hxxps://nordencoae[.]hyooon-ksa[.]com/?d=uTWhVjniYM-w5D5SSIGS5gNR0KKzKJGtmQYKUjZnO6VKYY-CnQ5WHKkkY5E-sTytbMHiBcTWfgSMdEu2zkpXkW7x12k2miPxYfyKjiCqPq0Bw5nPITRKXIGnXLjRE93q-1tp4yEqx7kEUI9OGaM8R2942c5Tqdo5

Analysis

user interaction
yes
max time kernel
121s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 07:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://nordencoae.hyooon-ksa.com/?d=uTWhVjniYM-w5D5SSIGS5gNR0KKzKJGtmQYKUjZnO6VKYY-CnQ5WHKkkY5E-sTytbMHiBcTWfgSMdEu2zkpXkW7x12k2miPxYfyKjiCqPq0Bw5nPITRKXIGnXLjRE93q-1tp4yEqx7kEUI9OGaM8R2942c5Tqdo5
Sample260930-jelnjsvy2l

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4632	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{A73466FE-ECCF-4BD7-A38A-26F4917F6686}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3852	msedge.exe
3852	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 4876	4580	msedge.exe	85
PID 4580 wrote to memory of 3812	4580	msedge.exe	86
PID 4580 wrote to memory of 4632	4580	msedge.exe	87
PID 4580 wrote to memory of 3812	4580	msedge.exe	86
PID 4580 wrote to memory of 3812	4580	msedge.exe	86
PID 4580 wrote to memory of 4752	4580	msedge.exe	88
PID 4580 wrote to memory of 4752	4580	msedge.exe	88
PID 4580 wrote to memory of 1476	4580	msedge.exe	90
PID 4580 wrote to memory of 1476	4580	msedge.exe	90
PID 4580 wrote to memory of 2112	4580	msedge.exe	91
PID 4580 wrote to memory of 1476	4580	msedge.exe	90
PID 4580 wrote to memory of 2112	4580	msedge.exe	91
PID 4580 wrote to memory of 2112	4580	msedge.exe	91
PID 4580 wrote to memory of 4192	4580	msedge.exe	92
PID 4580 wrote to memory of 4192	4580	msedge.exe	92
PID 4580 wrote to memory of 4192	4580	msedge.exe	92
PID 4580 wrote to memory of 2304	4580	msedge.exe	93
PID 4580 wrote to memory of 2304	4580	msedge.exe	93
PID 4580 wrote to memory of 2304	4580	msedge.exe	93
PID 4580 wrote to memory of 1248	4580	msedge.exe	96
PID 4580 wrote to memory of 1248	4580	msedge.exe	96
PID 4580 wrote to memory of 1248	4580	msedge.exe	96
PID 4580 wrote to memory of 1656	4580	msedge.exe	98
PID 4580 wrote to memory of 1656	4580	msedge.exe	98
PID 4580 wrote to memory of 1656	4580	msedge.exe	98
PID 4580 wrote to memory of 1152	4580	msedge.exe	99
PID 4580 wrote to memory of 1152	4580	msedge.exe	99
PID 4580 wrote to memory of 1152	4580	msedge.exe	99
PID 4580 wrote to memory of 4784	4580	msedge.exe	100
PID 4580 wrote to memory of 4784	4580	msedge.exe	100
PID 4580 wrote to memory of 3412	4580	msedge.exe	101
PID 4580 wrote to memory of 3412	4580	msedge.exe	101
PID 4580 wrote to memory of 4156	4580	msedge.exe	105
PID 4580 wrote to memory of 5220	4580	msedge.exe	116
PID 4580 wrote to memory of 5220	4580	msedge.exe	116
PID 4580 wrote to memory of 5220	4580	msedge.exe	116
PID 4580 wrote to memory of 5508	4580	msedge.exe	118
PID 4580 wrote to memory of 5516	4580	msedge.exe	119
PID 4580 wrote to memory of 5524	4580	msedge.exe	120
PID 4580 wrote to memory of 3904	4580	msedge.exe	129
PID 4580 wrote to memory of 3904	4580	msedge.exe	129
PID 4580 wrote to memory of 3904	4580	msedge.exe	129
PID 4580 wrote to memory of 3220	4580	msedge.exe	130
PID 4580 wrote to memory of 3220	4580	msedge.exe	130
PID 4580 wrote to memory of 3220	4580	msedge.exe	130
PID 4580 wrote to memory of 5576	4580	msedge.exe	131
PID 4580 wrote to memory of 5576	4580	msedge.exe	131
