hxxps://tlckidstherap[.]com/coferconnelly/download[.]php

Analysis

max time kernel
148s
max time network
143s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
30/09/2026, 14:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://tlckidstherap.com/coferconnelly/download.php
Sample260930-rtbe5asxaz

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1704	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3202520547-175870679-441661622-1000\{7102C95E-45AC-4E87-B072-5BBAF0A5D3E1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4748	msedge.exe
4748	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3100 wrote to memory of 4888	3100	msedge.exe	83
PID 3100 wrote to memory of 1704	3100	msedge.exe	84
PID 3100 wrote to memory of 2968	3100	msedge.exe	85
PID 3100 wrote to memory of 2968	3100	msedge.exe	85
PID 3100 wrote to memory of 2968	3100	msedge.exe	85
PID 3100 wrote to memory of 1304	3100	msedge.exe	87
PID 3100 wrote to memory of 1304	3100	msedge.exe	87
PID 3100 wrote to memory of 3980	3100	msedge.exe	88
PID 3100 wrote to memory of 3980	3100	msedge.exe	88
PID 3100 wrote to memory of 4328	3100	msedge.exe	89
PID 3100 wrote to memory of 3980	3100	msedge.exe	88
PID 3100 wrote to memory of 4328	3100	msedge.exe	89
PID 3100 wrote to memory of 4328	3100	msedge.exe	89
PID 3100 wrote to memory of 872	3100	msedge.exe	90
PID 3100 wrote to memory of 2128	3100	msedge.exe	91
PID 3100 wrote to memory of 872	3100	msedge.exe	90
PID 3100 wrote to memory of 872	3100	msedge.exe	90
PID 3100 wrote to memory of 2128	3100	msedge.exe	91
PID 3100 wrote to memory of 2128	3100	msedge.exe	91
PID 3100 wrote to memory of 224	3100	msedge.exe	93
PID 3100 wrote to memory of 224	3100	msedge.exe	93
PID 3100 wrote to memory of 224	3100	msedge.exe	93
PID 3100 wrote to memory of 4932	3100	msedge.exe	96
PID 3100 wrote to memory of 4932	3100	msedge.exe	96
PID 3100 wrote to memory of 4676	3100	msedge.exe	97
PID 3100 wrote to memory of 4676	3100	msedge.exe	97
PID 3100 wrote to memory of 4936	3100	msedge.exe	100
PID 3100 wrote to memory of 3888	3100	msedge.exe	109
PID 3100 wrote to memory of 1660	3100	msedge.exe	110
PID 3100 wrote to memory of 2556	3100	msedge.exe	111
PID 3100 wrote to memory of 4756	3100	msedge.exe	112
PID 3100 wrote to memory of 4756	3100	msedge.exe	112
PID 3100 wrote to memory of 4748	3100	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://tlckidstherap.com/coferconnelly/download.php
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x304,0x7ffd7bbcc188,0x7ffd7bbcc194,0x7ffd7bbcc1a0
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,14161721585561017672,16779088008423948646,524288 --field-trial-handle=2284,i,2260494610571200403,4913175307304188735,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,17502572826743225583,3633293294850653264,262144 --field-trial-handle=2284,i,2260494610571200403,4913175307304188735,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2512,i,5326203274977286693,16200317271854165496,524288 --field-trial-handle=2284,i,2260494610571200403,4913175307304188735,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:8
