hxxps://daveneighbors[.]com/folder/

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/05/2026, 03:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://daveneighbors.com/folder/
Sample260523-dj9chset6v

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 16 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6036_2067551379\shopping.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6036_2067551379\shopping_fre.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6036_2067551379\shopping.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6036_1090622092\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6036_2067551379\auto_open_controller.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6036_2067551379\product_page.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6036_127961110\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6036_1090622092\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6036_2067551379\edge_confirmation_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6036_2067551379\shopping_iframe_driver.js	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6036_127961110\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6036_2067551379\edge_checkout_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6036_2067551379\edge_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6036_2067551379\edge_tracking_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6036_2067551379\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5348	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134239790322141190"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{495EBDD7-E7FA-40E1-BC54-A1D4ABC6DE46}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4588	msedge.exe
4588	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe
6036	msedge.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 6036 wrote to memory of 3096	6036	msedge.exe	80
PID 6036 wrote to memory of 4672	6036	msedge.exe	82
PID 6036 wrote to memory of 5348	6036	msedge.exe	81
PID 6036 wrote to memory of 4672	6036	msedge.exe	82
PID 6036 wrote to memory of 4672	6036	msedge.exe	82
PID 6036 wrote to memory of 6084	6036	msedge.exe	84
PID 6036 wrote to memory of 6084	6036	msedge.exe	84
PID 6036 wrote to memory of 3228	6036	msedge.exe	85
PID 6036 wrote to memory of 3228	6036	msedge.exe	85
PID 6036 wrote to memory of 3228	6036	msedge.exe	85
PID 6036 wrote to memory of 3364	6036	msedge.exe	86
PID 6036 wrote to memory of 3364	6036	msedge.exe	86
PID 6036 wrote to memory of 3364	6036	msedge.exe	86
PID 6036 wrote to memory of 5800	6036	msedge.exe	88
PID 6036 wrote to memory of 5800	6036	msedge.exe	88
PID 6036 wrote to memory of 5800	6036	msedge.exe	88
PID 6036 wrote to memory of 784	6036	msedge.exe	89
PID 6036 wrote to memory of 1232	6036	msedge.exe	90
PID 6036 wrote to memory of 784	6036	msedge.exe	89
PID 6036 wrote to memory of 1232	6036	msedge.exe	90
PID 6036 wrote to memory of 5416	6036	msedge.exe	91
PID 6036 wrote to memory of 5752	6036	msedge.exe	93
PID 5416 wrote to memory of 1312	5416	msedge.exe	94
PID 6036 wrote to memory of 4996	6036	msedge.exe	97
PID 6036 wrote to memory of 4996	6036	msedge.exe	97
