hxxps://pickupcoffeegift[.]com/pivwXc5Sq7X/c4r8a6trkvfytDLhONJj2e5313?ptf=ms

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/07/2026, 09:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://pickupcoffeegift.com/pivwXc5Sq7X/c4r8a6trkvfytDLhONJj2e5313?ptf=ms
Sample260723-lcjsaavdme

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1524	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292722087267783"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{3A9FD0DB-5B80-42B3-A928-F4CD396A4EB0}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2552	msedge.exe
2552	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 4000	4992	msedge.exe	87
PID 4992 wrote to memory of 1780	4992	msedge.exe	88
PID 4992 wrote to memory of 1524	4992	msedge.exe	89
PID 4992 wrote to memory of 1780	4992	msedge.exe	88
PID 4992 wrote to memory of 1780	4992	msedge.exe	88
PID 4992 wrote to memory of 3456	4992	msedge.exe	90
PID 4992 wrote to memory of 3456	4992	msedge.exe	90
PID 4992 wrote to memory of 4480	4992	msedge.exe	91
PID 4992 wrote to memory of 4480	4992	msedge.exe	91
PID 4992 wrote to memory of 4480	4992	msedge.exe	91
PID 4992 wrote to memory of 4392	4992	msedge.exe	92
PID 4992 wrote to memory of 4392	4992	msedge.exe	92
PID 4992 wrote to memory of 4392	4992	msedge.exe	92
PID 4992 wrote to memory of 2452	4992	msedge.exe	93
PID 4992 wrote to memory of 1744	4992	msedge.exe	94
PID 4992 wrote to memory of 2452	4992	msedge.exe	93
PID 4992 wrote to memory of 2452	4992	msedge.exe	93
PID 4992 wrote to memory of 1744	4992	msedge.exe	94
PID 4992 wrote to memory of 1744	4992	msedge.exe	94
PID 4992 wrote to memory of 3876	4992	msedge.exe	99
PID 4992 wrote to memory of 1968	4992	msedge.exe	100
PID 4992 wrote to memory of 3876	4992	msedge.exe	99
PID 4992 wrote to memory of 1968	4992	msedge.exe	100
PID 4992 wrote to memory of 1464	4992	msedge.exe	102
PID 4992 wrote to memory of 2020	4992	msedge.exe	116
PID 4992 wrote to memory of 4052	4992	msedge.exe	117
PID 4992 wrote to memory of 4416	4992	msedge.exe	118
PID 4992 wrote to memory of 1592	4992	msedge.exe	121
PID 4992 wrote to memory of 1592	4992	msedge.exe	121
PID 4992 wrote to memory of 1176	4992	msedge.exe	122
PID 4992 wrote to memory of 1176	4992	msedge.exe	122
PID 4992 wrote to memory of 2552	4992	msedge.exe	123
PID 4992 wrote to memory of 3080	4992	msedge.exe	124
PID 4992 wrote to memory of 3080	4992	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://pickupcoffeegift.com/pivwXc5Sq7X/c4r8a6trkvfytDLhONJj2e5313?ptf=ms
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffccf63c188,0x7ffccf63c194,0x7ffccf63c1a0
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,371458092181271744,7798235993302184745,262144 --field-trial-handle=2312,i,12349586075472130198,3497397687592941605,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,2169283211796214353,8949626638889279993,524288 --field-trial-handle=2312,i,12349586075472130198,3497397687592941605,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,6479887600238997273,9458209905347805062,524288 --field-trial-handle=2312,i,12349586075472130198,3497397687592941605,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:8
