471345,524288 --field-trial-handle=2648,i,15137161127412355116,12858457801061038750,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
      4⤵
      PID:2148

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NORDEN_Launch.vbs

Path C:\Program Files\Vanguard C4\NORDEN II\NORDEN_Launch.vbs
Size 1KB
SHA256 aa0f0a4c2a1d323ca8931e1d797a36614103335b9772dcb70c3e5fc75c957a4f
MD5 94ec622cae8d3df01f19129916c9176e
SHA1 873c5a26af0c9e10adbfd3c173d497e40c9c35f9
SHA512 7368d69fc3fbc9ba7f24e586854f6d227017c60cad7ae077bf0486356832a37ca595d91cf24e2adacd1e4fb18a7f2b4a8f9e1dcdc3861a6eadf6cc5dea31e161
TLSH
T1E021404AE41FFA3E5E5326C9219C487E6F4F3160CB772C7B0B5489AD681503C61D1AC3
MD5 SHA1 SHA512 TLSH

Submit Download

NORDEN_II_video_icon.mp4

Path C:\Program Files\Vanguard C4\NORDEN II\icons\NORDEN_II_video_icon.mp4
Size 10.0MB
SHA256 7a55607df062c2d85f088e2c36fcafff77a617a297c2c02975249c7ad8171d3c
MD5 1fee27e69a8f6377ec57efb61c6ad918
SHA1 59c0a814158ebd34987419d3682214f3a2d77ad7
SHA512 36163228eb398de5f0040cf9b4e2d2c446f9442346b06215a525db872c63867b5eae383a1739293717528c912b1228cd465b0cb13bf2056708504f8f751d1180
SSDEEP 196608:La5XkUvsRpCzd4k+4AQXI9xSXO6ngYGWU6GF6L8/KE/KMER807ydFK:+vsgl+4AQFe6gYGWvGgAnSDRN7ydFK
TLSH
T1C7B633B4279491B7E3080D7E14C807572A5ED08FA5A363BD922EDD4E5CF998B5002FEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm_console.png

Path C:\Program Files\Vanguard C4\NORDEN II\icons\arm_console.png
Size 3.4MB
SHA256 ca0884793d3c97395c2030045c6bd9a19d885a8a03f5c4ee7187f58fead52c4e
MD5 0a3e6a0b7336b4bd665fffbab498dff8
SHA1 b899a13f971b1402f894aacdbb95729b6dbb3f92
SHA512 881890702d312d927039526f4271c1abc9db59e6c0a1b861153d42eaf7d26c7f45a82ebd390a8ac59c160c975828ee5f74ce243b141015093f3ca5d82a1cfca6
SSDEEP 98304:DUdZHbxNa8ZgCTWkRqJztnhiawzFhbOol21K1sup:DSXaWgvhTwvbOol21KTp
TLSH
T13EF53355DBC7C3F2E1D740041AE93369151589E003A87B4D9272F9FCBAAE7A61E03F1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ballistics_console.png

Path C:\Program Files\Vanguard C4\NORDEN II\icons\ballistics_console.png
Size 3.5MB
SHA256 6493c0eeb229945dfb8605c7befb967789d867289d42117cd3484efe55e49e70
MD5 966c6c80115e2bcd90bf6ab5298818a7
SHA1 c5f6b44362eef51e8ae5dba098f82b2a75ebfafd
SHA512 e337a51064d9e2d0229e7cbbeba850795e5d89ae12ef09eb92e3734ea74e97a63386136ddaffd49fac648f40495db440f71dc2fba5fcd0e23c291cbf2a5e840d
SSDEEP 98304:Pd5Pt68Qj9Xu4Xi5yJFx34kU9gvkvdCITVwh:PdHYu49V3zUSvkvx+h
TLSH
T1F80633C1E8D253F0E2AB2E425D884AC3703451E593852FDE51B8FA5E9B1D79F8423F89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

combat_board_console.png

Path C:\Program Files\Vanguard C4\NORDEN II\icons\combat_board_console.png
Size 1.9MB
SHA256 de9492fbf5e73cd9e170785a9dd4891666897f01b642e308eb80431aede22135
MD5 b98877ddbad4332a5f50f22b5ea3b3e1
SHA1 cb20e9bf7a3a3fbcc6f386d2a240203e9cf898ad
SHA512 31393dcce04da16b84b39e163cde47bef06fe65dc6087be9c59f3774e3a03507e28cdab1b085e206573ff9fbae653b006f1fc7211e70ff19c76ceec5ebf6cf0b
SSDEEP 49152:R1KpUu05mba84C3/Eztu/555zZ8+yjM2pvs+lajMxWUr:R1ThLH4PX5NQLpvs+L9r
TLSH
T1A89533BE566FBD4BD688E777BE472263AB72382047F01D76241DCA0360D5B7CA4224E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon-192.png

