hxxps://nordicflame[.]live/

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/10/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://nordicflame.live/
Sample261026-sdechsxtf1

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4436	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{E88377EA-A323-4574-9628-117D3A5E67F1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2108	msedge.exe
2108	msedge.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
652	Process not Found
652	Process not Found
652	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2460	2848	msedge.exe	87
PID 2848 wrote to memory of 4436	2848	msedge.exe	88
PID 2848 wrote to memory of 4876	2848	msedge.exe	91
PID 2848 wrote to memory of 4876	2848	msedge.exe	91
PID 2848 wrote to memory of 2184	2848	msedge.exe	89
PID 2848 wrote to memory of 2184	2848	msedge.exe	89
PID 2848 wrote to memory of 2184	2848	msedge.exe	89
PID 2848 wrote to memory of 2588	2848	msedge.exe	92
PID 2848 wrote to memory of 2588	2848	msedge.exe	92
PID 2848 wrote to memory of 2588	2848	msedge.exe	92
PID 2848 wrote to memory of 2996	2848	msedge.exe	93
PID 2848 wrote to memory of 2996	2848	msedge.exe	93
PID 2848 wrote to memory of 2996	2848	msedge.exe	93
PID 2848 wrote to memory of 660	2848	msedge.exe	94
PID 2848 wrote to memory of 660	2848	msedge.exe	94
PID 2848 wrote to memory of 660	2848	msedge.exe	94
PID 2848 wrote to memory of 3484	2848	msedge.exe	95
PID 2848 wrote to memory of 3484	2848	msedge.exe	95
PID 2848 wrote to memory of 3484	2848	msedge.exe	95
PID 2848 wrote to memory of 2152	2848	msedge.exe	99
PID 2848 wrote to memory of 1796	2848	msedge.exe	100
PID 2848 wrote to memory of 2152	2848	msedge.exe	99
PID 2848 wrote to memory of 1796	2848	msedge.exe	100
PID 2848 wrote to memory of 1652	2848	msedge.exe	103
PID 2848 wrote to memory of 4416	2848	msedge.exe	106
PID 2848 wrote to memory of 4416	2848	msedge.exe	106
PID 2848 wrote to memory of 4416	2848	msedge.exe	106
PID 2848 wrote to memory of 3332	2848	msedge.exe	107
PID 2848 wrote to memory of 3332	2848	msedge.exe	107
PID 2848 wrote to memory of 3332	2848	msedge.exe	107
PID 2848 wrote to memory of 4672	2848	msedge.exe	117
PID 2848 wrote to memory of 1920	2848	msedge.exe	118
PID 2848 wrote to memory of 4328	2848	msedge.exe	119
PID 2848 wrote to memory of 4248	2848	msedge.exe	121
PID 2848 wrote to memory of 4248	2848	msedge.exe	121
PID 2848 wrote to memory of 2108	2848	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://nordicflame.live/
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x294,0x7fff9750c188,0x7fff9750c194,0x7fff9750c1a0
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,6989779837575849422,17866641512242208391,524288 --field-trial-handle=2184,i,3187100465741600691,2545676052056898795,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,4513947825854838350,17314088955537910141,262144 --field-trial-handle=2184,i,3187100465741600691,2545676052056898795,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2336,i,12558380292999175598,11966315185699790878,524288 --field-trial-handle=2184,i,3187100465741600691,2545676052056898795,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:8
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,6180041720168028270,1665429540779699351,2097152 --field-trial-handle=2184,i,3187100465741600691,2545676052056898795,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,9257826806311233601,480151771444729859,2097152 --field-trial-handle=2184,i,3187100465741600691,2545676052056898795,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4144,i,17033501811911481753,18234023898025220297,2097152 --field-trial-handle=2184,i,3187100465741600691,2545676052056898795,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,10750588913811334290,3983053241276332791,2097152 --field-trial-handle=2184,i,3187100465741600691,2545676052056898795,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:2
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,1660832059362364721,2973340603608428173,524288 --field-trial-handle=2184,i,3187100465741600691,2545676052056898795,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,9746330446436173984,18261172637178432854,524288 --field-trial-handle=2184,i,3187100465741600691,2545676052056898795,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,2476175849845675097,7932402826369753837,524288 --field-trial-handle=2184,i,3187100465741600691,2545676052056898795,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,2476175849845675097,7932402826369753837,524288 --field-trial-handle=2184,i,3187100465741600691,2545676052056898795,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6208,i,16022663977811483609,3943561505346984401,2097152 --field-trial-handle=2184,i,3187100465741600691,2545676052056898795,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6388,i,5691497374669363455,2071813097280448079,2097152 --field-trial-handle=2184,i,3187100465741600691,2545676052056898795,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,3911575681181632902,7333240307387701108,524288 --field-trial-handle=2184,i,3187100465741600691,2545676052056898795,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:8
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,7207705081394881009,7119922653953519363,524288 --field-trial-handle=2184,i,3187100465741600691,2545676052056898795,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:8
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,1029876801738085390,9061884216536700561,524288 --field-trial-handle=2184,i,3187100465741600691,2545676052056898795,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:8
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,13436230307899028095,7566023953054175298,524288 --field-trial-handle=2184,i,3187100465741600691,2545676052056898795,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=764,i,6830517112247924855,15294611734724544593,262144 --field-trial-handle=2184,i,3187100465741600691,2545676052056898795,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2108

