hxxps://tlckidstherap[.]com/coferconnelly/download[.]php

Analysis

max time kernel
148s
max time network
130s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/09/2026, 14:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://tlckidstherap.com/coferconnelly/download.php
Sample260930-rtbe5asxaz

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4404	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2293636880-3790684622-1477845016-1000\{DFD135B4-B70E-4151-A33F-7CC01556EC25}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3476	msedge.exe
3476	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 5548 wrote to memory of 4104	5548	msedge.exe	80
PID 5548 wrote to memory of 4404	5548	msedge.exe	81
PID 5548 wrote to memory of 4000	5548	msedge.exe	82
PID 5548 wrote to memory of 4000	5548	msedge.exe	82
PID 5548 wrote to memory of 4000	5548	msedge.exe	82
PID 5548 wrote to memory of 3828	5548	msedge.exe	84
PID 5548 wrote to memory of 3828	5548	msedge.exe	84
PID 5548 wrote to memory of 5384	5548	msedge.exe	85
PID 5548 wrote to memory of 1628	5548	msedge.exe	86
PID 5548 wrote to memory of 5384	5548	msedge.exe	85
PID 5548 wrote to memory of 5384	5548	msedge.exe	85
PID 5548 wrote to memory of 1628	5548	msedge.exe	86
PID 5548 wrote to memory of 1628	5548	msedge.exe	86
PID 5548 wrote to memory of 5644	5548	msedge.exe	88
PID 5548 wrote to memory of 5644	5548	msedge.exe	88
PID 5548 wrote to memory of 5644	5548	msedge.exe	88
PID 5548 wrote to memory of 3452	5548	msedge.exe	89
PID 5548 wrote to memory of 3992	5548	msedge.exe	90
PID 5548 wrote to memory of 3452	5548	msedge.exe	89
PID 5548 wrote to memory of 3992	5548	msedge.exe	90
PID 5548 wrote to memory of 6012	5548	msedge.exe	91
PID 5548 wrote to memory of 572	5548	msedge.exe	93
PID 6012 wrote to memory of 5508	6012	msedge.exe	94
PID 5548 wrote to memory of 1776	5548	msedge.exe	97
PID 5548 wrote to memory of 4728	5548	msedge.exe	98
PID 5548 wrote to memory of 1488	5548	msedge.exe	99
PID 5548 wrote to memory of 920	5548	msedge.exe	100
PID 5548 wrote to memory of 920	5548	msedge.exe	100
PID 5548 wrote to memory of 3476	5548	msedge.exe	102

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://tlckidstherap.com/coferconnelly/download.php
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffc5cc6c188,0x7ffc5cc6c194,0x7ffc5cc6c1a0
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,11622277510741527557,12137776525802732057,524288 --field-trial-handle=2144,i,15018263461864903762,14155027801393026621,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1536,i,14619494680787946419,919626850807404380,262144 --field-trial-handle=2144,i,15018263461864903762,14155027801393026621,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,5836212276607870580,6556456394974815113,524288 --field-trial-handle=2144,i,15018263461864903762,14155027801393026621,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:13
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,1206136042656809269,8169165890585039094,2097152 --field-trial-handle=2144,i,15018263461864903762,14155027801393026621,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,8548932220801873357,8704706083800914492,2097152 --field-trial-handle=2144,i,15018263461864903762,14155027801393026621,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5012,i,3800106955274265511,10366324237617121801,2097152 --field-trial-handle=2144,i,15018263461864903762,14155027801393026621,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:5644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4844,i,3880491006591352267,1962093255535517126,524288 --field-trial-handle=2144,i,15018263461864903762,14155027801393026621,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:14