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,15606896174926795983,14709684135056023403,2097152 --field-trial-handle=2312,i,12349586075472130198,3497397687592941605,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,4603837302086582801,3478809273689460485,2097152 --field-trial-handle=2312,i,12349586075472130198,3497397687592941605,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,4227455377544568475,2828714354553881624,2097152 --field-trial-handle=2312,i,12349586075472130198,3497397687592941605,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,846825322176867170,7595601980331319354,2097152 --field-trial-handle=2312,i,12349586075472130198,3497397687592941605,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,8094465843726170416,5165606912678054722,524288 --field-trial-handle=2312,i,12349586075472130198,3497397687592941605,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,9366803430125416905,9587860793021931011,524288 --field-trial-handle=2312,i,12349586075472130198,3497397687592941605,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,6356136833792694051,11224683235245150051,524288 --field-trial-handle=2312,i,12349586075472130198,3497397687592941605,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,6356136833792694051,11224683235245150051,524288 --field-trial-handle=2312,i,12349586075472130198,3497397687592941605,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,8441377484193251323,11073200510183773971,524288 --field-trial-handle=2312,i,12349586075472130198,3497397687592941605,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,16254464384127948174,15749517124994179563,524288 --field-trial-handle=2312,i,12349586075472130198,3497397687592941605,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:8
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,746310461129001269,1743417672534392958,524288 --field-trial-handle=2312,i,12349586075472130198,3497397687592941605,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:8
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,8711669353690247027,10429836141780886086,524288 --field-trial-handle=2312,i,12349586075472130198,3497397687592941605,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,14946374528090824104,14800027453341169666,524288 --field-trial-handle=2312,i,12349586075472130198,3497397687592941605,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6172,i,16897074894919609938,5638263056923388651,262144 --field-trial-handle=2312,i,12349586075472130198,3497397687592941605,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,15703705634144073199,13651670916189744684,524288 --field-trial-handle=2312,i,12349586075472130198,3497397687592941605,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  PID:3080

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 9f4e22c5361aa6aff09f6a92e01de71e6febee43c945b1c9b080c60e6048a7c2