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,5490943351008758551,9829233924257407453,2097152 --field-trial-handle=2284,i,2260494610571200403,4913175307304188735,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,14327269083501221434,16971730520509122744,2097152 --field-trial-handle=2284,i,2260494610571200403,4913175307304188735,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4148,i,4994975276250929295,13237858518791497065,2097152 --field-trial-handle=2284,i,2260494610571200403,4913175307304188735,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4172,i,17077011246043034836,18111305932195420133,2097152 --field-trial-handle=2284,i,2260494610571200403,4913175307304188735,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:2
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4920,i,11920492933095427836,1562201030499434975,2097152 --field-trial-handle=2284,i,2260494610571200403,4913175307304188735,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4464,i,3388045825240032074,14492119197461588037,524288 --field-trial-handle=2284,i,2260494610571200403,4913175307304188735,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:8
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,13152786730901254701,12930355489580765389,524288 --field-trial-handle=2284,i,2260494610571200403,4913175307304188735,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,1005870596197147449,2480147118285393301,524288 --field-trial-handle=2284,i,2260494610571200403,4913175307304188735,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,1005870596197147449,2480147118285393301,524288 --field-trial-handle=2284,i,2260494610571200403,4913175307304188735,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4220,i,5120704410611214868,1650164986404444759,524288 --field-trial-handle=2284,i,2260494610571200403,4913175307304188735,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4244,i,13813442240632187984,11514730970009031907,524288 --field-trial-handle=2284,i,2260494610571200403,4913175307304188735,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,12143510459427944974,18256264934376956988,524288 --field-trial-handle=2284,i,2260494610571200403,4913175307304188735,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:8
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4228,i,684207501465723028,13214633520167140902,524288 --field-trial-handle=2284,i,2260494610571200403,4913175307304188735,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:8
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6196,i,10202953610939166063,1338318858728499999,262144 --field-trial-handle=2284,i,2260494610571200403,4913175307304188735,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4748

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e540ff94479edeafbd2f52590dd9a8011e45e365c17d276ef0a72a73cf8703b0
MD5 34381c2be9e66e3a3f2106d98929cb65
SHA1 9dbace176fd9f60199e5fcdc1cf19399a18947dc
SHA512 715895995299450f87643e3c2823927f88e88c79d2e3fc83048a5aabc884b75a08b9125c07807996b45cd41a0667c3bd0cf692e72178d58addd93f4d0b89b947
TLSH
T1C7D022B0E3302230EAE8B23200E0C3328802EA020F883F000003E008ACF8BB020C330A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 545af60fd6f1babcf34d2de8406a8898f07180a583381549ec487c82a6f509f3
MD5 7b5eb721ca48ebb6bc5397c2c4c2d434
SHA1 6c13a0bcb87a73f71ced5fcc3d204c6a12b49c3e
SHA512 00a3ce72da4dda55acc4616d7d32ddecb923c6c964799294e08be9c4bf0e113fbb7aecf6c206e691a0927e77adcdbf806d416954441b8362b83b1b1215a3a988
TLSH
T1DFD022B0A3302230EEE8B23200E0C3328802EA020F883F020003E0088CF8BF020C330A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 be7202bcc4a08022c32fee9bb455ff288e11ecc61620adeb3bb97553b9dac98a
MD5 fa108e99f1378acd8e6c0e716179568d
SHA1 5627724850f5cba9d69b5901a886877d73e4f5eb