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4836,i,17124647582633522430,13376804775729266911,524288 --field-trial-handle=2144,i,15018263461864903762,14155027801393026621,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:14
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,2317505504329547347,13323842453424784760,524288 --field-trial-handle=2144,i,15018263461864903762,14155027801393026621,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6012
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,15465853311112121215,17830998772994494903,524288 --field-trial-handle=2144,i,15018263461864903762,14155027801393026621,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:14
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,15465853311112121215,17830998772994494903,524288 --field-trial-handle=2144,i,15018263461864903762,14155027801393026621,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:14
  2⤵
  PID:572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,2417577314831374703,13882514734034434409,524288 --field-trial-handle=2144,i,15018263461864903762,14155027801393026621,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:14
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,4312933750313343885,4105050044235601963,524288 --field-trial-handle=2144,i,15018263461864903762,14155027801393026621,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:14
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,8715484562523959881,12948922847889217192,524288 --field-trial-handle=2144,i,15018263461864903762,14155027801393026621,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:14
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,15636886960190107479,8775338491058508718,524288 --field-trial-handle=2144,i,15018263461864903762,14155027801393026621,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:14
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6204,i,5738039743920229477,18365070528084369001,262144 --field-trial-handle=2144,i,15018263461864903762,14155027801393026621,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3476

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 63b3e051645c9957f53c538586c3b5463f3ba4412c230d66eb66f06ad6052604
MD5 0070abe22a07fb36149648973e990688
SHA1 c8a203457b36afa6d0ce9b56d26cb7817d832d37
SHA512 cda9b7179f6f997dac4ee0624ff9f92ed77b7c27218584fb07f6b2ebc24d10fc25d45c3d2781b766d834f82054e29ee150712e7ab7d7a11465c468d0f8a31fd1
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P79:fwUQC5VwBIiElEd2K57P79
TLSH
T175B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d06c655b2480a29ad334636f95a35c5bdce83a66295adea08a8856dcd298e39e
MD5 5dab4062f87d6ffd5dbc44ebf48fd8c6
SHA1 bffdeffc524afddf1ff9a0fbcfae676c4de6a3ac
SHA512 df19db1241309a372c6eeb5a332eb1a5cf13caf28f98f4b9727e26379c541aea8e4d6c5acea40f3adbe049e1527b086f83b2d59149638912f8c9f6d02fd77d74
TLSH
T15ED02B84A8D97104C0131437002161103F8898440906E012D0C0027E0985AD30355062
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 83eeb6fb69147b86d59db93f6bef3b9700e1a01b1e16b7737138a14705b925ec
MD5 1261625a6979743cb430cc1e4a6c87ca
SHA1 3447cdabba89527c05d21de5b837debaa8dddd5d
SHA512 81eea7d5abc59ff723b0b7dcf56140c4ca4b98afc852eb03d6c02eb17e7ee2a4ed4c221a99cd4babf2c7e6721d787537a34f58357037ab616e168d5434558f41
TLSH