Path C:\Program Files\Vanguard C4\NORDEN II\icons\icon-192.png
Size 56KB
SHA256 b634493fef471c4fb20a1d7beae97937a388ac9c6df0b5ebefe7d6a7c337e53b
MD5 2565f64fc8048a46b9e05cc2fa34ab61
SHA1 885458ed42ac807ebf6dfcffada4be99adfdc842
SHA512 07bbc13220b543f60b2c31f0545769dcc21b18986b3d1789e5ac3ff4d2ed8f9eea3a945d57286c573a9e0048d116662e6542961b36405abba80c990efd162595
SSDEEP 1536:Ub+l/tCgdSQ+o+Jr6QdSx4JJwFb1FqyK3:U2VCgdezJr6QdM4JGXF5K3
TLSH
T1EF43F14D9D399A6AF7E091D4C4AB4927D44DC1DD48ADE21F2A8323F19844FF76AA0309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

loadout_console.png

Path C:\Program Files\Vanguard C4\NORDEN II\icons\loadout_console.png
Size 3.4MB
SHA256 10308f3e56283a8285e7b0ee1e6f307a8938a8acd98d61bbceef9739c5e7e83d
MD5 f5f8538daf03412e57473be0e33bb436
SHA1 3124522430e3d9b29a2bd9bec907b596354a3266
SHA512 b2bba296bc16dee8f9f92707d7a3d44eb8ef22537d09d4d9538915fde5ea962dc7afcf125dd141a389654d4b417c054f7fdc04911ca036ddc3573d6330b893d7
SSDEEP 98304:cjqFR/oP8/m4+p3ZZBtG3v/6nKFilDQFGb0wb+ZsF:hFqn4qDBc3vQD0wauF
TLSH
T190F53378D3D217FFF9574915865D16EE085B86B34B0BA3A53032DA1E82B2767238CF18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mac_console.png

Path C:\Program Files\Vanguard C4\NORDEN II\icons\mac_console.png
Size 3.4MB
SHA256 e7d600f5a9a38c2c4a04d9d7fe404b24ff6c9d75b071d98fa80f31f82a095a86
MD5 2fdf64e1096566fd349b36def1070a05
SHA1 9b0986d8c5a37e9b9bf4bf0cf5614e34d50ab17d
SHA512 9fa9dbf94a66fe27c05c0a8ae46db826fe0fe92e5f6805e0d04b10a1e94212ce19955f4711c96fb516b280cd07905e7e02fb87d7429efa50016ecf4b808d995e
SSDEEP 49152:Ywi+Pism1kwijAeqdK6Pa4Zm5PEx7qNZPYt2Rg5d4fjwBoQhklg/px9Gut0vYkgI:YwT6LijAeqbPQ5PeqnPoYtokG50gkgI
TLSH
T1AAF53381EADAB7F2E03BC2285252D708BC0A45696F748794D77BD50D3B1D39C0489F8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spc_console.png

Path C:\Program Files\Vanguard C4\NORDEN II\icons\spc_console.png
Size 3.3MB
SHA256 c359d84656edde7bb0243cad82e8a5b625631c6743b316762eed8ee9d892efc3
MD5 d7ceccd2f87bf7ceb7dfa25229bde854
SHA1 e73f46ac548b44ffd3f5ef06a81bf468fabb8258
SHA512 61ac11b88ce87d02a40b99cc3e0debaf846824ee7404b315bcb992456383d6c06c1edb36398fe8cba8151da71f46fdcc5c3506eff7d711e663a96f273d39fda3
SSDEEP 98304:XipnjlVCg5iWDEVBSpdXpQRx/6NIgpWrroJs/o:SpnjlVCgiWeIXGciro8o
TLSH
T1FDF533E1CAD943F8DC2BCDA8101C9F4AE88103855357C7EA6E71FCEC622E6554A59F0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

