hxxp://www[.]thecocreatorcoach[.]com

Analysis

user interaction
yes
max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/09/2026, 22:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://www.thecocreatorcoach.com
Sample260928-2n46csvglc

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3796	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{1BAE7FC2-88C9-4927-AEB3-7B47157826F5}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4148	msedge.exe
4148	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 4200	1572	msedge.exe	86
PID 1572 wrote to memory of 3796	1572	msedge.exe	87
PID 1572 wrote to memory of 1680	1572	msedge.exe	88
PID 1572 wrote to memory of 1680	1572	msedge.exe	88
PID 1572 wrote to memory of 2484	1572	msedge.exe	89
PID 1572 wrote to memory of 2484	1572	msedge.exe	89
PID 1572 wrote to memory of 2484	1572	msedge.exe	89
PID 1572 wrote to memory of 5064	1572	msedge.exe	90
PID 1572 wrote to memory of 5064	1572	msedge.exe	90
PID 1572 wrote to memory of 5064	1572	msedge.exe	90
PID 1572 wrote to memory of 5116	1572	msedge.exe	91
PID 1572 wrote to memory of 5116	1572	msedge.exe	91
PID 1572 wrote to memory of 5116	1572	msedge.exe	91
PID 1572 wrote to memory of 452	1572	msedge.exe	93
PID 1572 wrote to memory of 5068	1572	msedge.exe	94
PID 1572 wrote to memory of 452	1572	msedge.exe	93
PID 1572 wrote to memory of 452	1572	msedge.exe	93
PID 1572 wrote to memory of 5068	1572	msedge.exe	94
PID 1572 wrote to memory of 5068	1572	msedge.exe	94
PID 1572 wrote to memory of 1320	1572	msedge.exe	98
PID 1572 wrote to memory of 1320	1572	msedge.exe	98
PID 1572 wrote to memory of 1320	1572	msedge.exe	98
PID 1572 wrote to memory of 1660	1572	msedge.exe	105
PID 1572 wrote to memory of 3308	1572	msedge.exe	104
PID 1572 wrote to memory of 1660	1572	msedge.exe	105
PID 1572 wrote to memory of 3308	1572	msedge.exe	104
PID 1572 wrote to memory of 1876	1572	msedge.exe	108
PID 1572 wrote to memory of 4608	1572	msedge.exe	115
PID 1572 wrote to memory of 4740	1572	msedge.exe	116
PID 1572 wrote to memory of 4900	1572	msedge.exe	117
PID 1572 wrote to memory of 1716	1572	msedge.exe	125
PID 1572 wrote to memory of 1716	1572	msedge.exe	125
PID 1572 wrote to memory of 4148	1572	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.thecocreatorcoach.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ff9418dc188,0x7ff9418dc194,0x7ff9418dc1a0
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,11518567115444825233,13941949824854252455,524288 --field-trial-handle=2456,i,5643061802012634915,115775850559739033,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2260,i,3376442467415071711,314895477458291552,524288 --field-trial-handle=2456,i,5643061802012634915,115775850559739033,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:8
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,5851131649573699266,6955144023487249535,262144 --field-trial-handle=2456,i,5643061802012634915,115775850559739033,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:2
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,8280827899151168172,9716614339910194993,2097152 --field-trial-handle=2456,i,5643061802012634915,115775850559739033,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,8236958804751330718,17671736731259335621,2097152 --field-trial-handle=2456,i,5643061802012634915,115775850559739033,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,13926476517130689589,4836435299691691693,2097152 --field-trial-handle=2456,i,5643061802012634915,115775850559739033,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,3350130712160774159,10774748497789417005,2097152 --field-trial-handle=2456,i,5643061802012634915,115775850559739033,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:2
