hxxps://cpfq[.]org/?form=intl_fundraiser_gaza

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/08/2026, 03:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cpfq.org/?form=intl_fundraiser_gaza
Sample260806-ecs8dsdj5y

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2428	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304617070697174"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2824035265-2271499813-2042964211-1000\{03370823-18F9-4FA9-896B-BCD89CFBEA16}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2824035265-2271499813-2042964211-1000\{116032C3-F7CE-4D80-ADFB-27D3B8FE5B61}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2064	msedge.exe
2064	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
680	Process not Found
680	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 3216	4396	msedge.exe	81
PID 4396 wrote to memory of 2428	4396	msedge.exe	82
PID 4396 wrote to memory of 1460	4396	msedge.exe	83
PID 4396 wrote to memory of 1460	4396	msedge.exe	83
PID 4396 wrote to memory of 1460	4396	msedge.exe	83
PID 4396 wrote to memory of 4120	4396	msedge.exe	86
PID 4396 wrote to memory of 4120	4396	msedge.exe	86
PID 4396 wrote to memory of 4956	4396	msedge.exe	87
PID 4396 wrote to memory of 4988	4396	msedge.exe	88
PID 4396 wrote to memory of 4956	4396	msedge.exe	87
PID 4396 wrote to memory of 4956	4396	msedge.exe	87
PID 4396 wrote to memory of 4988	4396	msedge.exe	88
PID 4396 wrote to memory of 4988	4396	msedge.exe	88
PID 4396 wrote to memory of 1532	4396	msedge.exe	89
PID 4396 wrote to memory of 4060	4396	msedge.exe	90
PID 4396 wrote to memory of 1532	4396	msedge.exe	89
PID 4396 wrote to memory of 1532	4396	msedge.exe	89
PID 4396 wrote to memory of 384	4396	msedge.exe	91
PID 4396 wrote to memory of 4060	4396	msedge.exe	90
PID 4396 wrote to memory of 4060	4396	msedge.exe	90
PID 4396 wrote to memory of 384	4396	msedge.exe	91
PID 4396 wrote to memory of 384	4396	msedge.exe	91
PID 4396 wrote to memory of 2972	4396	msedge.exe	92
PID 4396 wrote to memory of 2972	4396	msedge.exe	92
PID 4396 wrote to memory of 2972	4396	msedge.exe	92
PID 4396 wrote to memory of 5132	4396	msedge.exe	94
PID 4396 wrote to memory of 5152	4396	msedge.exe	95
PID 4396 wrote to memory of 5132	4396	msedge.exe	94
PID 4396 wrote to memory of 5152	4396	msedge.exe	95
PID 4396 wrote to memory of 4152	4396	msedge.exe	96
PID 4396 wrote to memory of 4152	4396	msedge.exe	96
PID 4396 wrote to memory of 4152	4396	msedge.exe	96
PID 4396 wrote to memory of 5568	4396	msedge.exe	97
PID 4396 wrote to memory of 664	4396	msedge.exe	98
PID 4396 wrote to memory of 5568	4396	msedge.exe	97
PID 4396 wrote to memory of 5568	4396	msedge.exe	97
PID 4396 wrote to memory of 4600	4396	msedge.exe	99
PID 4396 wrote to memory of 664	4396	msedge.exe	98
PID 4396 wrote to memory of 664	4396	msedge.exe	98
PID 4396 wrote to memory of 4600	4396	msedge.exe	99
PID 4396 wrote to memory of 4608	4396	msedge.exe	100
PID 4396 wrote to memory of 4608	4396	msedge.exe	100
PID 4396 wrote to memory of 4608	4396	msedge.exe	100
PID 4396 wrote to memory of 4656	4396	msedge.exe	101
PID 4396 wrote to memory of 4656	4396	msedge.exe	101
PID 4396 wrote to memory of 4656	4396	msedge.exe	101
PID 4396 wrote to memory of 2992	4396	msedge.exe	102
PID 4396 wrote to memory of 2992	4396	msedge.exe	102