strike_package_console.png

Path C:\Program Files\Vanguard C4\NORDEN II\icons\strike_package_console.png
Size 3.3MB
SHA256 1c37b862178a18744120ca7248a03550f1fa0aa097cc9b11d5cf2c8a8a0154bf
MD5 fa51481f4834a0ba11e3c62904d25b6d
SHA1 b06de97f425d0ad8713a2e01df3764e9d863d77d
SHA512 a21ea531aa58dc036bc2573ebb9c161dd7bd5042534ab90ed4b9c34707cedb4cb08311451cb83c242508e3498f81e954f5f5bac1ecb9d7979aa5461697f9d8b5
SSDEEP 98304:r9zfUQ3pka++Ruv7OjYbfmbyQqymhNMZRWS:prUpORujHzyyQvmC/
TLSH
T1E6F533A9C3F1BBFBCC03FA409D721A8C350274E457C7EB6699B6C25E9048B564416FE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.html

Path C:\Program Files\Vanguard C4\NORDEN II\index.html
Size 18KB
SHA256 ddbcbf2e27ccffb4b54794cb89ad130b506255ec72ddf79ddc35acc564d09f16
MD5 be7c153cc13843c9fbde84791698e157
SHA1 e6c4f83d5f862b6a5f959f7c2c1969587cf55eea
SHA512 8eef4f4f50287e7ef7977289ffd2d1b1a24e9b21d6a961286264d11399a40fccdcb43084d8341d9019632f5bccda244de62adc7c8d101b2fc8ce46d44161d708
SSDEEP 384:WGzw6zlwcXoi6V1cpQt7z+GRZ0fEG7xxVc4FcR:WGw6/Xb6V2pQJETKR
TLSH
T1B382E8339190053AE67BC1E57BD19B8DFE72C007E9025B10BCEE52674FF2C464627A98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\Vanguard C4\NORDEN II\manifest.json
Size 711B
SHA256 51361ef9c0d64c79c9f105aa1a400d537d832abb5c057e308639cc0d3aa560aa
MD5 938467b94da28b9a16d43579d6d931fb
SHA1 62d86a630f8f93967aeb1e8717b18a0f00f2b4ed
SHA512 6a0c7d312ea51d9528579852c4128232d49cf7bedbaa6beb81e4fa3b63427c61972cb2fba05116622a3e81c37ba181b03b36c73600c1ad11dc8142e1a9d3d38a
TLSH
T12A01F205C974A95313DAC4B61894064264351E2B9E90BD463FCF909C8FBFE5F013A76E
MD5 SHA1 SHA512 TLSH