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

13d85d2d-6867-4325-a39f-a5cb0f7fa33d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\13d85d2d-6867-4325-a39f-a5cb0f7fa33d.tmp
Size 26KB
SHA256 f97c338506a545d84e7865981ef04a4a6361a94037eddd73d7a1cb72c0bf7d8c
MD5 fa8dbab9b6263fa16c25c61b851de185
SHA1 887ede7f48b3778f787a37e6aeb7b2ab4901b762
SHA512 dea1cf6d061eeb47b622700d1949e318da6e867a4b1a400ff8d5d6f89860a46f42e5f547527a483ed7d395d13a06abfc6ffad5926954466fb33e828ec3798c71
SSDEEP 384:FiFzQkUSv6zsNh8TUNTUlIlPwOZskb3tOjTVHglhBxQI2IrIIlb:MFdSswgRAnOFxQI5rLF
TLSH
T1F9C217F298C7983BD9AE8B03A77D2D038EBCC157F9446A50B388590CCD8A1BFD306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1d43e33e-b8c6-4743-ac2c-95693927e0fc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1d43e33e-b8c6-4743-ac2c-95693927e0fc.tmp
Size 18KB
SHA256 983bdae84ccfbd6eb436d74a86d1efe0c81d24883a12bed32026b624b2a84c7d
MD5 d792e475e5a95c2c51431f78003988a5
SHA1 20bea602d09f53c169dcf35c77398e538cf5b186
SHA512 028106c2542e20f9a19d82314d3965ed5ee2d172633da796c635847707d1e3f3020038afe89766898a7cb99e797406ea347572ee96981f5aabfb4464d5f5c7f4
SSDEEP 384:SQkUSv0sN/PwOZskbKtOjTVHglhBpQI2IrIIlb:K0NAnOFpQI5rLF
TLSH
T19A828E36BC686C778EE7E510F54A31039FB4D15BDA892B90D5ED6B1C02DA2DC2307A1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

433a27c8-de98-4a18-8e11-81f0ed1a8051.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\433a27c8-de98-4a18-8e11-81f0ed1a8051.tmp
Size 8KB
SHA256 f707e8cfa6ec00e8511a38201df95a98b38504964685d7fb1a276118915fbe67
MD5 14dc196621e0ff30d98c9c6f084f7bfe
SHA1 adcc9e93980a037e3b7b6b089a43262e8f68fcbc
SHA512 67a28c14b482fd9da82c65cf7a8705bfa31ca7c24bc8dd9164d7048a9675a99e72cef5fe1a0dc4287d5ac76365d76af3df60eb967118028795c3a37de7c1fc01
SSDEEP 192:vONi6yEQmiUytAvOCTVgcSMosSh2BEwY3UQKqwU6:vONi6jBvOCTVHglhBiQIU6
TLSH
T15D120B36BC686C7B5DD3A541F4C732039FA49167DA497B40D5EC1E1C01DF6AC630792A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

