hxxps://denuc[.]life/em-precision/em-precision[.]php

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/05/2026, 15:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://denuc.life/em-precision/em-precision.php
Sample260519-snwpjsfz8v

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4868_1748971016\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4216	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134237076456666347"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{3AB1B69C-BD85-41DB-A3F0-997258EE7FCE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1572	msedge.exe
1572	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 5024	4868	msedge.exe	86
PID 4868 wrote to memory of 4216	4868	msedge.exe	87
PID 4868 wrote to memory of 4664	4868	msedge.exe	88
PID 4868 wrote to memory of 4664	4868	msedge.exe	88
PID 4868 wrote to memory of 4664	4868	msedge.exe	88
PID 4868 wrote to memory of 4672	4868	msedge.exe	90
PID 4868 wrote to memory of 4672	4868	msedge.exe	90
PID 4868 wrote to memory of 2184	4868	msedge.exe	91
PID 4868 wrote to memory of 2184	4868	msedge.exe	91
PID 4868 wrote to memory of 2184	4868	msedge.exe	91
PID 4868 wrote to memory of 1900	4868	msedge.exe	92
PID 4868 wrote to memory of 1900	4868	msedge.exe	92
PID 4868 wrote to memory of 1900	4868	msedge.exe	92
PID 4868 wrote to memory of 4744	4868	msedge.exe	93
PID 4868 wrote to memory of 4744	4868	msedge.exe	93
PID 4868 wrote to memory of 4744	4868	msedge.exe	93
PID 4868 wrote to memory of 4480	4868	msedge.exe	94
PID 4868 wrote to memory of 4480	4868	msedge.exe	94
PID 4868 wrote to memory of 4480	4868	msedge.exe	94
PID 4868 wrote to memory of 3604	4868	msedge.exe	97
PID 4868 wrote to memory of 3604	4868	msedge.exe	97
PID 4868 wrote to memory of 2372	4868	msedge.exe	99
PID 4868 wrote to memory of 2372	4868	msedge.exe	99
PID 4868 wrote to memory of 2420	4868	msedge.exe	101
PID 4868 wrote to memory of 2420	4868	msedge.exe	101
PID 4868 wrote to memory of 4284	4868	msedge.exe	102
PID 4868 wrote to memory of 4284	4868	msedge.exe	102
PID 4868 wrote to memory of 4628	4868	msedge.exe	104
PID 4868 wrote to memory of 1356	4868	msedge.exe	105
PID 4868 wrote to memory of 1356	4868	msedge.exe	105
PID 4868 wrote to memory of 4984	4868	msedge.exe	106
PID 4868 wrote to memory of 4984	4868	msedge.exe	106
PID 4868 wrote to memory of 564	4868	msedge.exe	107
PID 4868 wrote to memory of 4248	4868	msedge.exe	108
PID 4868 wrote to memory of 564	4868	msedge.exe	107
PID 4868 wrote to memory of 4248	4868	msedge.exe	108
PID 4868 wrote to memory of 1036	4868	msedge.exe	109
PID 4868 wrote to memory of 1036	4868	msedge.exe	109
PID 4868 wrote to memory of 692	4868	msedge.exe	112
PID 4868 wrote to memory of 692	4868	msedge.exe	112
PID 4868 wrote to memory of 692	4868	msedge.exe	112
PID 4868 wrote to memory of 4728	4868	msedge.exe	117
PID 4868 wrote to memory of 4172	4868	msedge.exe	118
PID 4868 wrote to memory of 4156	4868	msedge.exe	119
PID 4868 wrote to memory of 872	4868	msedge.exe	121
PID 4868 wrote to memory of 872	4868	msedge.exe	121
PID 4868 wrote to memory of 4888	4868	msedge.exe	124
PID 4868 wrote to memory of 4888	4868	msedge.exe	124
PID 4868 wrote to memory of 1572	4868	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://denuc.life/em-precision/em-precision.php
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a0,0x7ffced40c188,0x7ffced40c194,0x7ffced40c1a0
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,9758391776025787522,8083346869062096176,524288 --field-trial-handle=2336,i,17408168441074140049,13560216129986005710,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,7135253357534175739,12782362023154934056,262144 --field-trial-handle=2336,i,17408168441074140049,13560216129986005710,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,916433475594885180,2364869345128180502,524288 --field-trial-handle=2336,i,17408168441074140049,13560216129986005710,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:8
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,9507983678411760708,14418725393369687975,2097152 --field-trial-handle=2336,i,17408168441074140049,13560216129986005710,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,3648201589690913232,16778824586458615257,2097152 --field-trial-handle=2336,i,17408168441074140049,13560216129986005710,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,4874066222597831343,10830229511373885248,2097152 --field-trial-handle=2336,i,17408168441074140049,13560216129986005710,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,9594651835203766870,16859454716021312327,2097152 --field-trial-handle=2336,i,17408168441074140049,13560216129986005710,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:2
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,12777225236858623760,3661460093745944929,524288 --field-trial-handle=2336,i,17408168441074140049,13560216129986005710,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,15440850070244630245,9906247804709185964,524288 --field-trial-handle=2336,i,17408168441074140049,13560216129986005710,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:8
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,856168015298966782,7976251091167654240,524288 --field-trial-handle=2336,i,17408168441074140049,13560216129986005710,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,9377367048857904110,8073203511481136674,524288 --field-trial-handle=2336,i,17408168441074140049,13560216129986005710,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,11360750614918635515,1556762290206295973,524288 --field-trial-handle=2336,i,17408168441074140049,13560216129986005710,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,11360750614918635515,1556762290206295973,524288 --field-trial-handle=2336,i,17408168441074140049,13560216129986005710,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,17878346264649243969,4664060978179599227,524288 --field-trial-handle=2336,i,17408168441074140049,13560216129986005710,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,11527658825344101695,11428156635115756287,524288 --field-trial-handle=2336,i,17408168441074140049,13560216129986005710,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:8
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,11098544818651088555,536215326193300708,524288 --field-trial-handle=2336,i,17408168441074140049,13560216129986005710,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:8
  2⤵
  PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,10663860596193613460,16544402559824396955,524288 --field-trial-handle=2336,i,17408168441074140049,13560216129986005710,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,13056653247244796812,2642614426439071775,524288 --field-trial-handle=2336,i,17408168441074140049,13560216129986005710,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:8
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=120,i,16442910260420334870,14190015677252188931,2097152 --field-trial-handle=2336,i,17408168441074140049,13560216129986005710,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3776,i,9295732651898639528,5159170344855067452,524288 --field-trial-handle=2336,i,17408168441074140049,13560216129986005710,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:8
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3948,i,11199306165685806251,5012145632173687531,524288 --field-trial-handle=2336,i,17408168441074140049,13560216129986005710,262144 --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:8
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3952,i,1426405848235043915,15337125790432733319,524288 --field-trial-handle=2336,i,17408168441074140049,13560216129986005710,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:8
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,2770530469001813421,3218886317874868266,524288 --field-trial-handle=2336,i,17408168441074140049,13560216129986005710,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,1447795454739731861,7007106473730972852,524288 --field-trial-handle=2336,i,17408168441074140049,13560216129986005710,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5888,i,13249672555593799085,7547942926122962169,262144 --field-trial-handle=2336,i,17408168441074140049,13560216129986005710,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1572