Submit Download

server.js

Path C:\Program Files\Vanguard C4\NORDEN II\server.js
Size 2KB
SHA256 6ae74914a4a76b12986f25e01bb252a8611310352b2ed62dcfc2299814d44c38
MD5 4bd3664bdb85fedb25e9a49147dde641
SHA1 a724b7e56440ace3d7373f1606acda886b8bfa01
SHA512 5628281744351d1c4dd1dba9833d896bb210c13bc0fbc034694448840d923b6aa2359c59ebfb2414424faaefb797d387967d2001423c8e178d9a01752df32e45
TLSH
T19051229A9DB322174BB3C26E475E5C0A770F901362A9E954F38C46286FC825C86F07FC
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 ed47d2e340f399254bd6abec4dcc5bead8974913038006257daba6f729840f1f
MD5 8858759ef2abefb93fc507204eaf9087
SHA1 f178625c96ef51cd38e04ad4efc0c59b1be7ce52
SHA512 fa58faea3d840e030de9b9bb20becc79e22d27152e6f9bce666a335ab048507f4b6770e70e7178d13c4a8d059aaffb3ce850cdbd4f3ec7d2244bd136bf8b01d3
TLSH
T130E020E429C7C21D77196447529C430CCAC0370BD7C5EB2A2714C8C97405040E291DB0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 580a834b191a478d957dfc1f649d5c888908fc81ab6d47501f216eccc82ca190
MD5 e545496aef63a3b3a4b79e966b667183
SHA1 661d4faf823c4b111e755097cd59f1b079d34ddb
SHA512 27fcb201649e1c261fa661779a3e470d763a307208ae1869bb88451c0efd6bcdcbe84b122384ceaa125c36f77617f97094130b7ed157ac0632ed05239e49bf22
TLSH
T10261C45623A34DD1DF7744BD52E96898FAF5A895093B2EC06054BEBC48C6F4BC0C32A3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a1975.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a1975.TMP
Size 3KB
SHA256 5d3c835fa56dce10ba8c39be4b6cdb2b82211f42f90204f41ada2d8d2bc4436b
MD5 95dc2f157059016c412477d36cb30d5f
SHA1 d3ba90fb4a516e6e6ab4e3408c11190443b9f6ca
SHA512 21e3b7b907340b3970373fae19a83743aad566394bc4caf27b4fa89a27ceb5a0a1459c63d342c305cc8baf10b5ef209f84bc8241da0d5145e66e36ea5fdb7932
TLSH
T1AE61C55623634DD1DF7744BD52E96898FAF4A495093B2EC06054BEBC48C6F1BC0C32A3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 972812dda8aeb3cf1756ba0fa8fe80567237eb954ccb01c2e247086bc1962877
MD5 1dc172380dde6d34894718b71367b450
SHA1 65970ac327a4a9b85cd1a58571720a9036696ee2
SHA512 c69bcc839af0fd604da59c3a248089ca0af969e16c3a4380f41501ae7a287284db6636e464b11afa8cb936aecf2ba381f788713c43ddc1b988ff4292eeb72851
TLSH
T11341ADF3C2E8866EC94156F0EA147E2BCE2D0954832C3D9AC8E4EF5B93E2471D18165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 5d9462071a278201386a5c1c671d7d6127e22a03ecc59d9eab5c3d96696ed167
MD5 0c7a66a61b1be042e2361bdeeaec7330
SHA1 f85cf3dab12e045942d47da808047720f983d6af
SHA512 fa0e85d2e20bdc56ea8bc23b85d881ffcd513e1465a8546c6ecbcb78bbf8d71b64ae1edf3eb5b1bb9b99b72a3dedb867e8bd5cfaac7a7e6530d1cdeccbb17e6c
SSDEEP 192:sxRhprCS/frsVf78ZL6zzoA8pFCv/g6+WNl1q9YnDBhM+GmIgDC+Y4fJ:sxR3eS/frsVf7CL6ie/5q96bMgN
TLSH
T10242C8566D28A87B9CCBD21DBB557F13E6F91022A0D01E48EBFD9A1C05E77DE220340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 9e7afb1dda169d08544a8fd3f0ee7e7d52cba61a4c861bcab8307db41224d5f5
MD5 e5eb5b04b55cbdf65881b6433717b989
SHA1 ae23b9de1135530ec1031cd504f3fd6fc877e873
SHA512 10bbbd37e4335eed0d78aa6b052c3f9cfdf3f68463ce199edc1ef7559ec86ca98713bf22cb1845814a54f25098fd39f36608819921897cf92bba1e899561d029
SSDEEP 192:sxRh+rCS/frse3prQ5AzoA8pFCv/g6+WNlqB/Yn43hM+GmIgVNJ:sxRMeS/frse3Ge/56/NRMgB
TLSH
T1AF42C7166D68A87B8CCBD21DBB55BF53E6F91032A1D05E08A6FC9A1C04E77DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8ae27df256ca7b51172fd30bf12c0fc89cbb80cf6a5b2633e2da8033b8085a8e
MD5 f4055815826a9711e99d6bb05f47c169
SHA1 4c84e92f5fb0a1d521d606e6d9a7dc37216b0c64
SHA512 380d57ecc4e7c05979ec00c00fd7ca502e536a409b729cb660d3d6a3c75030e4e70f4011c13a92be4d4266a88914bf2896731257aaef912f680142f72b0d7b99
SSDEEP 192:sxRhprCS/frsVf3prQ5AzoA8pFCv/g6+WNloYVYnq3hM+GmIgDCMJJ:sxR3eS/frsVf3Ge/5JVzRMgF
TLSH
T18442C7166D68A87B8CCBD21DBB55BF53E6F91032A0D05E58E6FC9A1C04E77DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 78df64382aee5c39b2acce09637b2aa9e5c3d29fe85ea0444bddac5bd7069c25
MD5 2a748e635fb76f01733d59a81c569a4c
SHA1 8d29e3866756234d65d7d5e1eab895ba92cd84af
SHA512 f720ea22397b62739afdf4e6383b8b6d2133a8f560b46654cbb2e8c861ce7f5f9c78c4913b82d0b1c9eed936548b78e13a961f1ed1972a75853d387444af515a
SSDEEP 768:wb8dpg7pLuL7r6Wgouf6M8F1+UoAYDCx9Tuqh0VfUC9xbog/OVbu46Lroh595C:wb8dpsE7r6Wgouf6Mu1jaUV64t0
TLSH
T110C2D97B740DCB7E4F800ADDE819BE9F6DA802CB5AD8CD4047FE951C02C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 53760884ff0cf6d350fd27e665f746883c82f63e09e2f033bd650272ad2c27ca
MD5 0a843ae7c9fee94e69e1496997316671
SHA1 1cea8b5fec34983a8ccb3884603f2b2b8d94fd6c