PID 4396 wrote to memory of 2992	4396	msedge.exe	102
PID 4396 wrote to memory of 968	4396	msedge.exe	103
PID 4396 wrote to memory of 968	4396	msedge.exe	103
PID 4396 wrote to memory of 968	4396	msedge.exe	103
PID 4396 wrote to memory of 3336	4396	msedge.exe	104
PID 3336 wrote to memory of 3264	3336	msedge.exe	105
PID 4396 wrote to memory of 5512	4396	msedge.exe	106
PID 4396 wrote to memory of 5512	4396	msedge.exe	106
PID 4396 wrote to memory of 5512	4396	msedge.exe	106
PID 4396 wrote to memory of 5724	4396	msedge.exe	108
PID 4396 wrote to memory of 2448	4396	msedge.exe	109
PID 4396 wrote to memory of 2448	4396	msedge.exe	109
PID 4396 wrote to memory of 2448	4396	msedge.exe	109
PID 4396 wrote to memory of 4492	4396	msedge.exe	110
PID 4396 wrote to memory of 4492	4396	msedge.exe	110
PID 4396 wrote to memory of 4492	4396	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cpfq.org/?form=intl_fundraiser_gaza
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x258,0x7ffcbfbfc188,0x7ffcbfbfc194,0x7ffcbfbfc1a0
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,339697612919366913,5770142755247430546,524288 --field-trial-handle=1960,i,14014945466985703634,9379108353845049329,262144 --variations-seed-version --mojo-platform-channel-handle=1964 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1568,i,6712602244285631259,3011235053999989524,262144 --field-trial-handle=1960,i,14014945466985703634,9379108353845049329,262144 --variations-seed-version --mojo-platform-channel-handle=1948 /prefetch:2
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,10483573412487776959,8725762099762775293,524288 --field-trial-handle=1960,i,14014945466985703634,9379108353845049329,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:13
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,11855532646149109784,15769369680877273320,2097152 --field-trial-handle=1960,i,14014945466985703634,9379108353845049329,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,5710144369790624932,15069024348202397662,2097152 --field-trial-handle=1960,i,14014945466985703634,9379108353845049329,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,14814742426844585385,9656434112152617962,2097152 --field-trial-handle=1960,i,14014945466985703634,9379108353845049329,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,17189218975662855158,11925405136829311709,2097152 --field-trial-handle=1960,i,14014945466985703634,9379108353845049329,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:9
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4288,i,4008152350060295257,3649542839901114603,2097152 --field-trial-handle=1960,i,14014945466985703634,9379108353845049329,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:1
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4320,i,15423365657370429334,12932565620527222569,2097152 --field-trial-handle=1960,i,14014945466985703634,9379108353845049329,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:9
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,2331784325490264661,6753960272540999719,524288 --field-trial-handle=1960,i,14014945466985703634,9379108353845049329,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:14
  2⤵