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4868_1748971016\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 1240854d02a699b4cdcb73e874459050726e68cf7b2acfec992a2d0036c875b3
MD5 fefea6e0a566aa892db74e6fdfe9dcd0
SHA1 31b9d55fd77d53202300d664f3cbcf0309e9ac6f
SHA512 177849886b98ec914e442f5f68fce7d798bbd5a890b720b353e792d154f55b96e5069c5a78285195c59f173ef6b1881b882838809c0676394851fd0b22de653d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7a:fwUQC5VwBIiElEd2K57P7a
TLSH
T1EDB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7c52d628b26e995a00a33fd39d91131a5876ac3e62d43ec09fc94bba37ed6132
MD5 0f187f923f850c516d3686f73cbe885b
SHA1 d2bfb7e41bac8e57fb9b1f9649bb38f835963c2d
SHA512 e945771dbd1eacecb60a3c99b67a12301c976f071a7a270b280978510caaeec8960f29129f7d8e6bbafc179b10c39b57d048448d4ca9d404b7e8f3496dad50de
TLSH
T14181A43311F3C3A2DBD1023062D2A07DF9B589EAFD3BDEA6555005766E38389A715F18
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b36d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b36d.TMP
Size 3KB
SHA256 4782bb2fe6126ee2c6f8a0ff8247b27593ed310a146b701ecd732ed7d691e634
MD5 a13a332ca29691cf62bc57cb177f20cd
SHA1 18b203fd3fb684b7bb059cbd6a408063ad415e3c
SHA512 d7668436de4c6d6c94d4503f2577836a3076ad21f37a1899ce665a93e03f5ea02ea60c01367e99db44d58240ace86a03cde55e4f224f69a28f21488fdd0a45aa
TLSH
T1E081A33311F3C3A2D7D1423062D2607DF9B189EAFD3BDEA6515005766E38389AB14B28
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 31eeb7970fe351227c768c47318e8d71da7c6c663460f1d94557d4a351a91c59
MD5 305253ff9f07034cbcb7d61d80c74a80
SHA1 78b591a8ec8d35ab7900893ce75de4503683bc40
SHA512 b32286fdc101f5b01603894905b5757345d2192db0189b69afececfe67842ed856896c61e35b00e13b05cf8bff91595c225fd1c57ffb65e019138e7753b4e00d
SSDEEP 48:YALlNdOHRgyCPHAH8HncBmsLRsBLzEsh/fo7wEsxdCKsnr/gmzsBQel5sC1ezsos:DTOxAgcHcrizt/aw3yr/t4n1E0+m/cA
TLSH
T16D917CF3C2E8C72D891296F0AB546E1BCE5D091453293D2AC9E5EF4F93F24B1E20165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 fa32810a6997d9d65402a2113da198e5ee26d18adc49b99dacb7606fb0f4f52d
MD5 cb63e4dec636c0ffaceb0ef7bbeb2425
SHA1 a95b3a1f91abef0f5f1884d7aecc9cbe3d8a999c
SHA512 f812a28b30967521a9a2551149419695396001e86e101e627238e12b5371b461a5e2075e499019d9464d82d0603236d9cb12387e55d7c4cf6100cdaf16a7b0d5
SSDEEP 96:DTOxAgcHcVcrizt/awrr/t4n1E0+4ciVc2x:DqxAgcHAaiFawTt41E0+4dV9x
TLSH
T188A18DE3C2E8C72DC91256F0AB546E1BCE5D091453293D2AC9E5EF4BA3F24B1E20164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 858e9c2713a71588dbb93f67836ca0166f85fae86571db8cf6e16a569810db6a
MD5 df52f562089ddd9b07255dfabdf6ebe0
SHA1 220f0ef461d7b8d1e570f0f7f36d099b7493308b
SHA512 ecbb07aad845ab0814295be36e9c1fd93615716e2d2556256b0a341b5b8706d5865c54e0a4fca3fcab9e5e09155ae736faa223050615dd51ac71a21eb58129d6
SSDEEP 192:sxZwRAyM/jK1Ml8Mk3/fB4shgEgqe8Idp2EHW6+WNVrA/egvIJ+kIg4J:sxZweM3/fGsuZ57Hby/ePc
TLSH