45c503c5-44d0-4a61-8154-73a32e5c2b30.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\45c503c5-44d0-4a61-8154-73a32e5c2b30.tmp
Size 8KB
SHA256 1a016a8d67fc5c22764070d03c6de737b1cbed26b832ae211a643260eacb079b
MD5 b24cc0399cd004ef7f14be5359807123
SHA1 5b82976cab15293271bda0145590292d2cb941f3
SHA512 25908eb3cca50524ccd057ab2b79339a09c60fe46b0b6f85028453d1e974db1c9e16f677ae4557969d7ed2dbad392406909fa96ebe4a3ca8c34e1bfbd3ac23fe
SSDEEP 192:SONk6ygpQmiUyLAtOCTVgcSMosSPzPQuoU6:SONk6lH9tOCTVHglbQ3U6
TLSH
T1D902FA35BC687CBBCEF3AE06F88623179FA8117BDA552B40D5E85A1C01D766C2303936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7b1aa09e-66c3-44c5-8060-1e9400e94efb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7b1aa09e-66c3-44c5-8060-1e9400e94efb.tmp
Size 18KB
SHA256 d3ba83e89d3408bdfe32b4d135622e50235d4cb32b0249ce53a2da3028f1ad71
MD5 5aa9bf8e5133e6ecb916d4658368787f
SHA1 58bc1bb3175b3cb384cd2254c93e69de38128ef9
SHA512 7767f6e16c3cff6f2badfa6926ba57b726b937fc2ff03cfc4d6b5554476bdc8339a78942a3e37025cb0d64311e17c10f40842651977ef488e1661644d9a2d6de
SSDEEP 384:kQkUSv0sN/uwOZskbKtOjTVHglhBpQI2IrIIlb:U04AnOFpQI5rLF
TLSH
T1AE828E36BC686C778EE7E510F44A31039FB4D15BDA892B90D5ED6B1C02DA1DC2307A1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c904cde2439d0f658b6928376273908e18874923ffb5ab0253d91ef97d247274
MD5 71592819d06ab9dfd94505cef3db0b85
SHA1 fa4c610ce7419e5f934db322abc11ec563259b9b
SHA512 f0dccb656458e10495c6728811a1fad970a69f8abb5ce8e9bcba9e93f496cd66fb3ce8ce1065b946203d7912789774c609787e85dd5139479b2562b6f05cfae0
TLSH
T16BD002F8BB950515C5C970F7713BDB8143B6EB218246265D64F21E082D747B23606895
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ad9341a3ad2b263d2be4ffd8a97b10f49a2c167d02a5b66182496dee5e8cf827
MD5 8f79499bd1d234dc030ef99e2f850e0e
SHA1 4dd7c44b8570ce93f3db7df7fe1188f189fa82fa
SHA512 d06aa3eb27c999ba47fce9a170740591ef6bacf188a5d364ad9a567936919e24290b5c0c3a8ad16cae1e37c71c2364d9db3ba42e5914a96b0f1f732c29ff5945
TLSH
T199D022F83BC00800C8C830F3303ACB8003B2EB208202230E20F20E080C303F23202880
MD5 SHA1 SHA512 TLSH

