hxxps://tlckidstherap[.]com/coferconnelly/download[.]php

Analysis

user interaction
yes
max time kernel
148s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 14:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://tlckidstherap.com/coferconnelly/download.php
Sample260930-rtbe5asxaz

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4616	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{5BF3897A-6ED5-4F4D-9882-D6A549AB991E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2068	msedge.exe
2068	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 688	2468	msedge.exe	87
PID 2468 wrote to memory of 4264	2468	msedge.exe	88
PID 2468 wrote to memory of 4616	2468	msedge.exe	89
PID 2468 wrote to memory of 4264	2468	msedge.exe	88
PID 2468 wrote to memory of 4264	2468	msedge.exe	88
PID 2468 wrote to memory of 4184	2468	msedge.exe	90
PID 2468 wrote to memory of 4184	2468	msedge.exe	90
PID 2468 wrote to memory of 1280	2468	msedge.exe	92
PID 2468 wrote to memory of 1280	2468	msedge.exe	92
PID 2468 wrote to memory of 1280	2468	msedge.exe	92
PID 2468 wrote to memory of 4420	2468	msedge.exe	93
PID 2468 wrote to memory of 4420	2468	msedge.exe	93
PID 2468 wrote to memory of 4420	2468	msedge.exe	93
PID 2468 wrote to memory of 1320	2468	msedge.exe	94
PID 2468 wrote to memory of 1320	2468	msedge.exe	94
PID 2468 wrote to memory of 1320	2468	msedge.exe	94
PID 2468 wrote to memory of 4496	2468	msedge.exe	95
PID 2468 wrote to memory of 4496	2468	msedge.exe	95
PID 2468 wrote to memory of 4496	2468	msedge.exe	95
PID 2468 wrote to memory of 4960	2468	msedge.exe	99
PID 2468 wrote to memory of 4960	2468	msedge.exe	99
PID 2468 wrote to memory of 4960	2468	msedge.exe	99
PID 2468 wrote to memory of 2480	2468	msedge.exe	101
PID 2468 wrote to memory of 2480	2468	msedge.exe	101
PID 2468 wrote to memory of 2904	2468	msedge.exe	102
PID 2468 wrote to memory of 2904	2468	msedge.exe	102
PID 2468 wrote to memory of 3748	2468	msedge.exe	105
PID 2468 wrote to memory of 3580	2468	msedge.exe	116
PID 2468 wrote to memory of 1116	2468	msedge.exe	117
PID 2468 wrote to memory of 4108	2468	msedge.exe	118
PID 2468 wrote to memory of 5060	2468	msedge.exe	126
PID 2468 wrote to memory of 5060	2468	msedge.exe	126
PID 2468 wrote to memory of 2068	2468	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://tlckidstherap.com/coferconnelly/download.php
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff8c59ac188,0x7ff8c59ac194,0x7ff8c59ac1a0
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1892,i,2696183085544236906,651683820495976854,262144 --field-trial-handle=2248,i,12512813900267515872,17166592340037402821,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,11606039081879723194,4470479148800967190,524288 --field-trial-handle=2248,i,12512813900267515872,17166592340037402821,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2288,i,4888471633271523014,7419309858928226662,524288 --field-trial-handle=2248,i,12512813900267515872,17166592340037402821,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3392,i,2698027697949209225,8770073150904554719,2097152 --field-trial-handle=2248,i,12512813900267515872,17166592340037402821,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3396,i,12710187749606465400,15973375207490150531,2097152 --field-trial-handle=2248,i,12512813900267515872,17166592340037402821,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4164,i,6409256776145947582,5486965837730803860,2097152 --field-trial-handle=2248,i,12512813900267515872,17166592340037402821,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,2859958161035159498,4888809812273096252,2097152 --field-trial-handle=2248,i,12512813900267515872,17166592340037402821,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:2