T17652D8126A3899778CDBD309F955BF53D6F9046292940E44AAFCDA0C04E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 1ae32f2cb87fa7f9fb5801d2ad603aa4e6058f9dcb55137b69a4f845fe64eba6
MD5 4d5c1d7c3c5d5e5932f75f56839bbd5b
SHA1 c39529decb0dd1d940f78ee74645964d69d0bc22
SHA512 49c588f58bcfafe46bdc48392f735eb138a814cf34d61ae3e6f463d052f26f4038c0e23fefa04d9adf764dbc76c27d9d2e666fe9aedbaf978892980dc2ffeb33
SSDEEP 192:sxZwRAyM/jK1Ml8Mk3/fB4sWgEgqeC9Idp22RHW6+WNdXrA/egb4IJ+kIg5eJ:sxZwmM3/fGsVZzrHbG/eko
TLSH
T16562D812AA3899778CDBD319F955BB93D7F9046292940E449AFCDA0C04E6FED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 2f486d61275d07630b03ec9837812b6fc121531e53b6ab4c0f58c70ae973ebcb
MD5 00fb9e056f95795f63e65fc21d612d6b
SHA1 25fa15f4eec6480b168f84534f3ab7e3c1995500
SHA512 c35587ca667c82286e9ad5702bfb57cbb464249e8466ed78026ee69908b697ae6a3b3eddb587a268cd2ae3837f7a3acd6309933f6143a525f0b258bf9ebdb5dc
SSDEEP 192:sxZwRAyM/jK1Ml8UQ3k3/fB4sWgEqqeC9Idp42RHW6+WNdXrA/egb4InJ2+kIg5k:sxZwmq03/fGsV/zhHbG/eIim
TLSH
T13D62D8126A3899778CDBD319F945BB93E6F5547292940E44AAFCDA0C00E6FED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 d0b13125e346e48d5a6ee091e7b3048d901eaec58eaa1c7e0099d499b2e487a1
MD5 df2adfcb562a8abe56a676d752d8ea0c
SHA1 84f9fda9b731ee14bca852ba68b18f115091c03a
SHA512 c6a2f1e10d0ebb9e61d4f9681731d5d4d107310dda0b721d109982dc0028e32250693578c14510a9190332ae224b87adac18228518cd3a68e89824b90a71765c
SSDEEP 768:99sqxFm7pLuLXJlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVLXUY4Ll6AR9Ar/:99sqxFGEXJlWvJD6Tu1jaSEY4LAs9LMX
TLSH
T1F0F2FB3B6D4CCB7E4F844E9CED2A7ECA6DE8018B56D8C95447FA840C03C66EB11165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 f0412b9a01c8dd706de8996dfdd656d193c7911645931b934de5e62c7df8541c
MD5 303d465c75d546c9f8ec05b693df621a
SHA1 b98fc70756199582fcec81b9f8dd5a67671d6f3c
SHA512 8845c7d764ef6d264e9da9c344a998838f1e8bc48ecd91bc17262c26f3f280dba54cc68f0a5038727fab5976a8e1680c5076c16b9e35585a89f3b8935fd2f179
SSDEEP 96:KYbaKYIKOj+Kg8KmFyKecx9OKe4KuBuKK4H:ExJNRfxVy
TLSH
T111E1E502723B120138BD295CA2DAAA379E8175633418E4FF7BB950A24D66F214CFDDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b0d959e7-3cc8-4391-8418-cecc593f3a22.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b0d959e7-3cc8-4391-8418-cecc593f3a22.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 f3c0656d27aa6a68e887a5c4118150006f50e9aa88b0756ad18e42c3074a76f2
MD5 ae6db66eaef35bad8c5a969f9b1c050f
SHA1 ca2dac64da6e45fb91d9ac724c344b664fa360b9
SHA512 aed2c8d7c78e8d3d08e504c94c949de084fb0d68f6c57f6f77b680752e371710d4bd7496a39dd2328d80d41929b4ab65cdd178965e2d583812774990475eacc4
SSDEEP 192:uuvFsNDeVYRViQIEEq9jwIokRbOYjQmiU1Q9gD4VRNZOmCJO9+n2hSRC/mU8:n9sNDeqgMD3bp5sVRNZO5s9ipU8
TLSH
T14042083279386C779EF6AE45F54B3B435FA4207BA6852E84D6D85F0C01CB79C230A927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 519c3406a78ada5c88ad57f0f26f235f0491bdda73a1377d9697dc23daab70d2
MD5 b62bc9eb7bf18fffb1c2a371a306719d