SHA512 95ab13e3d80f5fa8144b0e20bba166c028acadf3cfea7c9f871b3dcd7d5a49f02939df82a3ad100075623ce0ac1e451fe64be069f2adea31aef564df0ad42b87
SSDEEP 96:KRklQUuSW0Wyf/gc0K4xgW0cUUfO0pH7kh1DZpVW9yogdVK4kgzVcbDVYgKlyyzC:CklQUuSWLyfocIxgWbUUfO0pH7kh1DZK
TLSH
T134914F11317B4294387FF90D95E9982E428278733029E62F7BE981A50F67E168DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5abd08.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5abd08.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b972fa50208e7cf401524018c7d05750cd54594d6cdec8aed604504b31f3022a
MD5 9067ed3755e9ee97fdcccaa2a9859e3d
SHA1 a8d6718150c2cee011f07cc0b3844297ebcbcba0
SHA512 891788750f6d9c4cd1b7af13fdcce0ff0dc1f765326dc5f4e436b0bd457f19f89ffe09a01488ccf8e7eb7fc0e45ea123d6da8c0e56b78922ee27447fdfbdaa04
SSDEEP 768:kFQ33PwgTBG7RCZQ5O0ZQRIWs4BNzc4ReyIsPU2ewBKZOW3:H33vooIWs4Btc44bs82evZ5
TLSH
T158038D36EC28DDA7BDEAA782FA057646AEE05167C1D86DD4DADE5E0C00432DD074BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 c9b8e103143e0b1aac4721e3d9fe5843033c4258b98e4a5772e41eb27869f717
MD5 9cdf0d3ba859873e868f022a35b41b5f
SHA1 6e0a2f893f03387fb85ccea6c78be07963c98860
SHA512 524bf5a0a8a9ffa5987e39636f0fbe9c97d3d497bbf053361159322a727538ad420e6dcac0b77bfec02caf7f7617121ce5652d30dfcbce6769b01c265af5e98a
SSDEEP 768:Arv+4UNbdr3qOGI+vLDZIO0ZQRIWs44Nzc4ReyIsPUeVH1S5F:AbsbR3qOl+BIWs44tc44bs8EH1W
TLSH
T1A713BE32A839DDB3ACFAA642F5473A937EF4612B81840E94C4DA5F0C4A472DD175F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 ee0fb3046073a4c710d93d43b85414dc114e118aa626ef435fea82d49d7056e0
MD5 1b93c1fbfed58f0dbde3f2b8673192d6
SHA1 624e27e4d162394a609f05cb84f7f3723c9296fb
SHA512 59963081628247b9c05b47faac32bed7440339ce048cc394990dee4be47dd33eb42b66f792d6e5b02cf919568ade665043463dd6992c276c44ff2fea02f8ea15
SSDEEP 768:1E3DBG7RLDZIO0ZQRIWs4hNzc4ReyIsPU2ewBKZOW3:1E3VoPIWs4htc44bs82evZ5
TLSH
T199F2BF71AC299CA3ADEDA246F6063683BEF46167C1D41E54D6EEAF0C05033DD1B5B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 0ea811844f0c2ba8634b57b8ff0f0f23b21f958a830a33ccb86b722d388a0db1
MD5 cf8b4cc9f991464b9ff747e3fd8a0842
SHA1 637dba65eaa2d0f54e354e449cff3e90b51deaf4
SHA512 1a654134db9eb4dfefac3bf47f151f2910bab66f03b955e3486c22d9add24ee5e0863e663dc136703397e8752edf681b605dea3646ebfc73240c69181695ef64
SSDEEP 768:Orv+4UNbds3qOGI+vLDZIO0ZQRIWs4TNzc4ReyIsPUeVH1S5F:ObsbS3qOl+BIWs4Ttc44bs8EH1W
TLSH
T12F13BE32A8399DB3ACEAA646F14736937FF8612B81840E94C4DA5F0C4A472DD175F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a98b0dde3f465de9f50de2dc177f552210571ea29d956dceb40950bff0506910
MD5 ad5aa133f1a509435319bf1eb176dcfd
SHA1 498de670d82d85a1c2327fa600ccffc1aa744f95
SHA512 c57832ec0aea6dafc52e375f9a5b79fc5ba7a60650b99c9c89889938db6a5f728477db17ea4e54a5b8c9b863a165090d97da39eb1e574c766a87ea006ab86ca6
SSDEEP 768:6rv+4UNbds3fODZIO0ZQRONzc4ReyIsXTeVH1S5D:6bsbS3uOtc44bsDEH1Y
TLSH
T19503DF32A8788A77ECF6A686B14776537EF8512BC2D81E94C4DE1F0C464B5DD130B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 cf5e5467ab3de71fcb419acbbb754c3effd5e787864ffa7c767f24ff9bbe5ae3
MD5 87299a8105078d6252386ba9d333ff05
SHA1 c43e027b4174d2ae2c7f138de07b18ac0407148a
SHA512 f6678cce079ae97838bf5aebf3c195a2c82d27dd6546fd7e5428396130ca4bd2c809f2d2edca4f130da479624c3418beffe998ae1a032451706b9a47bad62885
TLSH
T1670110D14C3E1AC3C6B90EAFE04717EC40C89512B0D8387818CDF8A4917A41E345182E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 51fa2add3b372e4d932d6926ca9be223a98d6ad3b63fcf099338f199d0a4ad28
MD5 0bc15719fed893a50e7e1a0840cebcc2
SHA1 b6b38e62996bd5e878b8bdb423c8908c2c7952d9
SHA512 e8025d1cc226ac64ba4fa534aa9a692475cc6f90a825329d6a12e01c23821f5e08fbdc188e3ec58612b5fc7bedb6f5a7f294d0f22467098763b8949281bee090
TLSH
T1D9011ED158391AC6CA7E0EAFA0472BEC44C8952AB2D834B908CDE8A4957985E304183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 918167fab0fb4435546513252415c1a2e44b6e8e60caf6f31d07587ba0a71ab0
MD5 5ca920f0e1c81dfb329b916e242a4065
SHA1 1d068ad79883fd23c27647c98e761858e46f48cd
SHA512 2b99239123f922883dea3137835bb8b74713799981e5aa1434ea70db85e7666f2372db684f94bb599ecff70c8c31d02286b0587ffe620333eb1d4bbc7feb84b8
TLSH
T11DF002D04C3E19C3D5B90E6EA40717EC50D45517B0D8383804CDE894D07A05E315183E
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9f537f96-8a8e-42f1-9ec5-df8ae73a3c85.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9f537f96-8a8e-42f1-9ec5-df8ae73a3c85.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