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5076,i,17915133976187978245,7799966921064151361,2097152 --field-trial-handle=2248,i,12512813900267515872,17166592340037402821,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,4747926752720896490,8770765007483499017,524288 --field-trial-handle=2248,i,12512813900267515872,17166592340037402821,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,14098001137387757255,18062721785968800701,524288 --field-trial-handle=2248,i,12512813900267515872,17166592340037402821,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3468,i,5731250437046995426,8424505517023579247,524288 --field-trial-handle=2248,i,12512813900267515872,17166592340037402821,262144 --variations-seed-version --mojo-platform-channel-handle=3912 /prefetch:8
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3468,i,5731250437046995426,8424505517023579247,524288 --field-trial-handle=2248,i,12512813900267515872,17166592340037402821,262144 --variations-seed-version --mojo-platform-channel-handle=3912 /prefetch:8
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,7760710053771949361,4029718130140893913,524288 --field-trial-handle=2248,i,12512813900267515872,17166592340037402821,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:8
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,4435788997430939239,15976311722892245143,524288 --field-trial-handle=2248,i,12512813900267515872,17166592340037402821,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,13203429703171836397,1083467205678745780,524288 --field-trial-handle=2248,i,12512813900267515872,17166592340037402821,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:8
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,15781944323853604649,3121688075497942281,524288 --field-trial-handle=2248,i,12512813900267515872,17166592340037402821,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:8
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6116,i,6334169761522080395,10065924848649142789,262144 --field-trial-handle=2248,i,12512813900267515872,17166592340037402821,262144 --variations-seed-version --mojo-platform-channel-handle=720 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2068

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5421c8b0bf6e5f37422a05b412b233cde63f1db63aa71d65c91c5b31275595c0
MD5 07f616e3db8597d59ea940f94c1abb0b
SHA1 eedf28342bbff8c4cae798c2980ea6953992f1b2
SHA512 30782b7b7d8c6db47a40bc15f968f35fca7939aaa4b83a8a19c8f5a415c745b54c161abc0037d24bad8ebf15d5deb4134f24e357c1b5869f1598fa22619302be
TLSH
T163D0243C7F114D50D40041710530D50435D3CC1740D015050C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 daf8c1243ee20a2e95a6bd65ee87f94e97a213f1bc26473da181514314bf0e5e
MD5 22b29b46992ba3d1fd586e35207b402b
SHA1 03a007676fa49e6e9fbeffbbc2e943124c1b3d3d
SHA512 3634d483353d2e9fb49d846c71c6867053c6a8f1ead10608addea75574d5ce0e36c8de933f71d10bae9682752372e6f7925bbc3c9d982dfe840a9d664f859687
TLSH
T1BDD0243C3F514D50DC0041710530D50435D3CC1740D017070C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0f832ed49c46ac4c97d5b0d61c87a391363e143b296f2a557633ac49bbf38408