SHA512 349af72f41495dd9ad05623814ab3b533c04a2ede53b1a0cff42f3a83a80110f88c2a6109ee0e327e75a0f9dcc5e3a93c2cd852717fb4112aa3604887484304f
TLSH
T1D8616DA529874D94FBAC86F3C5C5D09B36308986F2973E1F028CD8B82F87B69DC41430
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b820.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b820.TMP
Size 3KB
SHA256 ac8a3d188548cdec76a0b04e28067a7e32d81fd2543b0a764b01654d39923169
MD5 5937e32e0604f94f45cc2f0cdf015845
SHA1 2b8e75ed676ad3be94369934dc42390536fe15f8
SHA512 d07fc53d480d4aca2a9c843ab66f88f0d9e77a1959430cfc731f4a0605ca5c2fe612fc1974589ff3b1503cbbcfab94f74e53b0d802381c1d7e6292338e08df2f
TLSH
T195616EA92A874D94FBAC86F3C5C5D09B36304986F2833E2F158CC8B42F87B58DC51434
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c024f70347d444b283e7004861f06fd431d63e89a1547f8154bfb82df932cae8
MD5 340e96e171c625ceb52cb535697b7eac
SHA1 d084f8a6bb449640511849ebc88984e56105f34e
SHA512 13e1e2afe2edf42b9a732c42b98fb74cf59724ef0b27ee9d53359d496e1346b13c105d02333a4f79b6c1c39abd56dd3817a8265cff4088b94ef435d4f4c6bb10
TLSH
T16A319CF3C3E48A6E9D1116F09A28AE2BCE5D0559832C3D6AC9D4EF5B93E3871E10154B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 fa6f75536ff5077e7523d8fd167349df1f810a3b17ceb578a80276a4f71a9051
MD5 28d9d4cd98ca1f80469959c620f1f88e
SHA1 4c19b14a1853ca7a75b32c3b4e3deaaeebea58c5
SHA512 823372a6017137801b134331d3a34eb6043182c92c0c32f49e05f887c27cacecf27d1998d274c52d5883adb65eb471b4b11fbbaa621522de33e7ddbdf3a74f4c
SSDEEP 192:sxZERsWO/fwstzIdpe2ZlyHW6+WN5R5hIe/Yt4AKUIgrJ:sxZENO/fwstsZTyHbD/R/k9
TLSH
T1A522A6126E34A97B8CC6D21DBB15BF63E6F95032A1D01E88AAFC851C05E66DD2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 78f61122c1c9266b23d7efbab7c8f1df3b0c7f3f1d58087d3ed8308119bf2ccc
MD5 5a03cf8d8fa8733785d4acfc5d5730a3
SHA1 8d688d1e956c0bdfe80b7d73f658d53b8e946e6d
SHA512 c3979d65ac9589e8120a5a1414da257d63d4be98ba5cbbe11db3bd8c9252ddca10a44adfbf00a4b6df58b896ab2a6c556aef0d60b179364c7817a8758f958b14
SSDEEP 192:sxZERsWO/fwsKzIdpe2ZlyHW6+WN5R5hIe/Yt4AKUIg5zJ:sxZENO/fwsKsZTyHbD/R/kj
TLSH
T13122B7126E74697B8CC6D31DBB15BF63E6F9503261D01E88AAFC851C05E67DD2217C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 a1832425929860670e7cf1456c32c9ef10fbff54f0b2b7ee1dd52dd6dd8f7e33
MD5 3666cfc47e62230ac5c5833008ac5d43
SHA1 7df1e9aa79cce5cb25b696595138008b2fd9d2c6
SHA512 c929ee503566aeb07d9798531c7fb3d8429941c4879575d1bc28420c8ea4ee0ed544df4f4b48d93a3dcf11ade0c2fa53d2f0be73eadbe5912266a041414fabda
SSDEEP 192:sxZERsWO/fwsC1zIdpe2ZlyHW6+WN5R5hIe/Yt8AKUIg5BJ:sxZENO/fwscsZTyHbD/R/iV
TLSH
T1E622C8526E78697B8CC7D21DBB15BF63E6F9503251D01E88AAFC8A1C05E67DD2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 c7a91e4b2ac507df0cfd232c813d53cc832e38e80f75d0cae68051cc74b5d076
MD5 9c2678d29d76e031c3f62b9e41246915
SHA1 27506386ae274c4624038ccb5f6003bb01957d7c
SHA512 8b553d492ff08fb2f6cf1754632ea28b45c5ddb9d0439417db85630fd3d0a3e2b7536af95a40893854288a695f161e36b7d76759bbe39a45147ac42ff1fae871
SSDEEP 192:sxZERsWO/fwsC1zIdpQ2ZlyHW6+WN5R5hIe/YtVAKUIg5BJ:sxZENO/fwscsTTyHbD/R/dV
TLSH
T11032B8526E78697B8CC7D31DBB15BF63E6F9503251901E88AAFC8A1C05E67DD2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 6e9186a523adcd54006bac239c7de493271ce6d10d5a14a33abd84ba50076796
MD5 91ce38006632d3d48c7768da84ef30a7
SHA1 a425731d55c75c3d6b5a32b68f8ae2f0fff0ba42
SHA512 d73b65674e360db61e3e6668c20731f6a13eef51570a73a32e1699ff4be9f29c7584a7ed63faf84b4d26244a37b986f5d00eb0aaca14f18fcdf0d5f92767cb19