PID 6036 wrote to memory of 4996	6036	msedge.exe	97
PID 6036 wrote to memory of 1108	6036	msedge.exe	98
PID 6036 wrote to memory of 1108	6036	msedge.exe	98
PID 6036 wrote to memory of 1108	6036	msedge.exe	98
PID 6036 wrote to memory of 2820	6036	msedge.exe	99
PID 6036 wrote to memory of 2820	6036	msedge.exe	99
PID 6036 wrote to memory of 2820	6036	msedge.exe	99
PID 6036 wrote to memory of 2008	6036	msedge.exe	100
PID 6036 wrote to memory of 2008	6036	msedge.exe	100
PID 6036 wrote to memory of 2008	6036	msedge.exe	100
PID 6036 wrote to memory of 5760	6036	msedge.exe	101
PID 6036 wrote to memory of 5760	6036	msedge.exe	101
PID 6036 wrote to memory of 5760	6036	msedge.exe	101
PID 6036 wrote to memory of 2900	6036	msedge.exe	102
PID 6036 wrote to memory of 2900	6036	msedge.exe	102
PID 6036 wrote to memory of 2900	6036	msedge.exe	102
PID 6036 wrote to memory of 1888	6036	msedge.exe	103
PID 6036 wrote to memory of 3748	6036	msedge.exe	104
PID 6036 wrote to memory of 1436	6036	msedge.exe	105
PID 6036 wrote to memory of 5744	6036	msedge.exe	106
PID 6036 wrote to memory of 5744	6036	msedge.exe	106
PID 6036 wrote to memory of 3512	6036	msedge.exe	109
PID 6036 wrote to memory of 3512	6036	msedge.exe	109
PID 6036 wrote to memory of 2816	6036	msedge.exe	110
PID 6036 wrote to memory of 2816	6036	msedge.exe	110
PID 6036 wrote to memory of 4588	6036	msedge.exe	111
PID 6036 wrote to memory of 2956	6036	msedge.exe	112
PID 6036 wrote to memory of 2956	6036	msedge.exe	112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://daveneighbors.com/folder/
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x250,0x7fffe740c188,0x7fffe740c194,0x7fffe740c1a0
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,5694707550357532695,4968662990868111429,524288 --field-trial-handle=1928,i,18003302897921950868,15224532914700890257,262144 --variations-seed-version --mojo-platform-channel-handle=1956 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1556,i,17360099431479708729,4014667255139498464,262144 --field-trial-handle=1928,i,18003302897921950868,15224532914700890257,262144 --variations-seed-version --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2576,i,14249997361364755023,2915096493612978273,524288 --field-trial-handle=1928,i,18003302897921950868,15224532914700890257,262144 --variations-seed-version --mojo-platform-channel-handle=2704 /prefetch:13
  2⤵
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,134528058145547410,4178805135311236069,2097152 --field-trial-handle=1928,i,18003302897921950868,15224532914700890257,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,3868279063267296875,12884351029377300551,2097152 --field-trial-handle=1928,i,18003302897921950868,15224532914700890257,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4980,i,3246424406425628216,17833533931355559531,2097152 --field-trial-handle=1928,i,18003302897921950868,15224532914700890257,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3940,i,7197551667868965525,1787209201244134318,524288 --field-trial-handle=1928,i,18003302897921950868,15224532914700890257,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:14
  2⤵