PID 4580 wrote to memory of 5236	4580	msedge.exe	136
PID 4580 wrote to memory of 5236	4580	msedge.exe	136
PID 4580 wrote to memory of 5236	4580	msedge.exe	136
PID 4580 wrote to memory of 3852	4580	msedge.exe	137

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://nordencoae.hyooon-ksa.com/?d=uTWhVjniYM-w5D5SSIGS5gNR0KKzKJGtmQYKUjZnO6VKYY-CnQ5WHKkkY5E-sTytbMHiBcTWfgSMdEu2zkpXkW7x12k2miPxYfyKjiCqPq0Bw5nPITRKXIGnXLjRE93q-1tp4yEqx7kEUI9OGaM8R2942c5Tqdo5
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7fffd6a4c188,0x7fffd6a4c194,0x7fffd6a4c1a0
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,10539879884753079713,14159166981631081493,262144 --field-trial-handle=2292,i,15945869799332495164,12474421637686076189,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,16063729951074748565,7352347291510615132,524288 --field-trial-handle=2292,i,15945869799332495164,12474421637686076189,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2644,i,17705715940313336022,984923798318120862,524288 --field-trial-handle=2292,i,15945869799332495164,12474421637686076189,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,17856302029321707234,5057362373514015804,2097152 --field-trial-handle=2292,i,15945869799332495164,12474421637686076189,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,16016937014829720166,12792536097415218419,2097152 --field-trial-handle=2292,i,15945869799332495164,12474421637686076189,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,14803446382901636183,10794385117614350011,2097152 --field-trial-handle=2292,i,15945869799332495164,12474421637686076189,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,6502074064181034259,9724027405045306496,2097152 --field-trial-handle=2292,i,15945869799332495164,12474421637686076189,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3636,i,2908174838888719179,14312728189607968763,2097152 --field-trial-handle=2292,i,15945869799332495164,12474421637686076189,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5324,i,9556081929671164775,8333689277293763228,2097152 --field-trial-handle=2292,i,15945869799332495164,12474421637686076189,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5064,i,6799074426821727095,11579113967830724853,2097152 --field-trial-handle=2292,i,15945869799332495164,12474421637686076189,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,4391885996089514509,11397181379346047851,524288 --field-trial-handle=2292,i,15945869799332495164,12474421637686076189,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,16474101289919373071,10332423093501540995,524288 --field-trial-handle=2292,i,15945869799332495164,12474421637686076189,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6896,i,2950242993019135576,10907252735952288893,524288 --field-trial-handle=2292,i,15945869799332495164,12474421637686076189,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6896,i,2950242993019135576,10907252735952288893,524288 --field-trial-handle=2292,i,15945869799332495164,12474421637686076189,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4352,i,2476996599487028817,8140029664090908529,2097152 --field-trial-handle=2292,i,15945869799332495164,12474421637686076189,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,15945243948727798511,11543556824449627249,524288 --field-trial-handle=2292,i,15945869799332495164,12474421637686076189,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6784,i,1514905836905117770,11269130195157746489,524288 --field-trial-handle=2292,i,15945869799332495164,12474421637686076189,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,2749396240938295808,10450267084962219134,524288 --field-trial-handle=2292,i,15945869799332495164,12474421637686076189,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  PID:5524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5248,i,11116904570916169341,10916662469251916987,2097152 --field-trial-handle=2292,i,15945869799332495164,12474421637686076189,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6596,i,5434091741323520525,16485803000301481232,2097152 --field-trial-handle=2292,i,15945869799332495164,12474421637686076189,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:1
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3776,i,6412584288791610384,9516064349665605903,524288 --field-trial-handle=2292,i,15945869799332495164,12474421637686076189,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:8
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=772,i,13500843140248483338,14669232063775862557,2097152 --field-trial-handle=2292,i,15945869799332495164,12474421637686076189,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:5236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5128,i,17602319493860803118,5531241309491404361,262144 --field-trial-handle=2292,i,15945869799332495164,12474421637686076189,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3852

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 61a97be736e0441d45644d31b38bd9bef6c1bd260fa1ecbb5d099fa493fee6b4
MD5 99bbd8400adc948f85ebd87cb24b3fcb
SHA1 c8fb9564ede7ecb06cef446bdb527025127a796e
SHA512 75b3ee70eca487cbbfb3d5b4b25bae158ff99188ab36d55f391e9f80c51ce9fa433897d79a0ae37ad64698bc3eb5aa9a10a49116fb8f7f35ed0a6e98aa8321b7
TLSH
T109D022C8F2A0300CE00C3233A02BCE022B88CEA8F0032BCA000E8C80E8800C80CF2C8E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3e61e4b73622d80117d6808dbbc6d44e17cae3310327a1e48da720ea83f5a936
MD5 0b3f8a9587626d65e75368965ca39796
SHA1 e5ce74827a619b3cdd03cb7a873d000f4b17b8e5
SHA512 26de83207b26900212e06254d428ca05b65987acbfacbe5978afa5fe14d49fbd336eda0bd9fa3567a62b779844c62a5a56ac5bf868799602771e2a542da0a426
TLSH
T1E7714A8067B08472DB98A270D0F1D0AB3AF569F159CBEE5235E0FEEA5B03F5490E5022
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a79244afe5b86309eb5534fb1a98ba6c90f864b76590b073439dec6fd513e666
MD5 dd250a0d9b644d351e4544609127882c
SHA1 0ee60940094f3c102bbe5ffd384f92e66ef3a07f
SHA512 d574d291652c8dcd6a8969828178a069a5f615f5de0066badf705827fd1814014aff88ea86ba8cea13a18d970847ac742fdc3bb4f2a5955ad1604eb093228469
TLSH
T1C3713B8057B08472DB98A6B0D1F1D09B3AF459F159CBEE9235E4FEFA4713F5490E4062
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 bdb1daaf888e7d1f3dbd740a426d3ad9d56938da7e7ffc30b9659cb3b62db4b1
MD5 77d9a3f67a7cd4b6a60f60ca0c8bb4f1
SHA1 b831834add901961d0b224a93825af1e3f066343
SHA512 1d8a64bf69dd07fde3e589591a6b2bac5ee6cc523d1e95b158665df3cd8114e5688708fc42b0dbd5b243b9ee6007e4df924da40dd42329b76a47e707a298d2bc
TLSH
T14B718C8017B08472DB989670D1F1D09B3AF569F169CBEE5234E0FEFA2B03F5491E4022