  PID:5132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,10338305495504486956,10765202948935583858,524288 --field-trial-handle=1960,i,14014945466985703634,9379108353845049329,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:14
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5356,i,9850545530743640538,2695148776425378161,2097152 --field-trial-handle=1960,i,14014945466985703634,9379108353845049329,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5844,i,5031788113071250363,6832444771138964779,2097152 --field-trial-handle=1960,i,14014945466985703634,9379108353845049329,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5828,i,3054011903450256406,1919883329121221554,2097152 --field-trial-handle=1960,i,14014945466985703634,9379108353845049329,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,156209570878579452,9857200106873877402,524288 --field-trial-handle=1960,i,14014945466985703634,9379108353845049329,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:14
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6368,i,11704484849994260744,11356363250478722195,2097152 --field-trial-handle=1960,i,14014945466985703634,9379108353845049329,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6548,i,3446393450453680940,2004792581237910796,2097152 --field-trial-handle=1960,i,14014945466985703634,9379108353845049329,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6352,i,8937262856713777272,7606629810481612153,2097152 --field-trial-handle=1960,i,14014945466985703634,9379108353845049329,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6932,i,9415307712131946225,3650162119121591507,2097152 --field-trial-handle=1960,i,14014945466985703634,9379108353845049329,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7532,i,16954006401659334692,13680989295127256896,524288 --field-trial-handle=1960,i,14014945466985703634,9379108353845049329,262144 --variations-seed-version --mojo-platform-channel-handle=7512 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3336
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1140
    3⤵
    PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7820,i,54478626209477435,7748157231998650263,2097152 --field-trial-handle=1960,i,14014945466985703634,9379108353845049329,262144 --variations-seed-version --mojo-platform-channel-handle=7792 /prefetch:1
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,4336338064702780299,7516251603125202804,524288 --field-trial-handle=1960,i,14014945466985703634,9379108353845049329,262144 --variations-seed-version --mojo-platform-channel-handle=8144 /prefetch:14
  2⤵
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,4336338064702780299,7516251603125202804,524288 --field-trial-handle=1960,i,14014945466985703634,9379108353845049329,262144 --variations-seed-version --mojo-platform-channel-handle=8144 /prefetch:14
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=8260,i,83331052147458866,5447686567606133608,2097152 --field-trial-handle=1960,i,14014945466985703634,9379108353845049329,262144 --variations-seed-version --mojo-platform-channel-handle=8200 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=8088,i,2563001873703689342,764683161066944870,2097152 --field-trial-handle=1960,i,14014945466985703634,9379108353845049329,262144 --variations-seed-version --mojo-platform-channel-handle=7984 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4192,i,10861326804353030003,13203694588676502651,524288 --field-trial-handle=1960,i,14014945466985703634,9379108353845049329,262144 --variations-seed-version --mojo-platform-channel-handle=7680 /prefetch:14