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3928,i,3335480218327641246,2513302602364268539,524288 --field-trial-handle=1928,i,18003302897921950868,15224532914700890257,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:14
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,10651173945465697729,4975749651240712426,524288 --field-trial-handle=1928,i,18003302897921950868,15224532914700890257,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5416
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1124
    3⤵
    PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,14926934523800086201,9279373342045996811,524288 --field-trial-handle=1928,i,18003302897921950868,15224532914700890257,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,14926934523800086201,9279373342045996811,524288 --field-trial-handle=1928,i,18003302897921950868,15224532914700890257,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5616,i,8224002158141917466,15198389401012577611,2097152 --field-trial-handle=1928,i,18003302897921950868,15224532914700890257,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5612,i,3346468873434164671,10957407729444161809,2097152 --field-trial-handle=1928,i,18003302897921950868,15224532914700890257,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6532,i,14464334425767083881,2576839793849581597,2097152 --field-trial-handle=1928,i,18003302897921950868,15224532914700890257,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:1
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6568,i,5056728278696299363,14075799036042849668,2097152 --field-trial-handle=1928,i,18003302897921950868,15224532914700890257,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6560,i,6965723082030679813,3860120026735362736,2097152 --field-trial-handle=1928,i,18003302897921950868,15224532914700890257,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:1
  2⤵
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6264,i,12616567297308450161,4268300129531072763,2097152 --field-trial-handle=1928,i,18003302897921950868,15224532914700890257,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6520,i,9962855710620377741,10841572275470480653,524288 --field-trial-handle=1928,i,18003302897921950868,15224532914700890257,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:14
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,8606252427021062444,12508406581079702868,524288 --field-trial-handle=1928,i,18003302897921950868,15224532914700890257,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:14
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7028,i,11800614072523888722,5471065735965100588,524288 --field-trial-handle=1928,i,18003302897921950868,15224532914700890257,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,14059294493810779908,10913818194590985070,524288 --field-trial-handle=1928,i,18003302897921950868,15224532914700890257,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:14
  2⤵