MD5 993ec867532c838e8073c186d278c486
SHA1 c5b40638eeb0c18cee458bba09a08e417f81b760
SHA512 eb40a024d762cd454c991622cc0cc772f08e9ecc84020eb8d8dc60fe52e5d5126315e8e71942368a72231e88fbd5d77bd44444913aca9526f4f4712ab8542084
TLSH
T1A0E026C589CAC26EB244664743EC630CC290370A92C86D8A1B0C85A4B1424C0E7A6AA0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5623ddfad06f1fefb925d061699c7532c0e5fab3908679d17a2d40791cefe8e6
MD5 a4c2c76c66d7a1282f6cf33f41dd4705
SHA1 b43da60f530efbba96ace2f0034b6f238f6cab30
SHA512 13959f13fb4cde186bff3fe686854d28e69303fdeeeca6d7cd15dcebc3fe2dfa9ed6b8f80acdf7d42aa522d005fff0d0dc710ffb3d9097d5ed162bc9a502e282
TLSH
T16E71FAB50B00D4EDEB90317098D932927872CCEAF4874E4670735EB1F606F9489E61BD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d6afa31b57923d45167fe8806a22e16853c6bd28581ef6290cb021bde87e0059
MD5 7f50f7bf44c1394e0efe598cf9fe8b1c
SHA1 3d48f56c5c983a2a534333a9dda1d194d40ec785
SHA512 a3e08020d871834d39ea77283903baf48ea197034428555594cb96194d0e46e5ea1e297958a72e78a5c05fb712d6f9a25c843164c1567bc381c96cf6a6eeb834
TLSH
T11861A5350B10C4ECE79031B098D932927872DCEAF4875E4670B35EB1FA04F4189E61BD
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 8387e9d51a3f958a9a484f2d512b9ad330b14290e778d5ee41c1d9e2d668eb1b
MD5 03b2d1e926a531502da9d2642b7c8eef
SHA1 0f5294babeab7e22f169cb8003938bb02a06283c
SHA512 649f9176cd74fd4e98adbbb5e42577a174142b9981cb3dc79bfd0ed3608d72be43cba65705f0fe90d06deac226513027322b9154062bcd195e8bba81208160c4
TLSH
T121719DEAC3D94B1CD85227F1AA552D52CE690895836C3C46C4E8FF5BB3F14B0D38164E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 6194585d310395d46d0cf7fb8a34e4f24e22d6f26cac662eab898548b977c94b
MD5 08bf9f93965967a841eb8f1696d287ad
SHA1 3b320d0e66209ca010bdbaad54ddcd0673f25d31
SHA512 aefee956bf94f4c499d54862ce07e4d56454137bd5b844ec25234fa5e4e311af6d1e137e93f3d79672bd64c1ad58182cf4caf522262e76ba4fe49fe3e9ecaf5e
TLSH
T14D616BEAC3D94B1CC85627F1AA552E52CE690895876C3C46C4E8FF5BB3F14B0D381A4E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 ee333d460fef56bcb2c6807c1bc07d7688020226b6336fa5782df40e9a5a76e1
MD5 96f02eb36e4763d7a128616c1d445e4b
SHA1 f45bbace9b901fd96ef4c0bff8c36b1b60e1a6f0
SHA512 6f8e2c4ab7db889d47dad670e2f05b9a282a9e8bf8c806a7afcc299f60e1ea3398915506fb353719b458cfa01a3bd2f86ded531afe64a5931f540d92e225287e
SSDEEP 192:sxZXlW6/fMsAfLVwIdpK9SHW6+WNJ0Y/YvZpdS+AIgrJ:sxZXM6/fMs+HGSHbN/qSp9
TLSH
T1722297566E24597B8CC7D21DBA25BF53D6FA5032A2D51E88AAFCC60C04E66CD120790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 e9b61aa5f9c1b714adced2b193ca7929bfa4346b87a56e3da87a7f05b8f6d7af
MD5 2dbb4a43cb49015cd75da6d9603bfd34
SHA1 aaa0531d2a1972bd690e534d82fa29afba8a009f
SHA512 92b7435d75682082a6cdb98293b39d2bd7214e27f26d80c89c32069cef24a8a8fd038b316c54e9b0a97ee9a02a685e3b5f4d623699188508a89854516f358c07
SSDEEP 192:sxZXlk6/fMsQE6HTVwIdpK9SHW6+WNJU7XYvrLdS+AIg5jJ:sxZXu6/fMsd6H/GSHbWXMSp3
TLSH
T13732C7166E3499778CCBD21DBA15BF53E6F95032A2D11E88AAFCC70C05E66CD230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 44897975297cd13f808a6560d220c988d820efaf29ea8c9dd492bc0772ffe2d7