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d695.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d695.TMP
Size 3KB
SHA256 6359cdbfbfc495dc82c7334b27413fd28632a2737b5a517256e9b221c9303b76
MD5 bfdba17f161d603567e5e8ca4a9b214d
SHA1 5c6d00c9a308f83fccc7e8ecd0d4902541a1edfc
SHA512 bda27f6955476419fae3a3ee28a5ee9e569f1350cb58a3582bd26a3ec32d366e69241d9ed4a9a8e879d5839ffeb4507356558b063b89abc59925d74251da0e50
TLSH
T18A613B8057B08472DB98A670D1F1D09B3AF45AF149CBEE5235E0FEFA4B13F5490E4062
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 85aa28f9c33165ceed03412c95615b69c4060ef2fcce0aa9fcd7b0c6dfd21098
MD5 5fb9f531ec794eae3d48927a2cd33a4b
SHA1 68cb1bd859748cf6629f88023ff2c7bc1238e40e
SHA512 91bab56fb0ca5162cd7225243d8ea398e8f1ba92e713f7314c205390ade5636a993710eb17d0c9eb84ef8467c75424c796ad4cd7546d4cbfd522a43d398d0614
TLSH
T184817BB2C7E4C75DD91166F0AB14AE2BCE2D0519536C3C5E89D9EE4BD3E2072E10268F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 bbfafb242dc8c9cdf073730811a3c9eabe46ef9ae3be065d23c0d25edcd91482
MD5 c9d921723afbadfbbc5697ab488de017
SHA1 6125d98f3b4a66f55d40f03e32ff96d1d0f8323b
SHA512 da9b4a1252a4a3c9f86e35be110d0395c5976ae7a122c6fc7285261b8eabf7facb27ef8a46108ea7e2a8378394ab305707a7eb0d2e1d637ea8f82babed13e5fb
SSDEEP 192:sxZoXR2ks/f4KXs75rVIdpJBgb1HW6+WNc54GgRmdPE/YalqoIg5aJ:sxZoXTs/f4Ms75rmqHbIf6/nc
TLSH
T12332C956AA7869BB8CCBD219BA55BF13E3F5603251D05E88ABFC851C04E77DD2203C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 ac7170274ba099e6cfc79522709b8e7de0c254f764d9411c4b90213b55ee9778
MD5 bb3561287d9bddf40380544650aebded
SHA1 212c795e75455d301b15338f3bb1175e634a2ab9
SHA512 b6c20d7c67d0d3d32f993e42c4eec5cd8b4f244d8dafcf06ed9fb503d68ba47771dde4bbc97a5b4d02606cd9b007176f490850574f050d3d1b812f789f647cc8
SSDEEP 192:sxZoXR2ks/f4KXs755VIdpJBgb6HW6+WNc5gecbRmdPE/Ya9qoIg5aJ:sxZoXTs/f4Ms755mBHboZ6/vc
TLSH
T19632B856BA6869BB8CCBD219BA54BF53E3F5603251D05E88AAFC851C04E77DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 3ca492c71bf9ec08ab048fdaf775685bba439d3caf7c77f957a91bafa3fdb87d
MD5 20bb89e47523ed13f8da87c1c0b17be6
SHA1 85c519fd6236dbd0a7ecbfdb16fb26ab55318778
SHA512 b654a7e4890609b2ebcd3175664b17e4bdcc965f5c6561c96d601d07c5f775803b9c0d6bad2141bf823b69d6e9a334e34bfe5452913de85bcb29ea61c01c0755
SSDEEP 192:sxZoXR2Ws/f4KXs7grVIdpsjrHW6+WNcxRmXYaPqoIg54J:sxZoXvs/f4Ms7grmGHbdXlu
TLSH
T1D122D8566E78A9BB8CCBD21DFA55BF53E2F9103151D01E88AAFC951C04E77DE120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 ce52cf6f8135be99542352fe8a63521892f343f05d2bf8d01f741a3288d862d9
MD5 9d69b8d4e7f9bf32ca6c5309d946a458
SHA1 35b84ef65a4a3882f4a25ccb4a5563094cfc57ea
SHA512 5ff9a44741c6c4b1a49189518cca8c2a464759f3b63adcc2a4a78d092acec2eef05910207d68a5dbb1c28ab3da721a6db90b667a871c71aad6e0cdf59698f583
SSDEEP 192:sxZoXR2Ws/f4KXs75rVIdpsgrHW6+WNcxRmXYaNqoIg5aJ:sxZoXvs/f4Ms75rmPHbdXvc
TLSH
T1A122C9567E78A9BB8CCBD21DBA55BF53E3F5503251901E88AAFC961C04E77CE120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 bd3adc8db5760b900ee19e95d559eda81ad623d40b76efbc561300214ca89de2
MD5 d14de2de8c3806d09e2459d2135a9aa6
SHA1 812dffc17c51a602191cee33edfad8e604c886f6
SHA512 886b22b0617bbf7985bdd6592bceabc1dd3bc72be2bdca8ab04d3ef3d9b18b84256960611efdf82796b427ee64c6ed0df59532c2194cbf64d8ab0de55ce487a3