MD5 8afe1436fcb74cfcf04330328dc41228
SHA1 7635e071c3857a86a88227eda2b140f00153dc5a
SHA512 0f41ea9beac2c77d33650eb926371b1e5a448cce9266b02a2134fdb9d7d6eaf93d5576110a8094625c6bc09ad7176b5ed048b8a8943a834e1f0d69a615afa39c
TLSH
T18D6173841684C1EFFF6BF8B0B5D62387F9348E9275D3ED51167CD4B8589AB505038850
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a8be.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a8be.TMP
Size 3KB
SHA256 efc88d3f2774b77d646a7c2bee362aee55887ae00354be2332aa3eac326d8c83
MD5 c818b9d42271a09d71fa004c63d920a8
SHA1 c4fc3b6d86fa40a0d0e7e798ddd66881e422cad1
SHA512 38ff1b89626459d4dd1a5f87c4b105b3f38053c6b09740b1a9ef6272d64bd7078b9f501ac2ff34a8574e02b61fa30b364df2490932a04ab8d3ee965179be606e
TLSH
T1A06173885684C1EFFF6BF8B0B6E62387F9354E93B5D3ED5215BCD8B8189AB505038850
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 58d22dcc1659674bfd016eb19406d54cc3428aceb6ba33dc77428a0fa0c0d691
MD5 6907ab1de25aa5d7d7877e3abcb4423c
SHA1 ae53eca694d458a59fab45b846fc9462eb62046a
SHA512 f291bc166f66ad59b4e7883bcfcae3eafc272b924639db9ceb554e41ea8d4b2ea255ca7ac3a6e7dc1413140134d52fe8519a2b759f44c372e2ea49c211594413
TLSH
T1CC319CF3C3E0866D8D1116F09A28AE6BCE5D0559431C3C6AC9D4AF5B93E3871E14164B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 a0d224408d620936b173e3a8cb1f8772f0d07fddc2aa77cc219d03b984903c9e
MD5 3848d3a606855287419846548b7176b1
SHA1 3bd0bb2c06f179dc750db4ebcb7d6dc618c3f238
SHA512 cc319b79ad24d9bae6e5906c9485dd138c61a2aee356931bc4e3539f932edaac52c8651716d7bd08a96400d86e562e8e9bd50cde897f75b38445e86cf20dab09
SSDEEP 192:sxZ2RRQW1/fNXs6NvWIdpeelHW6+WNpzuL/Y33LsIgrJ:sxZ2f1/fFsgvXTHb6/L9
TLSH
T12522B7526E74A97B8CC6D21DBB15BF53E6F9503291D01E48AAFC891C05E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 e09665fd2ae07a2676b63baa3aa604905597550eb46e7603457313648046e707
MD5 4b863cd3800726500a07cc428dbbbece
SHA1 d0c6725fa7e1ca37f2aa47a2ed03e18a028aeeeb
SHA512 9d61e31636eae64f9ee757468d4773233d864ff2966870ca8149d9d71a71ad8cad9a88fb44c00e82bd82e0a4947a5a02d2ebf3ca32f068b57dd8701b45f16152
SSDEEP 192:sxZ2RRQW1/fNXspNvWIdpeelHW6+WNpzuL/Y38FLsIg5zJ:sxZ2f1/fFsnvXTHb6/buP
TLSH
T18022B7526E74697B8CC6D21DBB15BF53E6F9503291D11E88AAFC8A1C05E7ACD2207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 6e72479d86d387e279d29f77629658617d1597a5e349c7a6e6f94e8c370bf719
MD5 5e6f37a7ee8e9b62cffc80abcb1597e1
SHA1 dd99a0368e4989886cfe7d40b56b764c07091a77
SHA512 1024cb1a073575d264f5735308622204deaae68c99912fdabdfd8f5d0eaa9e8ea87ab5e4c8ad2ef712d77531edca92e92737343dd7d5bc2f28618f5e7f2f99bf
SSDEEP 192:sxZ2RRQW1/fNXspNvWIdpQelHW6+WNpzuL/Y38PLsIg5zJ:sxZ2f1/fFsnvXFHb6/bMP
TLSH
T10A32B8526E7469778CC7D21DBB15BF63E6F9507291D01E88A6FC8A1C05E7ACD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 603b5f5083b04790501c5d2c4298e96b032a64ad5cd987e3d947338bbbafe133
MD5 d8df8e4ae531744625bda4cfeae2224b
SHA1 43fccc889905dc80f439a1f1e713a871ef692365
SHA512 fae67f294dce12daa7aff6007b0a34574906557f83e86ed5ccc0286bddd6e8b79720ca5d26a3e4a59d60efcfc5e30b6b31b9611d71cbabdf849d07feb6cbe4d4
SSDEEP 192:sxZ2RRQW1/fNXsINvWIdpeelHW6+WNpzuL/Y33LsIg5JJ:sxZ2f1/fFsGvXTHb6/L5
TLSH
T1BF22B7526E74A97B8CC6D21DBB15BF53D6F9503291D01E88AAFC8A1C05E76DD2207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 acfe8aff98b1d271787be922636221e85d556767351d03b8e7ce9c7ac7e5f19e
MD5 c06ad723b3016895de025210185d0e8e
SHA1 55fef628b88ede1980cbc2ea683ae3defee2f4ce