b58c8221-ea33-4dda-9fd8-6f6a38607155.tmp

Path C:\Users\Admin\AppData\Local\Temp\b58c8221-ea33-4dda-9fd8-6f6a38607155.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz740E.tmp\System.dll
Size 12KB
SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
MD5 6d08f0d5503bb100b8429fefaad163a6
SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
TLSH
T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz740E.tmp\nsDialogs.dll
Size 9KB
SHA256 715a9b58de0995d1a08384c522ad9af210e2791aaf8e87a6c07bfe72ebfd2cb5
MD5 cf0351a2ab9128838be6b54cea8238d3
SHA1 c3b1abb890d92a6058de7c3ac2b2185b2f4fd03c
SHA512 f1a68557d3825ca879f66c1b6828342528e41b8c746d137c51b85e8f8341dcf69bffc5bab76a498113cb53de3f4502644de8a26adaa27c22fa005ee7186f7785
SSDEEP 96:oXEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3Y8NqkzfFc:oXEvCu5e81785qHFcU0PuAw0uyWIFc
TLSH
T16012F892E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5004_876280531\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NORDEN II.lnk

Path C:\Users\Public\Desktop\NORDEN II.lnk
Size 1KB
SHA256 5221dab77b723535f09e278effc7df7e4e1aaa724f2b77bae80f2270cd58584b
MD5 58576c81ad5cb0f7782e0e137f81d47f
SHA1 63fd68ff3563806b26d696cb5c3a9766534f5df9
SHA512 a794906e60a4809563d29adc5b74716e64227f70af389d2e5667007e66b7defdb125c16dcc082e47ccbece6601a797f33a6cfebd4c42e8fcefa6fe9355302643
TLSH
T15041A01437D90719F7F34A314176A629C776FD829D334F1E458892834924690EF25F3A
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5004_740160676\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download