SSDEEP 192:sxZoXR2ks/f4KXs75rVIdpzBgb1HW6+WNcxRmdPE/YaHqoIg5aJ:sxZoXTs/f4Ms75rmMHbd6/dc
TLSH
T1E732B9567E6869BB8CCBD219BA54BF53E3F5603251D05E88AAFC861C04D77DD1207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 073c3ce681e7afd78f02b0215e80afd4715d33df6562893a7380d4f8fbfd154c
MD5 b1c18f7b2a67741b31f06dcaf24fa0ec
SHA1 296f25c9684acd917bdba478e9195e9da2dc2b3f
SHA512 9030ef2cf2deb809b3f1111c8f401326a5f5fdec7d396e9ad82efc310b1c14dfbe1e44974a2978f62dda21bab1e761ec907ef2470ba4b9da80f69e60fb80eba8
SSDEEP 192:sxZoXR2Ws/f4KXsxeVIdpMrHW6+WNn09/YacqoIgrJ:sxZoXvs/f4Msxem6Hbs/K9
TLSH
T1DC22C9567E68A57B8CCBD20DBA15BF53E6F9103251911E88EAFC961C04E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 a92d11d13fd771e6b5f30d898e7be01e647cac0c3b87bf940d505af04f009682
MD5 7f52852556b9d8853c7d33896b6259cd
SHA1 b36e17dad3e3423a6304300ad7f39520f97a048a
SHA512 a85564d5aa0ca7d528238fd0da50c50f96c43dd2f01b9e591d051d59fe12c5c97efe3afa8f9b8809ff02b4c9cd97fb44d5609fc564bdc5ab0cfa689f564dca0d
SSDEEP 768:G7yQRbrWvvlRZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH3FrohfZajt:G7yQRbrWvvlRZu1jaXKLf33+hfZaB
TLSH
T1D0C2E92B640CCB7E4FC01E9DDC6A6F976EA802C766588D4447FA984C02C77EE512B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4bb4469937d632a68d8f97f2214e2ac3d06f93dcdfbed34b41d27e5a96bcdbdb
MD5 36677c7f6ca0134f242d1c719aa3c04c
SHA1 986a7aeff5f8c9e8e51fca490b1ba94ccb092721
SHA512 be88f1fcd35f7fde97823a851336e57044c3a2974b53aef989e3127c78b9e1d9b48c33cf98d8be823b87152fe641693ad38cf48ef308230e6340ab67ac4811fe
SSDEEP 48:K0u5uIuVupuzu3uLukbu3uSuPISuBukK9uB1urukxuJu0YuyuzuJu5yLmBcBLPTl:KgBSKaEKlqoKzKdSEKz6aCW
TLSH
T19E91511272BA124138BD395CC1A9976F428133733105E92B7FBC15A24E2BE059EFDDC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a3a8db80-d122-4e68-b89d-8e2e5283d08e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a3a8db80-d122-4e68-b89d-8e2e5283d08e.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 990738a105a89ba7915cbd23e90ec450713a05d952a6399363a1f5f36352902e
MD5 fe34e114904393132d60c9a47ab682a7
SHA1 29bedd3d4d53680fe76cc01aebd01ca1ac010dc7
SHA512 c245a55759a427ccd4bc449ce4c24b08c5a85a2290ae9557c7e0f8959339d0aa18337d6a714731ef9cd102826c87f679b0a75ad8ebd2cd59acdce02cd6310e30
SSDEEP 384:LiFiZcI+ssN+8TUNTUlIlhWzOwR+ZYp5u8iqHtH9tgOIwZOyLL9oF:mFQl3wgE+ZSkqZ9XswRi
TLSH
T176C22AF648DB987AE9EE4703B77E2E034EBCC167B1849684B798551CCC961BFC306911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 cb830e97f3deb13f30ee0f0e7789f5596b78c5fb4bd881c71c005c70a05d02b2
MD5 c0bce083d120f197c07f8364e28314e6
SHA1 14364ca05be3c3bbdd4d0f49dced149d0776ee9f
SHA512 3217468a6770f5f441fc401fdcfc7222da32ac65593b89aafa498ab866f05b165bb8f5a24793b859a2b128648316627d84752adc4a78b57b0ee2519273406d54
SSDEEP 384:iZcIhsNuaWzO3tCp5u8iqHtI9tgOIwZOyLL9oF:Qh8gkqK9XswRi
TLSH
T190827D369CBCAC7A6DEB9550F58736035FB48137D3C8ABC495ED671D00EB298130BA12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8b01b23ef1088c622e29fab827461a33d6a2e1f2b1029dcc0652909145959c5c
MD5 10e705cd98781202ae91246e741939ec
SHA1 5f2717183502db7aeb2563b68fc6507995c3498a
SHA512 dd9c25ad3172bda94481ee69b111d161390b463eb8538515d0d2c03c23d8384975289f0a56fbe32bdc97c67ebd1c2750174cbdd301666e6a12866bd4c1027de7
SSDEEP 192:SON86iDCQmiUy15Hq5u88PLuhLSqjroU6:SON86/aHq5u8iqvYU6
TLSH