SHA512 2d0f30e3318e9b4fb66cf61736b7186943dab595489c1efe5730451b3cf626420eeba106af74e64c85ae83e8731caf5f0ab7b5a9745eb578873c3391ed7141ee
SSDEEP 768:mGP30AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72GCrolZMD:mGP30AbSWvS2l9u1jaLmLZ12GZI
TLSH
T146C2DA3B640CCB7E4FC01A9DDC6AAF9B6E9C02C796548D8447FA984C02C77EA91174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe593ce0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe593ce0.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 bdd385ed69e4292dcd085d3fdc2a5073fab87227850291e81887685e741aab37
MD5 34b09fd07b16adbfcd525f02b27870ba
SHA1 b7822c8a0b057281eae259a3981e166e81df04c9
SHA512 ea250d3191717b74c2b5eb63dc5e2a8d53b3fe5711e412c8a902b1c189f0e2971a0db77e8c367dec76a8bbe701e8c9928f00dcab34fb09afc9142f7ba5a9fd21
SSDEEP 384:CZcIhsNk4ZkipuyZdu9iX5FX8E3OzXdJrbutgOIwZOyLLxoN:whOkiv8apEdhbuXsQlC
TLSH
T132827D33AD785CBB5DE6A144F14A32135FB88167E7C8AF94D9EC5B2D01DA298030AD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 4027e84235d7b7954dd648d5b5bec6368b8090f1c36ab971db2630542239c1c9
MD5 1a831ec6e9ec73ca58ffabca1e3b83d7
SHA1 bbb2bc529422473960f4433c952ac47a844d2df9
SHA512 719014f0f709dbfac116efc431116ce9581a9592df2112f411bdea675a9ba89d5ae096983313ae1e3e322cd91e819722fa9d7450a95cdbc0b0d5e8e613db76e8
SSDEEP 384:4ZcIhsNkxZkipuyZdu9iX5FX8E3OzXdJrbutgOIwZOyLLxoN:GhPkiv8apEdhbuXsQlC
TLSH
T1AE827D33AD785CBB5DE6E544F14A32139FB48127E7C86F94D9EC5B2D01DA298030AD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 a484116e060631fb5032a57366df9683a3499f06919232db4449f948cf45942c
MD5 cf9b448bc363c0445a148ca48468539d
SHA1 b921249ea2be176c68694c14bf3c244bb606298b
SHA512 d70f97b2eaacc58dfbf1671f6c99a39afd4e33bc5e7b9d241c656ec32812f43758f39084ec1dde059ee8f264eb934d9ca55c9b9a4eaab084aa9e3814cc8cd97f
SSDEEP 384:ViFiZcIEzsNs8TUNTUlIlxZkipuygdu9iX5FX8E3OzXdJrkutgOIwZOyLLxoN:cFQ4Rwglki68apEdhkuXsQlC
TLSH
T133C23BF348E7887AD9AE9747A37D2D024E7CC067F5849A54B7985A1CCC961BFC30AC11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f8730a897eabd78c68a2684b08bfc6277fa2519e8b814b208f8189f81cefc881
MD5 5535db30203e518202e3805a9fef990b
SHA1 e9c4d85680bb6a1f121d728d471ba67abaa5ff5e
SHA512 74f7c6bd7634d600d559f0d5efa7047b93908593493e254d257dbc4366893a2d0c5c8ea1e7d3b351e0aca3b751ee83ac8b7f1ceb78ed59c05683a90f314d7cc0
SSDEEP 192:LONU6AmwprQmiUyF06siX5FPjzorE3O+JioBU6:LONU6ipdR6siX5FX8E3OrUU6
TLSH
T11902EA35BD786C7F8AF2AE45B54737239FA5116BEA942F84CAE81B2C01D765C1306833
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 59ee1b1d3b1e5d9923f3bb88c0b0cd43d0880e6ecdeb3189db1e944bf5e9d61d
MD5 4ca25988b4b14631d7a04de36e2b7b67
SHA1 b975b0dfe02c801952ef5a93ed5d495e46af8dc9
SHA512 bff2eb7386c673466b60f34546429c5bb9b16bd018afacbd81b8446d1f08940e3d7004d9a688a55d952f3e5a9efe0601b3e048f0d885b035da227a6795a71f8c
SSDEEP 192:LONN6AmwpiQmiUyt0IsiX5FPjzorE3OzXCSJralRFqnU6:LONN6ipe/IsiX5FX8E3OzXdJrouU6
TLSH
T18C120B36B978AC7F1ED2A555B04B31139EA54127EB887F94C9EC1F2C01DB698530AD32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7b92639556429fd568158484094fd580999da47411e30aef22a104d46d141d0b
MD5 e85c21b0fa0e8d4d8b16938bd8a31315
SHA1 edc42978ef0855459bdff8f2c241d3e8e9c225f7
SHA512 3294bf71b777494cb031ef70c6b397904053507630502cdf87ea670379a008bb1fdf332fd4f42cb5a9db544c9bafe0e944032572033897c9ca38212685f4842e
TLSH
T17B412A5CAAE91144F7B36E5AABF6786E887B79372E07C06D00110E4F0627A01C871B37
MD5 SHA1 SHA512 TLSH

Submit Download