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6520,i,14341095725080397749,13782551564100594897,524288 --field-trial-handle=1928,i,18003302897921950868,15224532914700890257,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,7002462152661861173,18391404633305348901,524288 --field-trial-handle=1928,i,18003302897921950868,15224532914700890257,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5940,i,9058351280598429164,15151111314041557392,262144 --field-trial-handle=1928,i,18003302897921950868,15224532914700890257,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,10904369349522258464,3101309678291229980,524288 --field-trial-handle=1928,i,18003302897921950868,15224532914700890257,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
  2⤵
  PID:2956

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
MD5 c16a98ebe36bda7f5aece00f9ac1d0d0
SHA1 ef2e2a8775d1ebc0124f0ba983b6f20777919000
SHA512 148affd9dbe6aaee9070c22e41bc916df527cec5741753ca2733855f500e4eef0a257445d281d79c2449f8265c41b54dd53ffe57650802594b1211b0db611349
TLSH
T1ADD012273B0DA054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 e3cae852638f0d24834f88f91c68c10808b38bfe6c041f0f6ed678171fa9f1d1
MD5 762f48a4037672116f9c0e18264130e1
SHA1 ddd53f6d9f2da614ec6690f17d11907c2a5aa6a5
SHA512 689bd95bd9411f94dd49ef38138b74b4c623f06238271764c5408d3a5daaf503ee7bb6167908e20ff87ba0bc616734fe6ca651db5a331d1a35e68ceeabf89e74
TLSH
T1A4F02DB6CD21AC3B09FD2B2960645746EB5413672B41499F3B3C820D8FB573B4655C2C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 10b0985ebf33df69fb7bb0b9439acb7e2c54d9851d05d551622d3ce1d7a6730c
MD5 2c97eb222952ab86d11fc06142b0521a
SHA1 24e9e1ca82659b8fa142791e21c72472957192c2
SHA512 778fce0d6e0cf4e876aa4c649008f0c9e225247bcdc83b5b6ffe181df957bbd23d514718774a3eb65243f4f3ee109b80322843e383aa16cb7ee3296699a1d523
SSDEEP 192:VEqktgCj/X1ok6n2q30af5Ps6eSNKhoGo:VNQTjti0afZeSNKhoGo
TLSH
T1DCE1760382D1EC99FB5597B4B8DA7F103574B8950A4B1E2B63EC5C7ACF33F852811A46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe590c5a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe590c5a.TMP
Size 3KB
SHA256 7734e22d8903885b1d43aab4283231d829608c1547dd5405536d51a83ac93a7d
MD5 a90c0201d48c3d98f66b90737edb5b0d
SHA1 b001862b29ff096ba42f437924b28a0d0f763db8
SHA512 3b62068f572f9366a7e1bde4ba5cb462a68fea87f1c058beced541bf9b2268ffc3c963f0a17cdd422d2a3b86c47410f2adda5628159cdf38c98335197d82b0ef
TLSH
T17B71A507416A34E8F39607F0F0E93F5530B1BDD64A9F6D6B31E898BC9A32F142621708
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 3c201c655bd17230b7587bdc4f6175aad514932b0f2020b12c959db64552550c
MD5 35f949f94559d78e55b95c51b4c11d81
SHA1 1ea2d5243cc170652745d5025440746925229008
SHA512 b936e33533f35c205679f2829fa3c9439f27102a333390fdae4109d8fb023c1189a7598aedbe7e82febc1ae115c8b208076c4db9690becd095b891569d08d1bb
SSDEEP 384:D17ZrryStKblJre/2e1e3NRgeaaaiGVD1isoGR4MRasAKZfN2shqGRKwJ/iVh/TT:LZ5pGd
TLSH
T1D1524BB7C3F9452D892391F0A718EE1FCE590915932CBD39C9D49F8A93E24B1E241B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 b40253eb1e3c63c8fd551473ef02b6a2dd28196fd31a1520f14ac5d8dd6b01aa
MD5 4b18fd7b20db9ea2218847b5cd4ab674
SHA1 dda8870354608cb00f59bae564e32a016737898e
SHA512 2f3bb469f4a58ed7e80f4990277a62dccd30625cc2d6c7f486c3badc17067dd2de174912f2dff25ffcb7f871b4248a40ce624a4f83a2267c0e7a17855479aabc
SSDEEP 192:sxZqR1yMqZjK1Ml8MFo/flsFPpKTG5GN2fwizodpyp/W6+WNpsC/O++0hL9HIgj9:sxZqGdo/flsFPpUei2Mu/b//Pnj+I
TLSH