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4968,i,8301890405123527802,472679351876123796,2097152 --field-trial-handle=2456,i,5643061802012634915,115775850559739033,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3972,i,3207109167753541681,2045236522355890069,524288 --field-trial-handle=2456,i,5643061802012634915,115775850559739033,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:8
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,7667900571074177447,16201201886699992073,524288 --field-trial-handle=2456,i,5643061802012634915,115775850559739033,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:8
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,69953902689667688,11495199364540151150,524288 --field-trial-handle=2456,i,5643061802012634915,115775850559739033,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,69953902689667688,11495199364540151150,524288 --field-trial-handle=2456,i,5643061802012634915,115775850559739033,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4552,i,14074690301689700358,9661075735048788394,524288 --field-trial-handle=2456,i,5643061802012634915,115775850559739033,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:8
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,17217458471544510927,2812599666749131727,524288 --field-trial-handle=2456,i,5643061802012634915,115775850559739033,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4540,i,10906279651659979889,5299742240809087125,524288 --field-trial-handle=2456,i,5643061802012634915,115775850559739033,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:8
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,10906311783937061550,18225490149377741093,524288 --field-trial-handle=2456,i,5643061802012634915,115775850559739033,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:8
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6176,i,17438501386615365535,11663444712692364051,262144 --field-trial-handle=2456,i,5643061802012634915,115775850559739033,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4148

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c1d24032e322bda4aa4f943eeee5c1be2eee903b8fa00c6e40c3ae3aab1d6e57
MD5 cf18b86051311e5d4cb3435637b32441
SHA1 81808c10d3ea99d837ac73ca978bbac4af2b14c3
SHA512 d8f6d4f7cc0a9a322acccdf645cd0eaf7d236c68d82f2fd25c2d01e1e6ce323c3d584edd204b1c68ced260f3cf67a5be22a62de64511401735df9213129ac8f0
TLSH
T1EFD02B02FE898A6CD4921C34012E811D36CDF40049027041C0B023974C04701102CC64
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7ba460c9f5a00478279781ba3317975fb747ea7519f30b24bac67a94df77c22d
MD5 be02dc26a22f37196d8a2ed1f90604b5
SHA1 0d4f49e0f6b152530b0ff133dac678914194c470
SHA512 74fcddf19d34dc2b1dc8ec59c0f57f326e68c7c9b62fb89494b07e2bd52522d6f7662a05f91a2d0787fba43ac2646fc3214bc591a45f14862aa715bcd9206f88
TLSH
T1EBD02B02FEC98E6CD8921C34012D811D36CDF4004902B142C0B023974C05741102CC64
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d19b1550f3c3e198cbdd20250665639be9fb4b7930dc963b8a141b61d7dad5f3
MD5 ea05b3e40792199021f1cfb56e5b8342
SHA1 cd5686ff2f27cd6479c46fcbeab145040c8c8a91
SHA512 25fd20cfe20e3509a0d42b73598908143ef42a8a537c45fb5483b55206c8fc335de4467924d2e6a01168535b86bbe4ad09e23e15ebf1c5415793e3f6162db703
TLSH
T14261C5B818A72061DB7EDF72A3C921ABF23063F177437E83A2AAC4B46B2B3455105554