  2⤵
  - Modifies registry class
  PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,15056895461043974967,12309111812726020130,524288 --field-trial-handle=1960,i,14014945466985703634,9379108353845049329,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:12
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,5749141115844220819,3662310262940905311,524288 --field-trial-handle=1960,i,14014945466985703634,9379108353845049329,262144 --variations-seed-version --mojo-platform-channel-handle=7616 /prefetch:14
  2⤵
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4276,i,8871026156528137836,4193182373512058067,524288 --field-trial-handle=1960,i,14014945466985703634,9379108353845049329,262144 --variations-seed-version --mojo-platform-channel-handle=7588 /prefetch:14
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,12088428747234995200,14599484219679036365,524288 --field-trial-handle=1960,i,14014945466985703634,9379108353845049329,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:14
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,7706371778529508023,703048429115795683,524288 --field-trial-handle=1960,i,14014945466985703634,9379108353845049329,262144 --variations-seed-version --mojo-platform-channel-handle=7604 /prefetch:14
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=568,i,5707074914538198205,9306389328545571370,262144 --field-trial-handle=1960,i,14014945466985703634,9379108353845049329,262144 --variations-seed-version --mojo-platform-channel-handle=7524 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2064

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 12e7cbb941c3023db4f822d1f2c98fb0cae07852284cb119a6496a1e413ee6a7
MD5 a74fd0ddefaee0626444fd4411e7730b
SHA1 4aa4e89cdd69b07ad1923a1b08a8faeabbbb0e9c
SHA512 ac7baf622680c4c54c4fd586e6b67ce23fdd94601e095e716107034cc30a8ed15991c47d07144f6775f968126b0a883f9b2b5a0cd9ec5a094dab6e6c634bc2e2
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7E:fwUQC5VwBIiElEd2K57P7E
TLSH
T1CAB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4945E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a4b35a6422c1c682176591bd42ebef96b0cb78607f98b3c5ee2c0e2d44e526da
MD5 63b4ddb137c55bd42461aacc1eb4cf83
SHA1 e41f99c448526208c80f1acecf1939a8e3f06728
SHA512 88b7f5970c19ff8d8362281bde3b29f3c7b018ff88c03d8ce082f66572704c79543ea528e6962172f18f1cdde2d1aaad0aca218b732ba8a673b844844d3ae585
TLSH
T125D080B23D4DB010D75B51F1F903D741121A857528536B33E694C54C5DB5CD813C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2e4c78c9d4b6915833ca44ba5f9b735c9d9e0bf49d6aa045c47aaaa63f1f9359
MD5 f7389aaad82eb86ca1896ff3c7af7a86
SHA1 a7833bad037b8c94d375310ccb5bf39c3f9df83c
SHA512 cdfd274480229d612566789a9d9cdf47643a9543e303957436e5121c790936878b1b7eb452100170489121bede724239183c48208033a8c70d6070e93b3f1226
TLSH
T1E5D080B23D4DB010D75B51F1F903D741121A85752853AB33E694C54C5DB5CD813C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000c0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c0