T13DD02B80ACD56104C0031437006161103F9894440906E012D0C0027E09C5AD30755062
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 49ff247d678ca9dc78c0ec5b718b430f53c31842e509832ceb3b142ad4647914
MD5 27d33814e076faff32a33e47c0792e20
SHA1 6f8ee8d1123751abd7da9d53d01b8082b2fa3063
SHA512 2301ad11a7c7764327e1107548839933c4243b6f6d2274209d66cfa14e2ce24198b5d53401a47ad5109c74f30ebc615a8489efd59e1796a5ad965bf1d7877246
TLSH
T1C4F028A9C921AC2718FD1B2A20655B4FF75513673780995F3A3D821D8FB0A3B4286C6C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 305ed8ca7ad36bdde4f290885178d0e693507adba718afdbe133f95cde2dd3f6
MD5 53e8f4d79c4b5ab2b95ea78398483c0a
SHA1 67760119875a3e9a017c252a1186668d00e81841
SHA512 d5851b82cbf8a29c915d3234efe589628fd9c4638ccacb92676b782e59bddbc83015b6f15801a07f0585b2da70f53a9032d2f1386f35be87a34581cb1bf71441
TLSH
T13F612EB565204CE1CBAC917399F6E14B377B99C235C75E7311D4CD78A856FD88C8D084
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 366507dd88b9a6a6c40d308bb01e912dd32735ada7a3022cda769365658d0854
MD5 2025aacb18d610bcbde8fbbfca4b9f27
SHA1 27ebcaabfd65b8821035dd8080d2c5afc0b64d6c
SHA512 7560d9fc5683b44639f36b6bb4ee1657091098e255af10534630d76d19b6e30848a85db581a003a9dc9970366c3543afd8c10223e043ef1be542e0de1ed7d385
TLSH
T1D3614EB565604CE1CBAC81739AF6E08B377B99C239C75E7311D4CDB8A816FD88C8C084
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e720dfa809323013f88ae852a93e221398d9674647de06017b4e28a2635c631f
MD5 e873c1366eed11f2b5e6dd2a5113fe46
SHA1 e6b0ff9892686ec36409a968a8d1011275d189db
SHA512 a809bedc83822bdef6ff020fe6c951f295f7bf90e14bb704487937f2670e2b66b5701cc9a8528f136fd0acb2824a6cdc2bfe6c10d7771646223e5e56a5d79a5c
TLSH
T1BD51CDF3C3E4866D891156F0A618AE2BCE5D0555432C3D5AC8E4AF5B93E3871E14164F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 259268ef8393b62ca28810f471da8ee555fc1f4c339ed4aeefb692684e660e5e
MD5 8ae3502317de400ae46647dbd740a01f
SHA1 8800556031914cd03e95e3f8b026101cf56d5b2a
SHA512 f29d5cb49cf4f6ea1ee92ceb565471bce2a04ee465af615eb165283a86401f0a5dd91dc9a93e08a3050ad0bcdb7d32eb7274ec6d02e0bc94ab4db10a263b842b
SSDEEP 192:sxZARCF3/fEsMQ705tsflzodpjxK/W6+WN+u7Gr/Y0RAdbyxIg5UrJ:sxZAC3/fEsM35JU/b+3/5KRyO9
TLSH
T18942E815AE74A97B8CD7D219BB15BBA3D2F9503290D11E88A6FC8E1C11E76DD2207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 14b4f23279ca34ed23726f76fbc7070a879f33e9d6590472536a0144f005fbc1
MD5 f20bb71b691fa56a69eaa6d374d068ee
SHA1 86d88b5071efdb2f5abd58bb157f5b6c833d72c5
SHA512 6718305650c14c071b8139ffa155ffbf064eb4d87a9df5d00b0068456c2a1b1a7b5b11d97ca2d38ea63db550b355a208460b71cee1d42ada1fe5f8f59073fd96
SSDEEP 192:sxZARCF3/fEsBQ705tsflzodpjxK/W6+WN+u7Gr/Y0RABbyxIgjrJ:sxZAC3/fEsB35JU/b+3/5Kdyj9
TLSH
T12E42E815AE74A97B8CD7D219BB15BBA3D2F9503290D11E48AAFC8E1C11E76DD2207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7664eb364b74e946767f8c95d91471d70c81e101a4f68fc6eb178ae70e1f708c
MD5 38b43afc3fadf88195a0bfc432ba2d07
SHA1 e9ba8723bc284bb215d63b46664676a85b1a9220
SHA512 bff47ce72b44361216619554aa3c4b9efa197ddb4076334fd0f09ad25237899b314589d5b6f323a19383feac5d1e5491c400b0bfcb011473d7e55cb9f2d00bec
SSDEEP 192:sxZARCF3/fEs/Q705tsflzodpjxK/W6+WN+u7Gr/Y0RAibyxIg5UrJ:sxZAC3/fEs/35JU/b+3/5K2yO9
TLSH
T1A342E815AE74A97B8CD7D219BB15BBA3D2F9503290D10E88A6FC8E1C11E76DD2207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 28KB
SHA256 f8c6613100e2e03836efce332c8c5b99b84085e0b6f868f5c5c9c1389626922f
MD5 95a52ada67c41eceec136ae85247798c
SHA1 7c9c88f0c0d48deba1e6e3a9fb378893d7886aa6