SHA1 5bf5f16b639c9fa908329826b5996ab40a671cac
SHA512 f89240c0aaed59776d2e4dde4b4373a7c7e7e1d2523e5ebeb3425f68fe5f41ed00bca4dffac8e1b865a919fd11cc71204071eda4483c95aab50fc3101a31aac8
SSDEEP 384:nWiFoNsNd8TUNTUlIl5MSM7MD3bpdsZDfYZRNZO5s9ap31aj:9FCAwgkV+HZHZOG9ap0j
TLSH
T13EB240F294E78977D9AE4B83A73E6E429EBCD05775885984B7841D0CCC862BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 01163a658cab0335ba67786468db4cd75177480770c26226d6c63d41378602ed
MD5 86b0b3733918fba5ed50d3250ecec557
SHA1 7529ecb4fa2ccc40775b94f7230debace5dea730
SHA512 f17133ef60cbbc2040230e72ca0671a67fab6711a36146b3c9f89f3cb2bc05283ba58c74813d24aa48af8c8b6890e79f0aaa68d64d3a076a30929d893cedd23e
SSDEEP 192:uuHFsND5VYRViQIEEq9jwIokRbOYjQmiU1Q9gD4VRNZOmCJO9+n2hSRC/mUt:nlsND5qgMD3bp5sVRNZO5s9ipUt
TLSH
T1C442083279386C779EF6AE45F54B37435FA4207BA6892E84D6D85F0C01C778C230A927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 bf51e760973b932a639c91b165c260c9a56b03b46d178f9d084d4d2cc9f8279d
MD5 00f6e1639a06faf2ba8ddcfba1fce150
SHA1 5f42280935ad81883f1666c9ddadcd2eaca559e9
SHA512 b8eb40315b7bc6a0ea23d6685645f93a2fbd3f52f6201a65ecadbd18c028d22e033ad7c2935b429d16c4e6fccc585f6f838e39e1446a9b09628f4f0567e081a5
SSDEEP 384:nWiF9CcmyWCeNsN28TUNTUlIl5w/MD3bpdsZDfpZRNZO5s9rp31aRjSn:9FccpMFwgLyZHZOG9rp0RjSn
TLSH
T163C282F198E78977D9AE5B87A77E2E428EBCD06775844984B7841E0CCC872BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 234a03ea95a04f5c8caf8ea3bc0406b815c6e8bd74185ca5623f29c45a7c3950
MD5 38ebae7eac883ac0f49fea4aa9c4b189
SHA1 69b533ee188f005eee9a6ec874dd54a826cc88df
SHA512 c88a39e5f3fa339543725955c9ef9e41baae232a870c7f515525a31a21550bed759511673d174724406ce2d7c0f01d0ffe9614d36928a0bcd8372f2e83060131
SSDEEP 96:mqONk0QsjpfHkRQ9865ih/cIPURHl8h4otop5fTDRBsPvvk40KQN0kjOmXdwz1q/:tONc6JkRtQmiUyfnW+RNZOmCMh38RkU6
TLSH
T11002D8357D382C778EF26E49B98B27175FA4206BBA552F84DAD81F0C01D765C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 45a149fd85a650222e52aeba2625d3f57cffc083cdf1bd40c5c7b336ac7c7a37
MD5 70864cd368e64bec6b3a35ac631d7377
SHA1 b8085818a8af8916af5be903173cd2803eb2ae08
SHA512 478b9cc8797b88ec55a9e5da21ab9efccf3721aa19f2f99d06d37abf422adb3aa96f180b6407bfd777aad57db9e1ee2aa8488d0596dfd7811dcf1d846b38aa86
SSDEEP 192:tON26JkRBQmiUy2xn8+RNZOmCJO9+niVcC/mU6:tON26Uf78+RNZO5s9apU6
TLSH
T13512E73579386CB79EE66D45F88B37575FA4207BAA852F84D9D81F0C01D7A8C230A836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 c15544438abefdefc071376804a667364d297e39ab1794a4f68350c8ad263e5d
MD5 99511388742e9def3c17c4136138916d
SHA1 261d1912f3b981838eee128b58c5cf26873f174c
SHA512 fb0ea1bba24354e6052fc15489e2bd0c23f73c72e953e5652a0e1ff7808526cc32eeb087f66c4e03db4ad3966867da255bcbf0c0f133b2e118328ec9d9c64950
SSDEEP 192:uuvFsNDeVYRViQIEEq9jwIokRbOY/QmiU1Q9gD4VRNZOmCJO9+n2hSRC/mU8:n9sNDeqgMD3bV5sVRNZO5s9ipU8
TLSH
T1BF42083279386C779EF66E45F54B3B439FA4207BA6852E84D6D85F0C01CB79C230A927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