Size 214KB
SHA256 15f0f04ff04c426d68877665ee2c99ef7e253b1536e74226bfdc72533fbc19e6
MD5 f8830bd6e9b3ccda53731023c9e783af
SHA1 c023b8f5a8436b6cd9519e06d537c4258123b001
SHA512 9b5729177443acfc8eba682bfe50d694ddc46c99404e68290ea9d64df6e20352be21317e27f4eb3db5451e5cfac3927111cee2a50fbe746570d2084647453932
SSDEEP 6144:qYpDfrOzsnCHrVLYb2pkUZVdp1sX6CkMe:DawCHJW2pkUJk2
TLSH
T1962423E8E610CFFE6649939F44CFD6E843D51209AA1077FCE51EE17DA0A67E0A8D0B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 617a4f6bfe03d98d5fd7d2e98c3ac067802a435ff5d3533a33cae06bd554bad8
MD5 654f97fe640a6086f0a7672ace959eef
SHA1 dadd13d21aa7d74b9062e21da35d28bf85fd6cfc
SHA512 ad2ca646a303edf4c9626d0a7f6b119365a5f090abd1b7e8f82a7dd41100b40a9b7430b434374cde7b8262aef8f06bf72c961c930f3fbda5a1e6325906aaf3cb
SSDEEP 48:a3D6fLF2r0DGId60nqYOT/7XskiCY4kD7hCPkzuJyG3yWMUca5Ti45Toutt:a3SLF7i/kCT/7XdaD77uJNOUz5N5Th
TLSH
T1C1A1A52584A26374FB9B41336ED3DB6138F17AA6190B5EB671A3AF3534077B3D842390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58e70f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e70f.TMP
Size 3KB
SHA256 c24c45ae68b42cd021383bb7eea6532ca95efad75f8ec61a7597912494f177ee
MD5 0043d4445fff59b7b7370de88afb1fb6
SHA1 a65f332a9f9355e80c3cb54b3dcb2adfd6a9af34
SHA512 941b71ddf61567d4cb04354bf3b43a8e0345a146e9672ff0e85440d3b743563b48a3e5059e156015cd453b3a1a77648ce86e9625e19108e07a05c4b91d29a577
TLSH
T19D715C25896153B1F72F0233ADD31B1539F2BAAA190B2E7631A3AF367503B37D805780
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 5044b23475f62b6943c47a66afb1eea43a0b7abc7864d93c346fea0aa38818c9
MD5 dbddc58d7b9ef24c156671eb40253ffa
SHA1 481cd0c6831280e6cc5ce90a35202f2b60722f80
SHA512 1b29d909251794df49f3594d24bf2c6668e0cd990e3aca4eacab8eedd10dbe2eab80018af9d1b0e26a96308e98800332bb6f2166f1853c15f29e0571eb70b99f
SSDEEP 192:Dwy/9452s/UIJfisgbodAAnInkb4DVZnH3Ga8GOj44Gw6yJ+78JJiAEP5e7deJHm:Dwy/9452s/UIJfisgbodAAnInkb4DVZy
TLSH
T10A329DF3C7E8866E8A5192F1EB143F2BCE1C0579032C3D0685D8AE1BD7E14B2E25195E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 1227991905bc9f32d3531b733935769b09463f8cf73b5f3a5d424d7acb30ef38
MD5 f59f9a90118073e95fc55cb864bdb0c0
SHA1 5c2a0781ede3337c2827ee7c8fcc91b98d5a6924
SHA512 bfa6c1b7dbd6318fa96dcfc0edd85ae1753af5bf984d47e84569aceb3bebfea6de2a060b938169c61e19f0f13d9519a4eb6378a6c86f8b626e8b7eb33b7cad98
SSDEEP 192:sxZ/R2yM/jK1Ml8UQqFL/f5s5Dy6N3LAIxpqj/W6+WNuLbdY05k0d+IOIg54J:sxZ/YqQL/f5sdfN7Rk/bid5JMRC
TLSH
T1FF62D6066A34A977CCDBD20DB645BF53D6F9157392904E54AAFCDA1C00E6AED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 cf08651f497955c2fae6ef39276e4ce085b4f0c1f76a534134e8a3afbf431f46
MD5 1971fa1a1ee194897f1d34428c431efb
SHA1 03763869014d3c50cbce66ba1cc7f93591d18aed
SHA512 ff45db7fd74688a106a20076d64d1f4ebe18262a84f1badf4e5fb409731b4041d0f22ae851698c357371d9e61c3ebd12cdd34d19966e8289f64587d2d3f1ae07
SSDEEP 192:zZ/R2yM/jK1Ml8MFL/f5s5DF6N3L2Expoj/W6+WNuYv/Y05QVIOIgrJ:zZ/YdL/f5sd4N75m/bB/5IR9
TLSH
T10842E8066A346977CCDBD20DFA55BF53D6F8057392944E98AAFCD91C00E6AED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 eb8e2a3713fcc2dbf8eef189d74f66fe6d8f257963cec2925468955d567319c4
MD5 da78f577c8193236e870fceacb8359f4
SHA1 cbaf77af6cacd5ea3944428c5a4ac2c1c3ca1269
SHA512 74fe1be090bbfe25480af3b54644eadc0eb6be132a9260701ea555a892e862964d6e1a502f8fe380f5004179f45a07518c55c15f9de804b9e70dbb9101bcc5f1