T1C762E8466A74497B8CD7D219FA55BB53D7F9157292904E48AAFCCB0C04E6AEC2203C3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 358d7a74d58fabc4a5519a9fcdf66f787564fe8932fd8a3e20540e8a9d8e0376
MD5 d7db01e0317d786e8924a8e8e65cc00b
SHA1 5178af1b72705c2b9c0c7f90e460906b52ec26ae
SHA512 288cb56aac105b3576575e92fc4de12ea16a10e5628e793a8889cd43379eb632c45e93dd2f6f6a30578d10d2c0b9733381f00835220970f085e5b2e09fdd6281
SSDEEP 384:sxZqGqCo/flshP6Uei2Mu/b//OS98BbJx1Gk:sSJCo/fAP6UY/bHn83J
TLSH
T14082C79366740D7B8DDA9626F554BB27D3E9047796904E88AAFCCF0C00D7AEC6103C6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 5dec1c57180a86e5fc2cee35fe9ba8e04743dc196545199c193c99c0629464eb
MD5 eb7b07e93bca5c3d7f7a2ee41dd10259
SHA1 25451f896e6cd59d1b3b33c0c1c79b272ee62b9d
SHA512 7643c6152829b66dfe389d1c5849cee128895264cd0cb36fb36bff10e34d8bcac0f185da02a081a0b6f26c9765eb232205976ae0d1bec433b5bb6fcc890962f4
SSDEEP 768:wQAKq8y02yS7pLuLnjbWRmj1QWT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3zzx4Ll8:wQAKq8y02yqEnjbWRmj1QWTu1jaKzzxL
TLSH
T1FF03FA3B680CCB7E4FC04E9CED267E8A6DE8028BA698C95447FA444C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\d8d05327c5274855b1a8796001e4dc6b8f2e344f\index.txt
Size 239B
SHA256 efc0095d682dfe6ec131cb3f2188d66bffd93c971c25323c22e3222ec93fa915
MD5 14f1f2d725afcd2501fa16088ac1b21b
SHA1 78927bad07e2891d4072174a83c74053da013ff1
SHA512 008ca2e6c9fb88c295884252d8a529fda91f544b681829b32c65989035b8e0768cb1f9b6c9f1364b9f1556b552e570581e9d5e4240c929416264d6d98ef81b10
TLSH
T18DD0973F07988304DAF8CEE009B5B56812463090BC67E1EC42026077066304BA33B0F3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\d8d05327c5274855b1a8796001e4dc6b8f2e344f\index.txt
Size 253B
SHA256 c117842d393c4ecdf8f9946ee4b14ee1172bf49a014c7284ef1bc881fe7a2e82
MD5 34580f4dd6180eaf84bda0dd9abd9083
SHA1 8a68e039cc56107e62515df168ab9750fefd57a7
SHA512 d0dfa32797c15c4903b5095278096f3208e3ba3a6de092670936b7265dc418d4ad071e04caa992e52a3df1461a990a748539929bdd78d72b339a2e2c08ee5f53
TLSH
T1D8D02E3A86A882049AE409E108B1A9981A52BC96BC56E1EC42037037067208BE62E0E2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58973a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\d8d05327c5274855b1a8796001e4dc6b8f2e344f\index.txt~RFe58973a.TMP
Size 163B
SHA256 25c00cabc092f7f4c5cacfbfeaca4db1ed148c57396429ec2a6d4ea46e8518f8
MD5 06a3fc1d8aea4984116b4623944f365a
SHA1 8d61a28d157ee6e7c0305d05c83e9316c006937e
SHA512 a8e7919e42af173051b7325abfb4c2a7c30c6b74a70ad7197cd5aed18a2125c3fb5443be5bb5dd5bdcea37219039b9bf4d51703f12f135c7cc879a5ca339d252
TLSH
T1D4C0806B475542009E55495019F1B64C56477D547C59D5DC410370370033496A61B5D3
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 d669e56259dfa280c4759eefd295f94f6af31a3980111d6a003d1828c13072c6
MD5 dd4c6ad1f866ddb1b2f770f6809f0f96
SHA1 281b2ab92c507ad14bf14f3937808219ef544dd5
SHA512 8ac926170c4d98ac7dd745af5ed7160be584ca967aac1cfbd5d63d57a146ce6f3000b104dc36f8e9d7e1d090eebacf1296480ae1ac473420f92b0fdc78983e05
SSDEEP 192:GD9R5VJhn/iVJnZFGVApBPisTE/3oNloNPSF53pVWFQ5xfSsD0PnY9JFlPtv0F56:GZLVDJjEDPV0/ZdsLC2
TLSH
T1E2B2790232FA02423C7D290C93979B674A42F1633469AD7F7BA900B64E67E125DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 c4b269ab9b1606954420dc997d31a076b5735352d7288adc6f1c083f55932624