SSDEEP 768:eYOtS3IWvUgqc8F1+UoAYDCx9Tuqh0VfUC9xbog/OVp3LlTtsbtro0v/:eYOtS3IWvUgqcu1ja83LNWbG0v/
TLSH
T1F4C2FA3B680CCB7E4FC01E9DDC6A6F973E9802C7A6689D4047F9994C02D77EA51264CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a37c5d76-1dd1-4953-8ffe-6eee5f822c4f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a37c5d76-1dd1-4953-8ffe-6eee5f822c4f.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 bf6712ec92280de3b95b13c64de5235fd8007720b161eff9798490216748bfd9
MD5 823a359b852c347d6f216abb37d94c0a
SHA1 8da36e68025b7d0bfee668ec5a57c61de5a9008f
SHA512 0cb9ab3e2c3a069dc1a4ec254652e6fccdddc60d3bd1ce8ed4420bf3ec5c1c9297ff03e497cd0ec210b30fa9f4c14fe910f2efd1f1d728ad1bc3d02caed4274f
SSDEEP 384:IiFiZcIIzsNB8TUNTUlIlkICagLBGWF4WlpOcq7/3+2gIVZh6DKhHaoN:TFQ0cwgRLknONlgIfYGHaa
TLSH
T1AFC208F258D7487AD9AE9B47A73E2E038DBCC117B5856A90B3C85A0CCC961BFD307911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 f5deaf830503776b8a2e71c667a7db9307eff6b19301c69a34230bba8b396cae
MD5 a2c1957ad4e73aad938ced0b3d6bc2a0
SHA1 4ef816b5201dc9e6b7ecc9da124f25b715187cc6
SHA512 2ac29c0e09a18cbfa74ee99ff3f5e4d0fc68b34378a909f7dee9cad807faad8be6d6152235c2d08d7450d465ccd3a469c20962e4a25c7ca48aa98cfc2a3aeb93
SSDEEP 384:FZcIhsNfkhCagLBeWF4WlpOcq7/3+21IVZh6DKhHaoN:9h/rknONl1IfYGHaa
TLSH
T1B0827B32ACB85C7A4DF6A545F8473A038EB88127A7C92FC4D5DCAB1D01EB6981317D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 22061a8fb34d6eb3d007b00737d42b37ed78c691b8667a283a09f6b82c2ea179
MD5 09bb95e9739346ff437ebc2dd45a146a
SHA1 df51b45a453cf8fa2951bdbd3965699156f54473
SHA512 edd209f16048efacfb23fe7f9fb0db217bec53c809539329d03ffd2a820603a90a4e1433fe21017dca23ac89957cf28548e837a5b5138a23d943e4b572ffbeaa
SSDEEP 192:3ONk6v6mtdQmiUyFrRe4WlpbRYci1b6TVLXU6:3ONk6C8URe4WlpOcgKU6
TLSH
T13A02B738BCBC687A9EF39E05B5473B175EA4113BAA952F94DAE81E1C00D728C1307936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 649d3fa2c266211fb3392687e979d2b97a08d489176f7602815b823f6c6b10e7
MD5 c425d774289750914651afa5e24e05eb
SHA1 d83e8e5d9691a599f9a7a8dcafdc199bde6d62d1
SHA512 5c478cbb9e373482033b7f31f7537a40c6356b7e7b59efd392fe2e0e730b2ecbc78797169271352fd038e48234a242c5c8dc1b1ac69c86af7f402f11bb030536
SSDEEP 384:6ZcIhsNfkICagLBeWF4WlpOcq7/3+21IVZh6DKhHaoN:4hqrknONl1IfYGHaa
TLSH
T1DF827B32ACB85C7A4DF6A545F8473A038EB88127A7C92F84D5DCAB1D01EB6981317D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 31ae396883d167d35b62867c7063dd1cfabc1b50cccc74bdd9d05f1bafed5b8d
MD5 1b4a115ad8ab1bf753e968588ff58605
SHA1 9f1a8129bf4f6f994a19edabf5db873a255b9f09
SHA512 5d315d48f197812727db268adece7a4a52722caf4b627ad462931bd37e5a047fa2680b1dce5e9fba3e23adb77c8bbf1c7dbd5a868dd77e78b7ed6dc74ca29a9f
SSDEEP 192:3ONK6v6m6dQmiUyXrCe4WlpbRYcq7RF3+2ppo2qEU6:3ONK6CPYCe4WlpOcq7/3+2YIU6
TLSH
T16F121A35B8B8686B4DE39954F44736139EA4423BEBC96F95D6DC2A0C01EF19C130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

403ed7be-09f4-4972-9e37-3aebd0ee7bc3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\403ed7be-09f4-4972-9e37-3aebd0ee7bc3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 394e71ea87494cdc160d772035ff3eb97661c11c2f6b086f56f5ef61dc20a45d
MD5 ca713003b7efe3eaa127582ecc7dce19
SHA1 62d26597b993f7954c5fdeed0b4df4c3cf67a7b1
SHA512 d360ec425e7a4691d16a7105d85ca031312de247eeccc96944ff25cae4c52591684bda19f4097742626f9c845f6c04dfb0416682815fe944aa8be8dbdf72326e
TLSH
T1A641D859A6EA1108B3B76F56AFF6A86E487EB9772E06D09D10110D4E4A63F04C861B33
MD5 SHA1 SHA512 TLSH

Submit Download