Submit Download

5a05fe3c-070f-4c30-b77d-453269d8684a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5a05fe3c-070f-4c30-b77d-453269d8684a.tmp
Size 10KB
SHA256 f3f39334b970e6b48a6074bffcbe1a95cccc493e5ea5f48eeb9a6f3b1aeb8bd1
MD5 6e0e2cc9681f36368ffe8e66f443d0d6
SHA1 4760dd9247294920e08ae5d532ac90f6305654b3
SHA512 9e8091279a97c71e4ac3a96ef26d527e1c521630cf3c6ba62b323314232a743a5b44291cc4b4f76ab3966158d0a2d5dbd7f8d038bced44cc5a9466dcac6a834d
SSDEEP 192:sxZNuRgW2/f/st1IdptVHW6+WNc5W/YRPg3rsIg5lJ:sxZNuF2/f/stGHHbP/m7h
TLSH
T18922D952AE28697B8CCBD60DBB14BF53E6F9503291D41E48AAFCC61C05E6ACD230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7fdd6be8-dbb0-4d58-b716-1de12b452375.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7fdd6be8-dbb0-4d58-b716-1de12b452375.tmp
Size 9KB
SHA256 9719aac594285a6264fc9c19034f340b5edddb0432c0d17099cb7b0cf07ec7e7
MD5 feaacdd92e3b3dba6ab9caf31a562cc7
SHA1 88a171cdcf66eef99391fa22066dc5b0355fa3bf
SHA512 587ef12797a657ad9ccdf836b2ee31c0532ab9155dc4f64794f7beb27ae49459869a4a3b3c3291df91373005f01048cca136993921b5d71895e15024977bfdfe
SSDEEP 192:sxZNuRgW2/f/s91IdpXVHW6+WNc5W/YRPkIrsIg5XJ:sxZNuF2/f/s9GlHbP/mWf
TLSH
T17D22BA52AE28A97B8CCBD619BB15BF53E6F9503191D41E48A6FCC61C04E66DD230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

82b25578-6c5c-4d13-8126-9e048a1e41ee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\82b25578-6c5c-4d13-8126-9e048a1e41ee.tmp
Size 9KB
SHA256 292d985971e7e93cf0dfd583de02dd33086490d13d1356c151c6d2aa4bf1a67b
MD5 54ac5d19ac37cecfcab1ecac88ba4fa5
SHA1 5d9c66893b2028a014d625b3ce202797e2d911e0
SHA512 5fff790feebd81d1e37bb86a3c2c5d0edf62244221f66eaba9c5369385915594db5accf04f00480862f049260fc23a46bc006bac22d1999af33f29725a647d76
SSDEEP 192:sxZNuRgW2/f/sy1IdpXVHW6+WNc5W/YRPkIrsIgrJ:sxZNuF2/f/syGlHbP/mW9
TLSH
T1F322C952AE28A97B8CCBD609BB25BF53E6F9503291D41E48EAFCC61C04E66DD130740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 2107aaed5854e0d582c82533b12f140c11820158943d01bd3c3db868efc2e601
MD5 bf5090ff277d4bf73460d3e31115e08e
SHA1 6210636c3785af8cd58201468728601d7e32c41e
SHA512 f7abcd525dcd84b10535ba92ef3078f8f2520120a738e283d50025e0fb0f467ae762e9eac5a9bf93bbb98bc073789eeadbedd8f08aeb3fe013b12c02db4e17b8
TLSH
T1DF61C2CAE1E34C91F7A815B067C70CCB3373CC8358672E5E84A8DDF8B88A3962109360
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 88f36a3cc043babf272414489d4337a635a73a18557d22e125768ad7aa0db175
MD5 51a823471a50036e76e841699ae678d7
SHA1 712f6628c9d5de162b2384b059edc2611809552d
SHA512 42a00b98777b5e99c0b1a4bb483ba7a93d0da0bc8039260af1de5f7131964d93c407381231ba87c0e09be380f197a8821b7125a973c74cb8d34c25a900a5b8f0
TLSH
T1E361A2CAE6A34C85F7A806B047D70DCB3333CC8364672E5A9468DDF8B88A3926109310
MD5 SHA1 SHA512 TLSH

Submit Download

d2e0f79c-454d-4cf1-885f-23bccb01098d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\d2e0f79c-454d-4cf1-885f-23bccb01098d.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

2d975eb8-b1ad-45e7-91c9-884066c7bd34.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2d975eb8-b1ad-45e7-91c9-884066c7bd34.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

7699d34b-cd78-4460-ba94-a6c3dc9c8157.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7699d34b-cd78-4460-ba94-a6c3dc9c8157.tmp
Size 2KB
SHA256 692f7dd65c33cc68d86ea21a18e2be01d1bdafcdeb3b9a3babf4877fbff9a8ba
MD5 2e4cd09e9a67ce45390e058e1750e019
SHA1 ac2dfa405682925e0ecf462950f342f77b265784
SHA512 451ff9adf1b3232cf12072c3f7b1b25e10b3de25d7df2a03ac28cdc3787cefc6b3c9dd3333b12f07d9332bce3532be8c51c5f87ffb0cb61f8e757181e8bb2dcb
TLSH
T11D517FF7D6E5CA6EC911A2F06A14AE2ADE2D0918436C3C1E89E5DF1B93E30B1D10165E
MD5 SHA1 SHA512 TLSH