MD5 b54c6fe07b40ad86e15db08e07b22bb9
SHA1 08406937251a1ea82896e6c43d0670876c45c0b6
SHA512 c4d7fec165b6cf7e531992ea3decb9b47d79ee00dd8d4fae81616b0ee3fcb15ca3a33a554e4ea2da1187e386ed8fcba19117384dcc493f468a5e8f4d97bfc1cb
SSDEEP 192:sxZXlW6/fMsQfLVwIdpK9SHW6+WNJ0Y/YvZpdS+AIg55J:sxZXM6/fMsuHGSHbN/qSpR
TLSH
T1DF22B7566E34597B8CC7D21DBA15BF53D6FA503292D51E88AAFC870C08E76CD120790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 fe2a55f0a8bf639bf9dc34a97b46804d5993e48e30cb56581d246120b77be8c9
MD5 60b3e137a27ce626313e53bd177ac986
SHA1 aed9f4f1145b036145a5244072997834267cbb9e
SHA512 7bd560d384d675a62490d579a6bdc85c72fb2bdd660c6e5cb79c54305df5e98565883db5d43ee70bd9be7fb7107bb78aa203dbbb33a5c8a818e1c35b9745a787
SSDEEP 768:bmee3rxWvhffn8F1+UoAYDCx9Tuqh0VfUC9xbog/OV4cLly0pbhrou:bmee3rxWvhffnu1jatcL88bau
TLSH
T1C6C2FB2B640CCB7E5FC00A9DDC5A6F977FA802C7A7548D4087FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 fc7367497535ee3a52324484a4b8ee3e22f65590c9eda26bc2b53c97e645a045
MD5 e3710ac4d43a754b09e769585a3ee12c
SHA1 6181262d9fecc247700b4acdc37d2a56255da861
SHA512 b4626c4d8ba81d62fec6a6774bd953bd0113b4ee4f2fcce548692d80f9f68d953d09ffcc913312957911f2f5d0b446e67588a579374bd8dcd68555425ab604b8
SSDEEP 48:KYHIhKggkXyFrI1KAUonyhziHD1RFARpETIwbAKjV7dAXrQe09o:KYH+Kggm+ruKAUyyQgKJux
TLSH
T135910516743A02022C3D3D8CB2A296760F4635937468A8EF7FB804625E67E524EFCCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

039146e0-8d38-4c7e-9cbd-648d407789c6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\039146e0-8d38-4c7e-9cbd-648d407789c6.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 c456e3fbc40bfcc6f37ce1863d7b1fdad8ac28b4577aedf4cebf3bbd4ebdc6f7
MD5 ff2ee26033dffcd12b8cd778e240f8e2
SHA1 d0c6a6edce9544d2a43f148e7eaca71bf9285ca8
SHA512 d81c43dd4d843cfe21f24b2f4d43aa6abbb2e4ba608a6bb8dde4166306d13421f0c4d3a15ce2576b179af8ffac12d7ea1331ef7383131bdb347e75287a5af154
SSDEEP 192:ujLsNEUUQG56NM7osUQmiU1wPCA4MTAn+FdLQx6ptFd3Ee8z14qFUMZ:0sNEUUB6O7lkSavkdcxMdUf7UMZ
TLSH
T165422C326C789C275DA3A156F54A3B035FF48167DAC42B94FAED6F1C01DA39C130A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 1d0f2bd69eaf31356cbb9fb6888968d19ff118e8efe1b72355754186ecb2df6d
MD5 8db37a154379b833077ae88b4386b3b4
SHA1 10846b163a9aead9cfc78af7f1d621fc8623ea71
SHA512 f99c0d8aeb492e0d20a73a4470fbc62f2427980f02fdbd2aa1705534d18c5f379e8fe83d66174777e861ba0553ff160d385378b378f147a768721c4e8ee82a85
SSDEEP 384:mhiFiZcIAzsNF8TUNTUlIlmB6O7lkSbvkdcxMdUP7gm:jFQcEwgu6O5bMnUP7gm
TLSH
T115B208F248D7883AE9AE5747A77D2E034EBCC067B584A690B7D85B0CCC961BFC306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 f9b5482cb0920f7c168e437c7a870805313bf74f07c0624c47a329d2b2a38de2
MD5 9f3f3badd95756771009cf482fc9c5f2
SHA1 d21a7a9166c4d59c74c8e739dd8fccd63cd2094e
SHA512 54e71402ad8006975a88c0f3e2c8ac5e96b37dea52a1438e406f5f4a75f05185cd240066e947519f9a7ba700af91922983593fbd152539c1bd4b3e63b8c27610
SSDEEP 192:uZYLsNEUJQG56NM7osUQmiU1wPCA4MTAn+FdLQx6ptFd3Ee8z14qFUPZ:OesNEUJB6O7lkSavkdcxMdUf7UPZ