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591469.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591469.TMP
Size 3KB
SHA256 5bcd4327fd69927123d135e20847738bb1db196395dcfe2dedffb025c6c73189
MD5 57e0baaec63a6065731f87fac7b14d22
SHA1 ce9324f8badb6ffa1346689e28cb6fb9136b6f91
SHA512 2d4842cc42e975c16ab61f3c780ed6435f1e5d13107f2d7065b508b6e3923089a358dabb2c02b741c58bf27c6ac035d808a1e88e3abeaae37e4ec5160c7cfdb7
TLSH
T1D15192B908AB6451D77EEF7093DD22ABF63097F177937D03A6AAC574A7373009145044
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 8566a1efbb7449564e5e984d472dfc0509121447375857581f191cc55019e989
MD5 1cae910e60b051679fccd91f04b27e7b
SHA1 ac1f27eb7dfdd08feeb80ab0c7831f31a9648e78
SHA512 05e85a60acf3c1d049cf5487b6d2c33d44b1ebfcd877b514839da15f7439af8f9be0ea6a28a27af0478c3769461f6548708d6ef306f26dc3d77e46dd152b8658
TLSH
T150117DF3C7E595AE890116F05A24AE1BCE1D0506421C7C1A99D4EF3B97E3075E00299F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 eebf87a36249a9aaccca9ae6b49eaf319dfeb5cfa36ffaa5206024d7425db04e
MD5 e1d4117ebcefff73ba009e1496a1698e
SHA1 234fbba01012aa38aed1cc6a85e025f0c3fdcd92
SHA512 1f55f441a92ac5154e81219423414c67d48a55de128c73c67ae60775af4c72803e32157abe2656e394bc5940b2b372da557ceb67a3559548571a998ccc9254f5
SSDEEP 192:sxZ2kR9W9/fisjQdGIdp34HW6+WNRog/YYBg4FmIgrJ:sxZ2kW9/fisjQdnoHbh/fJw9
TLSH
T122229852AE38B57B8CC7D20DBB25BF23D6F9503251901E58EAFC862C05E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 5e96bb464418119c84de01fb77eee4eb471587a682a84eedf6acabb464266cea
MD5 ebe369e7a63597a5efca7cecd8cf3930
SHA1 315002dd9f739abb5e0283ebddb34fbf1c6fe434
SHA512 e97bd3e85c8c3b3fa25e8f266f1d086e08ffe7546139bc9b1d3ae7bbf8a77e85bfaaf16ab897a823e890c89c407283b5c44c4a24f07765f463247b023df93e02
SSDEEP 192:sxZ2kR9W9/fisBUdGIdp94HW6+WNRxV4xYYBE4FmIg5GJ:sxZ2kW9/fisBUdnyHb14xfNws
TLSH
T1AD229852AE38697B8CC7E21DBB25BF13E6F9503251911E48AAFC862C05E76CD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 566ddbaf5e991e82b8fd7bb705dcd959361f92b3b66e14c9e57d954a85f38972
MD5 abf2837d5ea56463d0c4fb1b86a1c87b
SHA1 aa5562754d59d761193c1459aa4547a83f8a607b
SHA512 e22e3f8d9b7aa94500dae089a28767aef5be81693e075c768608b5100b4f6708e9bfb4f87bd8dba33a3ab23e5315225a2a3b6d46fb21cb33c09fe4df2d47879d
SSDEEP 192:sxZ2kR9W9/fisBUdGIdp34HW6+WNRhFZYYB24FmIg5GJ:sxZ2kW9/fisBUdnoHbRZfnws
TLSH
T17E229951AE38797B8CC7D21DBB25BF13E6F9503251951E48A6FC862C05E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 a6a65ca90aa33dfea17be175ba986330b2f8aebc848d564178dd45938644dd04
MD5 e9aa399b54f3332ca521eb888eeebd33
SHA1 8f77a204fa1706950040396a901d11ea9b4c733d
SHA512 af15c034233306b579bdfff3cb9facf94c51cbbf58434214654ec18d76f1c03e8cde27dcdc238e14d9d1d669c0a8f57d583b01d924dc9d154dfa86ac886f1f05
SSDEEP 192:sxZ2kR9W9/fisBQdGIdp34HW6+WNR66XYYBC4FmIg5kJ:sxZ2kW9/fisBQdnoHb1Xfzw+
TLSH
T17222A852AE38757B8CC7D21DBB25BF53D6F9503151901E58EAFC862C09E66CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 24072a07b706fb36faa632b442db896291c6fd54e7903ce28c6a6f1506717f21
MD5 66e48e1edba50ec62a6fe20595b284ec
SHA1 b1ac6b60fceba95aa4cc95ddbee3d0429b048fcb
SHA512 258ae1e6c50639e9c5eb1fe9effe3712626d02e0dd2c3cdc6fee18326061997117819f0ae91786f2765bf112431ebb19bbe84a60c0e2713c5c55b34866c45732
SSDEEP 768:P4yYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvX0ropUlq:P4yYR7jWv3NpBu1ja/CL8OXfP
TLSH
T1A5C2E93B640DCB7E4FC01A9DDC5A6F9B7E9802C7A6548D4047FA944C02C77EE912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 83fd1c7e7399560fe15d4e9196217d0c2160dc1ea2b6dfaafa56238208b310c6
MD5 2418d69997cac3f250aba1d474161533
SHA1 a94d7b1a6b342ad2419b71df530f5e95427e4356