SHA512 2d9a23ba1dee928150d2ba9496c043c54d8589f336a29864b3e21bdb589a6ef429d58c758da0b943356dab48499438267c2ec14074ecad740916c178072435b1
SSDEEP 768:WJ6E28xO215WRmp3QX/8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3fsLl/LN0Y3Zroyw:WJ6E28xO215WRmp3QX/u1jaKfsLpLKYG
TLSH
T114D20B2B740CCB7E4FC05AADDC666F976E9802C7A6688D4047FE894C02C77EA511A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 fc3865edeee3926ba24d3585dee78d89a9dcb177c7f3bde17114cdbb2bc2495d
MD5 692814476b52243e0a7753e3e09672ea
SHA1 7f074135c674f34bff6e73afabb380778bec6151
SHA512 279053ddfe88af9dbcee88b7bf5a19c6ca463dfcada6763430d968232b9f775fe74ee9559fb6a5fd0af3add0e13ef464097754d2bf3d7488244f207dd0d2a11a
SSDEEP 96:KYlWKmcrGr2KosTUwK5e6SmIKT64ygKHK2qOcKjKIrSK4oiOHCKIUzj+fzptB0Be:80Z/jH0TnaJxzh/Mrzcp3wHbo1dj
TLSH
T1A6B2211171BA12153CFE290981B49B2F564232B37159EA3B7FBD00B68E6BE441CFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 f90a186fac8a76294afaaef0c2830b59d67e0f5731760c7e3e3c90038d0ff076
MD5 2b1596a3cf69c5dc943626321242d8b6
SHA1 9c1add0fb2258950acea218abd78e3a35651b142
SHA512 fbb8de84c094a993968c1c8804125fe9256eadb31d5b73f45d99254dc22e0a70ebc75d04b3327e510d99ad3432476fa00925a0e95fb7b952cf66162b386a726e
SSDEEP 384:nviFYZcIm38Nq8TUNTUlIRIQnhxDi6tzTfoBdYmpYbJ2DHIxtgOIwZOyaL7gL/7P:6Fmm35wg5hI0UBdZpYWHIxXslt2
TLSH
T1CEC24A32E8A9CDBBECEB4E99A34A7653DEF05163D58C8AD4E5D84D1C009719D130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 36feda2ec4a28c63f36e5a125372c2ea6dd4de11fe50fe3a42e9be43df6efa55
MD5 a325a8760ca25feefc5c356405bd7d7f
SHA1 8ff746ec0243e175cfe89969e3de988e97958f62
SHA512 79a183a070acce109b753f3ec317ec1f74e88365cf54332d6acc526fbe4acb6072a6ea7cfddf8d64cba72b5e2d08656a3dbd827a0f2685beb6622e4b25599848
SSDEEP 384:nviFiZcIV38Nq8TUNTUlIRsQnhx/i6tzTfoBdYmpYbJ2DHIxtgOIwZOyaL7gL/7P:6FQV35wg5ho0UBdZpYWHIxXslt2
TLSH
T1F8C24A32E8A9CDBBECEB4E99A74A7653EEF05163D48C8AD8E5D84D1C00971DD130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 af9ba13b4f50d0fbd8cd2f3e9637e50404e59c013a8c876eb898e9942b4b7d79
MD5 67eb88afd6f89223b31a0a209ad69226
SHA1 7488f779c1e0ed4d66b7e682cd871ca57d7178e2
SHA512 c51a515f3533d3c72c86d70d6061bc2b3ff7dec7880ac1dfad51c1488cedb8a925faa9cbca82330250229b93ca280354e4fc1d425121ebff591d5ae1cf1b7bec
SSDEEP 384:nUiFYZcIm38Nq8TUNTUlIRIQnhxDi6tzTfoBdYmpYbJ2DHIxtgOIwZOyaL7gL/7P:vFmm35wg5hI0UBdZpYWHIxXslt2
TLSH
T1F9C24A32E8A9CDBBECEB4E99A34A7653DEF05163D58C8AD8E5D84D1C00971DE130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 75b4c37c778f9ba002ae4334a4132bd0ac0832d02ae30b7653732026cab0e73a
MD5 09faaae0e9acc66f66fe2e255127d79d
SHA1 fcebbf9fd7971fdda62a68b56206e35cfc80c5fd
SHA512 ad544496c24d7e96f0f5fb3e688c466bffcab482b74e25fb4202bf50cfded96a5d92d1222a48940d179420677fdb8e279cc5683b09d7e56770b9658942a39a30
SSDEEP 384:nNiFYZcIs38Nq8TUNTUlIRIQnhxDH6tzTfoBdYmpYbJ2DjIxtgOIwZOyaL7gL/7P:EFms35wg5ht0UBdZpYWjIxXslt2
TLSH
T176E2A2F198D78976D8EE4B97A37D6E5299FCC123B4888A94B7C44D0CCC921BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 0ed7735c0ed6da9f3af972fd4ac78679854db24de226c272b55801171b37032c
MD5 9dd54b26824b9e3439e1df2c5b7b80a5
SHA1 d08b46c8a074357c2439547a641905ba394b43e2
SHA512 36b88772de14baee4858a9c445c35d6abd5a5b998ae1d5812828bf78508a130a1348a7a36005ac30b06c471188a79b5838179e3158a1eacf5fc79c47f5cce5a8
SSDEEP 384:zjiFiZcI638N78TUNTUlIxBQnhxqGUitzTfoBdYmp1IEsa+VYlBgL/7IzKoy:qFQ63Awg2hVU8UBdZp1IEhgzB
TLSH
T192C24A36EC94C9BBECEA8FD9A78A7613EDF04123959CAAD4D5C81D1C00DB19D1307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/572-202-0x0000017100000000-0x0000017101000000-memory.dmp

Download