ca6d43ce-2292-42a5-a911-7d567e9efe53.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ca6d43ce-2292-42a5-a911-7d567e9efe53.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1b0377a15af9b9b85ea85ba382270f6e03d7615dae88cc5ad9c63cc5966e82a6
MD5 19b86c68981c6ccc0855294c1f232ed4
SHA1 00cb50db074e39386c63905ef732d63515925708
SHA512 3192d37e8aff98662e4dd5ea27420c31b31100c92fb3462bf36da49f0fc4c4c8b424217bf7230da964b2d373a130ccada71d64af38e1f0a14fca76be6bba6674
TLSH
T134411558AAF91158B3B76F9A9BF7A86D447AB8772F06C45D10110E4F0A23A04C861737
MD5 SHA1 SHA512 TLSH

Submit Download

2ef0a1ab-e361-4d99-89c0-3adc29d2a379.tmp

Path C:\Users\Admin\AppData\Local\Temp\2ef0a1ab-e361-4d99-89c0-3adc29d2a379.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3f05c6fb-a955-48aa-91b7-51a197d8e2f7.tmp

Path C:\Users\Admin\AppData\Local\Temp\3f05c6fb-a955-48aa-91b7-51a197d8e2f7.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4868_1265270067\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

806dc307-b604-4094-a6c6-856c6335a9dc.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4868_546533384\806dc307-b604-4094-a6c6-856c6335a9dc.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download