SHA512 0e56ddf0c6623446f721ef347582b45a1f5b230474a8c02390a547037a22f30e59b8788df6a74b35c91a426eff7eda108fdd403d0741fe1143f4c65171275a31
SSDEEP 48:KgvSbvRxRqbpkZIS/qK9f1VqxP6YcdfDyLVUplXD34brOrIS94K9d1P4x9oYePls:KAkgKdaOiKMK7KkCEKTqKOJqKiIC
TLSH
T195C1FE5036BB165178BD299885B68B1F124132B73119E63BBFBC11B19E7EE040DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe598d61.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe598d61.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 fc2a0376c2f8d875fe71554cde4b869a5996abeb2272e351c6764843b0ee4ffa
MD5 d268fe1443ec3ee091f9c78ee0f8547a
SHA1 c7f47b809fe527d0204892c2f33c28602c17c39f
SHA512 471deda1959004095eb1eba54dbc50b8a71fc62278c7f0154ce9837cf68d9dc17c790fab6e6ca00c5a964ba0292129e8bb11dfc27e679098daeb40f0e220e475
SSDEEP 384:tZcIhsNfUSIyKbig/aQX5+DtH80gXmV0vtgOIwZOy7LRoQ:1hGVFmzpkD9Qi0vXsYNT
TLSH
T12A828E32ECB8AC775DF75545B48632135FF8942BD6C86B80DAFD673C00A96A9030A927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 63f410ebdcc309ac6dce7c883d5898429faa0b4207cfb8bd4c7298d77e1173b1
MD5 819b6ddc75f68f9160365c7bcbee7e0b
SHA1 4dc911e6e90a1be46b93c348ef5a7348273d6021
SHA512 dd3e517fbf4358c79210fbf573431488b23c87d9e8274868c188ddd2d1592aa3bfd5ffd9cf572e3f4a74f723630a0452989cab7215aff762d3a493f0c27d90d9
SSDEEP 384:xiFiZcIFzsNfc8TUNTUlIlXIyKbig/aQX5+DtH80gXmH0vtgOIwZOy7LRoQ:YFQ9GcwgxFmbpkD9Qe0vXsYNT
TLSH
T184C23AF298E7987ADDEE4743B77D2D024EBCC057B584A690B798562CCC5A1BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b854571c0b866502d9a3966478f5895087a7582d26658de517f203098fdac210
MD5 fd438200b1674504eb51ae9bf94005ee
SHA1 36bc4f6e14de12c82b9f657976b697b0639b0f68
SHA512 280b173fa5d0dedc8e5bb31f566743130d3fe449f5ed42b159dfd8dcad6d1fcdf279cd494a98661df5becf76e713a1087941f2eb47f2350aee07f25586c1469f
SSDEEP 384:VZcIhsNfUXIyKbig/aQX5+DtH80gXmV0vtgOIwZOy7LRoQ:thGyFmzpkD9Qi0vXsYNT
TLSH
T109829E32ECB8AC775CF75145B58632135FF8942BD6C86B80DAFD673C00E96A9030A927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 222e5bab05c0eabf0c13337e3d5eb843cabbb418c0f027f3af9ca515e91cfbe6
MD5 606f6c3a5d4cb110f66be08c041883f9
SHA1 66ffce6b85573e35d275e417dbbac4a49abf87b3
SHA512 6501de712f33d5897682a6bfcdeb810925005c49a3677526df05d414d9ba6d8d2cb7a06d775f0667211e971e9ef4adf2d11d1ef90c7d5d4e3ee5f46bf8425f3d
SSDEEP 192:EONI6nnHGQmiUyqsQYcX5hQDP1fjzorLoaMc5RU6:EONI6nCCQNX5+DtH80CfU6
TLSH
T18102DA34ACB87CBB8EF76D45748632239FA4212BE5952B80D6FC5A1C00DB65C2306927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c87d50beee1f0793af1c5f5011515d94de7c64955ee83f2b43c02ecb75f5fd8a
MD5 23ce7b16a9f627ad333d968219aaae94
SHA1 72fc3a8042917de2eb548e10b9db91fe069545dd
SHA512 52bace435e6dc84b65e25812bebedc8a381e8a1e2de72918f499520e34c26685f5a0989e85d741a6e389f44366fd703fb83e14c33f62ec1e746464095b1dcc53
SSDEEP 192:EON7h6nnHYQmiUy5sGYcX5hQDP1fjzorLogXXbKkg33q5vU6:EON7h6nY7GNX5+DtH80gXmP0vU6
TLSH
T1FD121B31F8B8EC674EE26595748731135EE5512BE6897FC0DAFC1A3C01EE6AC130A823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecfe4a53-5536-4a71-b5db-5028f75871e5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ecfe4a53-5536-4a71-b5db-5028f75871e5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a7c41df876cb1dd748269e7aaaf2d38215511972f35cbc8935bb535ac3ee819e
MD5 ab4c2b258e574c821a610d55d7db7ca2
SHA1 f3dfeb120fe25ef82464a384c59b525694f9ce63
SHA512 fd35b371ebb6651007bf3ab0235e27239d252336637c08f79df04d33bd45adb1f18bf73ab8710b26a01dc1e189e178877ce78cd0a572af81948826c7a9e1b2df
TLSH
T12C413959B6F9110CB3B36F1A9FF6A86D887BB8732E06C45E00010D4F0A62B00C962737
MD5 SHA1 SHA512 TLSH

Submit Download