SSDEEP 192:sxZ/R2yM/jK1Ml8MFL/f5s5DF6N3LAIxpoj/W6+WNujkVY05z0S9IOIg5SJ:sxZ/YdL/f5sd4N7Rm/bnV56yRY
TLSH
T1A052E7066A34A977CCDBC209BA55BF53D5F8057392904E54AAFCD91C04E6BED320382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 48f7305177f6820911202fcdac1782d82ee765166c831c9ad9e8fb8f61690c51
MD5 a9347aabb19c03402f0639aeca5e902d
SHA1 5416c9a45b59774d13799e12f5c3b8ba3cda0904
SHA512 68363ae444009031d7625529fd8bc9a0f555889c5be15096d7310ad0077b84199e6d0cd29b4ef5d04f97c33a7e1123d76a970e8ac80e2dc10f1d06bccfc637b0
SSDEEP 768:GJzXl8pZ221WRmsYQt08F1+UoAYDCx9Tuqh0VfUC9xbog/OV3u/Ll/df0hYcRroj:GJzXl8pZ221WRmsYQt0u1jaKu/Lpd8hE
TLSH
T1F7E21B3F244CCB7E4F844EADEC266F966ED802CB67584D5447FA884C03C67EB521A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4d6fabd12047dc9247baea7f6e7cf61839d4dfb2169b3e5190f928249ae0d4de
MD5 f1155881192df601859c62082a93ffa8
SHA1 06652a2415cc68edbd46a895c35e3af2ac36550d
SHA512 573f089c17a4ef4f5b4150d32309cb9bb0df99a27f0b48863e90ca0229496e91cea719af6baa3c0a5444c45865693f236d1b3930c01f9c4c1c5ba2214be71e3b
SSDEEP 24:KdUvfU2U9U0aUxdUlU1Ul4UxUN+UYIjURUlKiUChaUfUl1EUXU1SmUfMUa8UVUeb:KgtIFKGww3y56IvKjqoPfIpKQo83yhH
TLSH
T15191B35232BB13513C7E6A0C81D59A27164371A73018B43B7FE900B25E6AEA95EFDCCC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\8b84cb43-d917-4d60-b555-af8b3eb65e8c\index-dir\the-real-index
Size 72B
SHA256 534f1a334534d5a74e713b2a7b1a0a12efe2687f7cdf105ab55d8182a6bb827b
MD5 0ad29e07b24e435037e5d8299c9e7729
SHA1 3a4b2d2b7ed3917b181c14ab044a6a4eacf047a3
SHA512 4987cd30e2deae166bbc151b215fa38b0e4308ef3f0b4db8a7847a42d81b62e0d407a4f07415915cdfd900e15d9aeecd47c306fb54e03f6b33772408e771eca2
TLSH
T141A0026047C51055D0501AB450465BF23310DD50050617135490419D8C963CADD13026
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ee62.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\8b84cb43-d917-4d60-b555-af8b3eb65e8c\index-dir\the-real-index~RFe58ee62.TMP
Size 48B
SHA256 6525ce5abf662f0d9f3734d7c68d059f6ca7c5599b4b71b004702858b7f71ddd
MD5 de3f4d4b97288c3dd7e2bb8af6245fea
SHA1 ea7dc86cd2220228765f9fcaadc103aa59605019
SHA512 05051657241cf10bdff822bb572a3988a1034451daa99701f64a06e55004c495a7e424cbe6cc8d0290d8f9722cf6ed81fab30b2e81d58615c6b523f130318a55
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 88B
SHA256 6eda0117c21c0fd82c386843f4143a5dd8b94b44be300c318141653137897452
MD5 7c5e874a35a49423aa7ed60a7824a5e0
SHA1 0081f2554aaf55cfe0079cdb04b1e5dfae03d720
SHA512 5bf7e1feb43c3b6136981811a9b44d1247d9f8bb75f5244127265f9a8a7f9e35a250a6fd207383bf19c41b83d5dc36bc6ce3f974c02bb8322cd15d3072d40db0
TLSH
T196B002BB14C165C11EA134FB200536DDC52372CC6C80FB4C8471205532148AE2045D38
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58a12d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe58a12d.TMP
Size 175B
SHA256 ee52f30b7682dfeab1f4dc13b99f44d2addc4ebc1b0ee5b6a6784ac4b25b3dc2
MD5 8b9718d53979fc1b84ae8b192e743aaf
SHA1 b2faa247d7c57adcc7fcfd3e6e3b23279fd4dfb5
SHA512 c9d3a4891938486022ccb4fb3d188a0001ff38e9336b5690ecd69c7f67ea7eded57cd6e98332abd76ebc999062b98615ea9d87d29af62f081bc4999913e8ce1d
TLSH
T14FC0127724C152412E6568FB212532C5C6273EC99C80A64C482130856234C9A1401928
MD5 SHA1 SHA512 TLSH

Submit Download