T1DE02F939AC683C7BAEF3AD05B5477B175FA4013FE6942B84D9E81A1C41E729C2307923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 712811b09b6ebd5bba8d38cf4ae7c96fc1a3653d84d97f2800d241506b30a93e
MD5 398843d9d99440b131afcfdd3143866c
SHA1 16f64bef5c512fe4466afd57e7762a298a985062
SHA512 d4e966dff9be1826bc5ec87c4fa668a6016d30ea582686fae60e65e45d2233764636a58c7fc0005dc70185e65863196328f580d37e0188d8696a2882906464f3
SSDEEP 384:RZcI+sNuhWzOwaYp5u8iqHtI9tgOIwZOyLL9oF:5+dSkqK9XswRi
TLSH
T146828D369CBC6C7A6DEB9515F58736035FB4817BD3C8ABC494ED671D00EB298130BA12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 89cecf65128c25ce45436ee799e540204173fe6dd773fb6a1a534adfe24ca0ef
MD5 182725dca29b3adc6aaf01c19de7b559
SHA1 8e729931b5c7c737ad9082d1260357689d63f0a9
SHA512 0197c53997e69615f7b08e0375aa4d375eb2acfd23bfb1601960a19add28d6aa3078dd5f56a3bc270786c50af6a680e42ed7629ff63803213abc7f79edb1e0ac
SSDEEP 384:RZcIhsNupWzO3tCp5u8iqHtI9tgOIwZOyLL9oF:5hRgkqK9XswRi
TLSH
T1DB828D369CBCAC7A6DEB9551F58736035FB4813BD3C8ABC495ED671D00EB298130BA12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3c89b0c4de582e1c8b1321e18971c9fc20757f7b8f7b220175eba80bbf031689
MD5 fca0a59ffc57e39eba53eb356398cd88
SHA1 3b931db3e0e8677f120d042b537ae905f9227d6e
SHA512 64664b739ed73f1d8bb68f2e62b8a5bdb22cc0820ca37efa46f6792ed1738efed8c6ff43121026c40b2c6183f0fcf8bf9ed15e33eab57c67e92fbd9c0d993643
SSDEEP 192:SONX6iDkQmiUyx5eq5u88PLuh1tetGfuZOqJU6:SONX6loeq5u8iqHt69U6
TLSH
T13E120B36A8AC7C7B6EE3A951B48736135FA5422BD7C86F84D5DC261C41EF29C130B913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 41eda7b7b327288b2679470de258fb605512fd8715be0b5af910bf86774dd685
MD5 9a02c3e39a5d122558059a4aff7bd99a
SHA1 2b136a7615bc682e728670ffac426d1c965d2d56
SHA512 d4e238b821ba150b00ea0401ac6d1618d118fd907b9a22056f26dad87d67c73e1b504a934527807b5218fe396ddeff0a5577cab133552ce2eb104de5a1b5b6e5
TLSH
T1FEE00203120000DDC16A227001571A3059E34130417101446924115C0C233103F106C4
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 7e053174d5994d2c445591d08333ff8697fe8308392de74d7e5f7dcf728129a9
MD5 34a97d6a2239806232373a79a99ba1ef
SHA1 93851322875dabc47519c554e800e30e19519dd8
SHA512 eba49895358adc4d7dc5acb51470e76e505def38f14055bbe35f79a9b3cc9dfdd32b57c33bfe6bf18338c3a1128a39efdd705afc105f483bd918f7e868790592
TLSH
T116E00102920400AAC16E237001971A2069F2413042B201446924116828233103A20A84
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58dbd4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58dbd4.TMP
Size 392B
SHA256 b48f2adc2b3b64aa2a60cc1ea0e66f7c51f307318d8cd7d30ce706ec40cdd521
MD5 f32cf3a590bfd38cab19054153b08f01
SHA1 324972b56eb4fcff915e984bb33d62c0656d4e88
SHA512 16e996b44203f79f58c2bd3ad6b435d4fa9b9ba6d051b76267086a1527016f60adfe887734dc7e39fa6dae23166cf6a30a185450c7cdaa87904a6f2286f750e5
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 aafab783930878bb91383e3630b730cd2d98707295246803d167d10d8190e92e
MD5 ad606ad79bc4f8cb8285aa530bdd48df
SHA1 6e0ae5853f43bd759654fb3c52668f773dc54b93
SHA512 dc4e00427ef5120dc2721c28b291d38c89fbba2ba6b110a658a8bf14bd42a743dc1b92666c5d446e8a9de0fca8a049a9b6cb2814ff9ec16fe527739c77fcd2bb
TLSH
T11A411A5CBAEE1159B3B76F5A9BF6687D447A7C732E4AD15D10010D4F0A62B00C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4156-180-0x000001E8884F0000-0x000001E888639000-memory.dmp

Download