TLSH
T117422B726C789C275DA3A156F54A3B035FF0816BDAC42F94FAED6F0C01DA39C130A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 02eeb51e8a01c0e8e93cccd9855abf6f6f7e8cdcc5eb3b7b769b775d03d64aad
MD5 302c553804bff93afebaf58d8d91d2a8
SHA1 df3b62cf9da836c8c79b6bdaf452dd8dd87fc459
SHA512 8c33b2a4f3db107745b6fb39423c6e214ea10a4a89a0ac887c2793b1341c79840a14a07d226cb2e0885e6766401dd792d76386686d97f9a64b154370c862005e
SSDEEP 192:uZYLsNEUkQG56NM7osUQmiU1wPCA4MTAn+FdLQx6ptFd3Ee8z14qFX1:OesNEUkB6O7lkSavkdcxMdUf7X1
TLSH
T132421B766C789C37ADA3A146F54A3A035FF4816BD6C42F94BAED6F0C01DA39C1306926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1f0598a46d24f25ba6a2b351b5c1b3ae6c6212e363ab276ff0cdccb59e5c7f7a
MD5 747ca24c523f69e042a9252c763d3a38
SHA1 f540d3548c3dc6bbb823762f200716d27226f202
SHA512 c90e1344dfe40f07f7143b501883733cdb1ff828a67c271e504f81a9fc6d18b8b01e4ca18d61b584e86d0af875a6a60e29ffc03aa171793104ad43c05c9f0ca3
SSDEEP 192:lONb6vMtPQmiUy0dThTAn+FdLQx6/847MMU/u:lONb6UtRhT7dcxExU/u
TLSH
T1D4020835AC786C7BEAB3AE46F48A37175FE4116FA9D01B54EAE82F1C00D725C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 491416e44363c195bc3c5783053360554aff33ccb4e48718fed895da87436571
MD5 3d44e19c368c6442b92374589d03d527
SHA1 8de3ec7d93d51c3e5d748c640bfdd30148d135b0
SHA512 e312723b3aaff30fce27d20ec072097faace8dfd39be2b24ecaf2863ad177326a756f61c3bc3eb71f2b6b06aee28fec5037486930212be0f7b7d8a7e3947bd0c
SSDEEP 192:TON+6vMOPQmiUyusdthTAn+FdLQx6ptFd3EZ80I4qFU/u:TON+6UORRyt7dcxMdUO7U/u
TLSH
T1F8122D36AC645C279EA37546F48A37075FF0916BDAC46B90FADD2F1C01DA69C1307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VariationsRuntimeSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsRuntimeSeedV1
Size 484B
SHA256 9fd2b7fae87c2d863b486a425834283f19b1444749c84650d5a48c9eadb12e2b
MD5 e9289cc1f579fdfa9d46acfae9b38330
SHA1 7eac8e241d8c35d873280d6b9dbc1cca7a9b2231
SHA512 b1f37da50e387c8408a960ef5276a51336510286c1db7eaea4cde65af4efc343f8ac1d9de65df1fd0818513823a485733e5c155da615344bc044f46021ecf586
TLSH
T134F0543C33D821A4F08C46B23596ED8B88BF313247DC2631CA50F550315387701B5095
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1
Size 584B
SHA256 74e0ed70bc099749dbc3dcae1cc5e21308153c5ab148f5dd3f479a33fff4143d
MD5 c96e17bb739fe65ff64d350cc940c289
SHA1 b805be090084f3e92b0eca2411efedeb11c36db6
SHA512 4967a314b95a2fee2358296089e1123fbeb46069ffc493f1b0294314ae3b336b99c7c198114349e2d0265380d6a5755ed3fb17b86af6a4af582eb796eba2eb48
TLSH
T13FF04131E010CB788536A2F341811E24A8D0229EC1E52279BC329B688D035CB6A92BAB
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 03566f4946afd4242588a0ecf7b01aaf85200c2db7fd60e246c24399cc1f4faf
MD5 2fd38a814d855d3cf0d12bda83b6fc1c
SHA1 4c375287c222da0d9735c645a5e2bd10a80c104f
SHA512 43440777ca55b5112df6430fc5e4aa33a2a7fecc05c2eb31862e884dfd224b3a3dad8c486a8fe196384b92729d42ea6a46567888ac88a4dbedab79b671a1b886
TLSH
T157412B58A6FA1148B3B76F5AABF6A86D487A7C772E05D45D10010D4F0A22F41C9B2733
MD5 SHA1 SHA512 TLSH

Submit Download