4b602a4d-a809-4937-a5f4-d1e621699867.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\4b602a4d-a809-4937-a5f4-d1e621699867.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 50d2f2c29932ec7ccbcb2781261d66a311dd633f989f2c4b700f086bffe13f0a
MD5 cf35b70d570ae04d90bc06f9737f454d
SHA1 2e50d624faced4d5210ac2304f6090cec0ba4b5d
SHA512 36f5a472651658503e486540206ee11c1f433031f076064b88c837c45487460c7f9165d1dca0aab484ca80fde88ff204fddb5cdda75fe678bfc16812d6cec7eb
SSDEEP 192:uAL8Np4QBqWZNERDYQmiU17dfL7B4K/GPTHXRLrgPRVsAeqfk8cq:D8Np4NWnEyFdz7uK/Ar4tj9cq
TLSH
T1BC42493668B8AC3B5CE39559F54736239EB4506B9A882FA4D6DD2F1C01DF19C2307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 6db4ecf9c7f914fd9a8c437d6b246e299518d8d963cfabdddda98f676c8805a7
MD5 29bd6693b651e7067def19c303444b0f
SHA1 1b06da33310957a15092a4b397f9e1cb184a3a47
SHA512 ab41607beb71f3e28120f0be33f55e1593ba33d0f5865b3d855a38cde1b41ac5c5ba300951f2e7947a6521876323f08916aac57ff4f85b044449595ca711d670
SSDEEP 384:zZcIh8NpEqNWnEyFdt7uK/Ar4tjnTKwBODNZOCigs:rhld/AMtjnewBKZOos
TLSH
T14D928D716CB86C3B5DE2A519F90732175EB89173E6C42FA8D6EDBF1C00EA598130BC21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 f9f8c702251fb0f728cdfea75f01038e205ad529e6708b0572958d0c2274fbbb
MD5 5bb5003a9a446fe713a03c1fd69e8652
SHA1 d8576dc394a9423960d2ceb7bfbc47e0123db33c
SHA512 5d4ec7285d6d34f628fad5ad0a20272511eaf4ac6d3a01bec411866f3f725ff8138bbd5fa96315df5be53ab13378184f0932ef46e89b9baeb714e8649a094942
SSDEEP 384:cZcIh8NpLqNWnEyFdt7uK/Ar4tjnTKwBODNZOCigs:KhEd/AMtjnewBKZOos
TLSH
T173929D716CB86C7B5DE2A519F90736174EB89173E6C42FA8D6EDBF1C00EA198130BC21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 a0953dde2abf2a0b05e653f7e918935bdd1eb6321d50f9d20a49567d9552c5c0
MD5 3fdcf4ada75fcb13e023b5c6bf27f4ef
SHA1 ee31133a100f8fc1a7a3ebe8625771d49b8ef55c
SHA512 375c3bd17b742cb331311ceff634b653ae4606b1a51249e0fe95f67383c484c9248c7f0f2fb40658b5074710636834cba6b9453f76cd3d45bfa66954e2380207
SSDEEP 384:uiFiZcIH8NL8TUNTUlIlEqNWnEyFdt7uK/ArgZjnTKwBODNZOCigs:FFQHewgyd/AkZjnewBKZOos
TLSH
T131A28E725CA89C7BAEF69A49F90632178EF45173D6D46EA4E3DD7F1C00AA1C8130BC21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e6a1601a6f3f975ab6ea09916969d7798a9dc22a44dc2a2ac576c50884adebbe
MD5 7ffd754e61a43dd84eb1ee972881187e
SHA1 cc4d20d87ac5771d266f42bc4ae6d1d680a633c4
SHA512 e180b1152e91d887e26206146ee0e21a5f76ca8b03b75e9bccd8e97006725d1d1ad84e98a679c888b92352edbcb2883845625d380c69f41eaf70b6a79daa2fd0
SSDEEP 192:7GNv6fNNQmiUy7uzHSPL/GPTHXRL1V7q36U6:7GNv61L0uzyPL/A1UKU6
TLSH
T1BB020A34ACA87C7B8EE2AE59F58377175FA4117B9A951F44C6E82F0C00D769C2306C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a5e4c175da056f23e650a06e247bbef9c568cefcc5d42e220b0ca89704be77fe
MD5 4bef324c1348b7057e8521666b334127
SHA1 23da24aa97ce8ea70070fa6bf62c4d48fa58b5af
SHA512 69feb85f2f3096a236aa54695a850d28019ffcef48b4cead5c2fca529b5697e0af09e81bff8a45955c62ce1c4b12dcef7240b8058fb07de724278524dcb768f6
SSDEEP 192:MGNk6fNYeQmiUy7mSSuL/GPTHXRLrgPEV3ZeqfU6:MGNk6190mvuL/ArXLjU6
TLSH
T128121935A8A8BC3B5DD2A964F54336139EA05127DB896F95C6EC3F1C01EF59C230AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c5836758-559b-4251-ae4d-817dec0c385c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c5836758-559b-4251-ae4d-817dec0c385c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download