MD5 40a9bbe6b7c2300ca356cd8372e225c3
SHA1 811bb9dbe97b0ecc2c11a475be5bae80315dde5d
SHA512 4096186e1d7b53ce1f958cfcbe2f77f7c8168fdd868f31030bb1ad09a91b5afec2333b465f1401b7124bcf87d3e8612e38d47046b348fd6e2eb40e71e8e5003b
SSDEEP 768:FF1jZby3zwg9KekmMI+5fGyRLehp5feO7:bm3pk2Lth7
TLSH
T1ACF2A2F194E789B6E9AE4B97A73D6D02AAFCC153B4481994F7C84D0CCC861BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 24bcb83c90c0380ce2eec7f021f7256ae356ac8de9c39d02b418ebdec3426627
MD5 3d45edad0f77ff1fb108e1eccd97dfcd
SHA1 397523eaea96521c895af0da79f0cca7daa89c01
SHA512 d02dfe5d1e1835db27785385984bcbf146a0791a60ad3aea580bef8ca34bb59c965102f5b929c0aeb9d70913f1c2214b606e11757c1c25f2306e301ef6d07f4f
SSDEEP 384:n+iF9CcmyWCs38Nu8TUNTUlIxBPm3ek32nn9BOQIs4Jfb8GgFRLCaGByOUe4KV8P:VFccps39wgPKekm2PwGyRLeQTI8p0yt
TLSH
T153B26C31EC68CABBECE64F99B74E7A02EEE05163858C59E8DADC1D0D109719D130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 85455b9ad738c0ec14149658bf5b59837a869f2b1c1867029f664662eb4408dd
MD5 382b19be7595a46c92d313996081228e
SHA1 9b2c13524f52550e1a6c0bf7f1ee4d8dcebb55a5
SHA512 ff7d956f62ac06a2ed920e931e2e24132a377e2899a95f36b57001d2b4fe8031ba17df236c7a712b6bc72eff6301939cc8477ce420499d853a50eb78e9b8e877
SSDEEP 384:n8iF1tNnNnb9W38NM8TUNTUlIRPPm3ek32nn9OZsN4Jfb8GgFRLCaGBISDpdqD1S:nF1jZbw3zwg9Kekm5fGyRLeHp5feO7
TLSH
T16FD24B35E864DAABFDF74F9AA70E7643EFE40163958C5DE4EAD94D0D008B18D130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 1dccb07d712239468102f4e9acf66e6d8d94dfc25450fc9983d4af5a6afb9c2e
MD5 d15141f0063568e00adb2070cfcb9c78
SHA1 83378a5357367c3d61ec4a79f56452e1f5345fb9
SHA512 aa5b0d60779b28200c6bf0c026c8065bc9fe022f6c5a822bb1a1a4aa7357e123647a8570b93f3a92eb88a4c57fca373cf1c55d41a6d7f9529887f993508be6e6
SSDEEP 384:n7iF1tNnNnb9W38NM8TUNTUlIRPPm3ek32nn9OEsN4Jfb8GgFRLCaGBISDpdqD1S:WF1jZbw3zwg9Kekm6fGyRLeHp5feO7
TLSH
T100D24B35E864DAABFDF74F9AA70E7643EFE40163958C1DE4EAD94D0D009B18D130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.21.1\typosquatting_list.pb
Size 426KB
SHA256 dd09485bbf5cc88d4b16947759497eaa159173798917953ed192e4f70f7b5d4f
MD5 03151e6660e6bbfa692924e34f19864f
SHA1 6b6ab73d35013c474e03e864634d05f264c5de22
SHA512 a30e4932722ab12bb106b4727610272a987a9222b15b727bfe062c370fa4234b2c5c82e6858b3454ebe17cdaca02444ff5d9b00df76f41b1fd5a585c4bb981de
SSDEEP 3072:aOtMYwJuo6nLA5ORUEaT7EfDhixsu417P0++di92iLUJs:PMNJuoL8avC3N+09nUJs
TLSH
T1AE94A3B9DFC00150DB78112D20BE71D8181412A580E9DFEAFE7D865F2BC2AC977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 b16251a32202e9ae23c0ae913940eb448ce680501bf96177856745bd1a117b40
MD5 73ab91e36b0b2e77f7964f0ed458569b
SHA1 7c389383e603f4182633245ad77c2d61ca7918a2
SHA512 85533eaf8f94d69582f6e372ae7d2e13ddf3447890525144ec2ea98554878df2173daacdc109f15f6ea23d9e72264e8d00c78e34c223edb86e0dcb66b92a419b
TLSH
T1815130E15C395AD1D0BD0E6FB48B34EC85D8C725F5A0347E6C58EA584A3960D248183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 c2797c3dc57b5720539db522ecc60d7e1bc89b6b6754cc5533a05b3b18da55cc
MD5 36c26793095ab5c148b1ab629cd60c1c
SHA1 9efc5e49dfc71a37bc9d7483b68cd70eff5ca23c