Submit Download

e1b9f173-355e-492c-8102-14370cede245.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e1b9f173-355e-492c-8102-14370cede245.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 0ba8964110c6cdcdf67b8716096431983344a059292dae1325bd8eafb1080212
MD5 b0bb792e9675f0fe3881efa06a6223ed
SHA1 c161ab6f5ed93e01127cff0084b2a6ffa2ef705c
SHA512 e60a178d894ca60fbfff20dd4351d2d394d0bd7e360c7aa9ed7a5e20d9bd992b7a8b6934263986f6a10c24c84ea9fc6a37b5695d7ac7cfbf9b0085317c1670b9
SSDEEP 768:v7K9uzYWvcQus8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpHLlh7k3oroNl+vX:v7K9uzYWvcQusu1ja0HL7Q3TNl+vX
TLSH
T1E1C20A3F640DCB7E4FC01A9DDC5A6F9B3E9802D796688D4047FA984C02C77EA52264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 831a620cc835dc6db6f1a69848972993c3609b11f74b4d621a10acfe65385d25
MD5 8781993fa424797f9beae48338dcc8fa
SHA1 69833e3f7c54bb0b21710edb4afaf85d91f3df66
SHA512 50f1bf4c1137f5dd0f3222f4afcac57e592b3787ac8874d7baf27a10310cfc0e2902b06cf9aebb3adabce62bb8605193daf2ca2a77c85b970e808805c6890553
SSDEEP 96:K0mJGQKjiO6cAKtSeFApUgO22+gG3l+A+KWt:NbfjFApUgO22TG3wAAt
TLSH
T1EB913646317F4241397E265892A9861F425131F630ADE97F7BBC41B1AE2EF040CFE9CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\Paths\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a698a874-c8c3-463c-827a-e5de8a954ea6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a698a874-c8c3-463c-827a-e5de8a954ea6.tmp
Size 10KB
SHA256 dcb0089f3c1cdf5e1700bc20762c678f8d83d0cf54e22f1939cede4427d0a551
MD5 a67936cbadc0c93bfa7bc2edb7f58c97
SHA1 1bddc579f67fac0e8c35aa9a6a30ab69383d7dfd
SHA512 3a4eddcc05e8d622e500732a9008a97620ff9c2b45ec900fdde727c4a134f1fd04a5d0d027d4b9a7a67ccd2cc5f32df1f4969a1ec3b3e2508bca7bf72d78e461
SSDEEP 192:sxZNuRgW2/f/st1IdpXVHW6+WNc5W/YRPf4rsIg5lJ:sxZNuF2/f/stGlHbP/mPh
TLSH
T1A622C952AE28697B8CCBD609BB15BF53E6F9503291D41E48A6FCC61C05E6ADD230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c6e0acba-023a-4ca4-af97-73d3d0ad0230.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c6e0acba-023a-4ca4-af97-73d3d0ad0230.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3b737dd1-a87d-4329-8975-825e5f59a7ea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\3b737dd1-a87d-4329-8975-825e5f59a7ea.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

79f4ded1-097c-441d-8125-52546ad46566.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\79f4ded1-097c-441d-8125-52546ad46566.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ffc39a56b20a638abaa22278443fd4dbde9cedddceba76f8fc285c8aa42f6d6c
MD5 f8007a39633233c796ec1c9419131c6b
SHA1 1fde70930fbb9fd6d8839c6674bc04593d8b20e5
SHA512 4f275a42078dd40dbe36a321d0941838ddc87241c3736e9800af72c41771fc840cefa13c2e2d2b2fb9349db4d46f102ce3a47b19b3134bd23f1978ce3bf7fad5
TLSH
T1A2410958AAEA1148B3B73E169BF7A96D487AB9772E46D49D00110E4E0663B40CCA1B33
MD5 SHA1 SHA512 TLSH

Submit Download