SHA512 8213c8e84ff4e15c9e9940de88dbfb6af5544acbdc4e9db7a82225de98350625c15efcd41b4acacfec0bff40cf7e348340f5aa779a3c119b9200c2e67ec7e8a4
TLSH
T1685130E15C381AC1D0BD1A7EB0CB78EC81DCC725F5A0347E7C68EA984A7961D248483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 3daa74121f6a923b93354bc391df3300dd8f23f63aeffba74ef82a2c34fac363
MD5 83530a4974945d9ce09807c92c04cc6a
SHA1 75e5de04dafb725ecd8f959c42d0d1b781e96da7
SHA512 d72d7b075be7944ee4c3ce744bf037fb7199a3bd568ab672425b26a0913841c6802c6a284e042f590de36f13be8cac023f5ddd1cc02cf2fb4b8b57bc60e9a16a
TLSH
T19F5142E15C391AC1D0BD0A7FB0CB34EC85D8C725F5A4347E7C68EA98463961D248583F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6036_1090622092\manifest.json
Size 118B
SHA256 3c286bc18a9899fc2b55d3c55cd8331e6c64b853519149d854d42958b8209b87
MD5 af04c6b51c629f6364ecf578ae4b7127
SHA1 f9226903a59eb69191bc0c37db0c0f0a09c40c4a
SHA512 3aeab2a0269ebc7368d275ea57a7105bf90cbb2a68e7824c3a6d724eef426067c7478cef558d511116a900d13d406d3d92ac32c9fd859e83b95f8b17def8e031
TLSH
T16EB092B10C0AA47B26809720ECA0668283F80218E8065B1A088076881FD817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6036_127961110\data.txt
Size 145KB
SHA256 5f9da8ac4889421d2020e6246daa63b3d5d4fb5a19019b1c20fc803481f01484
MD5 b4802e5464604d772904c865a0d5e532
SHA1 77d577350787cc6d5fe65bdcb5e2a574f552fcf7
SHA512 05205448cf3424787f64bc99dd6b958ec497f1963a2d37a7fcac3cc9676b389e151ea456913c36358d07a92b6864557927fe0f53c37f890bb285a0e5446fd31f
SSDEEP 3072:UPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEgG5v7UFSk8KH99jo:4X1aI5aZoKzMJ07NJB7U58KPo
TLSH
T15CE3F220CDC45FD8DFAC252C90BE0B1DA391C69D842A7686E763FE4ABF9760452271CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6036_127961110\manifest.json
Size 52B
SHA256 90f59dd0f7cd3fb4906d133943819da7aaf33f7ae5b5a0241e03ddea2611885d
MD5 c86c55c53e2bf572642bd11d17a15dff
SHA1 dd16da5cbdc5519179a01396cb94f1194a814939
SHA512 a079421f077a5f2b822469efb6f4b1822e095beff27b2d1551c74d1d880c9fe085bc0f64ea040d17be2d2ad2969051e13f3a782e72bfa692752a16c3316fa49d
TLSH
T185900270042591172AC10E506570F8859391661955860D1D08551548029546CE4502D8
MD5 SHA1 SHA512 TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6036_2067551379\edge_checkout_page_validator.js
Size 1009KB
SHA256 9960614ae3d67b2a2b2b1bb1fdd6a427f4d103835e50e45f2e2cf3b1c540fa44
MD5 f4cf71ceaf44655238e8f6e445479361
SHA1 4d184496decd453261423d11a681bb925d1c466f
SHA512 c6af515da4c1eaa6689c829be6a99602f148090989c7f8b5aa5cd0620ca73d8b217ba266b188aa72bd219f863c86fb00d6e48758278346f5959f2c5169c1e382
SSDEEP 24576:cs4ymRAbsvvG3kJ6ARjiQixwaErn9VUfWEo0EQ1Xp8C9T0dK/vzHEiJsfaG81E9/:cs4ymRAgvvG3kJ6ARjiQixwaErn9VUfq
TLSH
T15F252B84E1E2253466D74CB960B7D2C4B5DC04583399F1E8FA6C68CADA0FD4723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6036_2067551379\manifest.json
Size 146B
SHA256 1d4f529025d274699f815657573b828ae880ae0d44ee0b0ce66a6a273f2bddff
MD5 94e3a47681712a13578f122b3158c015
SHA1 376442061baa7018ee9e784d991798fc9f302b31
SHA512 6974139805e18959c2ad2a71727705f1c5268ee598b8864833732e042beffe2416db033180b8d01bf8bb3b2b901d4ccbb090dd677ecded939aa3d07797ba05b2
TLSH
T12FC09B73C931AC71157507D449F59745EB74574BF511B1563730018D4B3D57550606D1
MD5 SHA1 SHA512 TLSH

Submit Download