hxxps://p3ryv3x1[.]r[.]eu-west-3[.]awstrack[.]me/I0/011301a01c4f47c6-bf6798b2-2dd2-4f63-8bce-68fe1d6133c5-000000/5PcazNelxTV2PfloXZAKzoA8zYo=258

Analysis

user interaction
yes
max time kernel
149s
max time network
145s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/08/2026, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://p3ryv3x1.r.eu-west-3.awstrack.me/I0/011301a01c4f47c6-bf6798b2-2dd2-4f63-8bce-68fe1d6133c5-000000/5PcazNelxTV2PfloXZAKzoA8zYo=258
Sample260820-e2tv8azbmb

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3296	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316736058415755"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2654269261-3199571979-4291878722-1000\{884426CC-939B-40F5-AFD0-3D41A0BB6552}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4828	msedge.exe
4828	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 5016	1724	msedge.exe	81
PID 1724 wrote to memory of 3228	1724	msedge.exe	83
PID 1724 wrote to memory of 3296	1724	msedge.exe	82
PID 1724 wrote to memory of 3228	1724	msedge.exe	83
PID 1724 wrote to memory of 3228	1724	msedge.exe	83
PID 1724 wrote to memory of 1404	1724	msedge.exe	84
PID 1724 wrote to memory of 1404	1724	msedge.exe	84
PID 1724 wrote to memory of 4968	1724	msedge.exe	87
PID 1724 wrote to memory of 4968	1724	msedge.exe	87
PID 1724 wrote to memory of 4968	1724	msedge.exe	87
PID 1724 wrote to memory of 4952	1724	msedge.exe	88
PID 1724 wrote to memory of 4952	1724	msedge.exe	88
PID 1724 wrote to memory of 4952	1724	msedge.exe	88
PID 1724 wrote to memory of 4888	1724	msedge.exe	90
PID 1724 wrote to memory of 3180	1724	msedge.exe	89
PID 1724 wrote to memory of 4888	1724	msedge.exe	90
PID 1724 wrote to memory of 4888	1724	msedge.exe	90
PID 1724 wrote to memory of 3180	1724	msedge.exe	89
PID 1724 wrote to memory of 3180	1724	msedge.exe	89
PID 1724 wrote to memory of 4736	1724	msedge.exe	91
PID 1724 wrote to memory of 1696	1724	msedge.exe	92
PID 1724 wrote to memory of 4736	1724	msedge.exe	91
PID 1724 wrote to memory of 4736	1724	msedge.exe	91
PID 1724 wrote to memory of 1696	1724	msedge.exe	92
PID 1724 wrote to memory of 1696	1724	msedge.exe	92
PID 1724 wrote to memory of 1740	1724	msedge.exe	94
PID 1724 wrote to memory of 1884	1724	msedge.exe	95
PID 1724 wrote to memory of 1740	1724	msedge.exe	94
PID 1724 wrote to memory of 1884	1724	msedge.exe	95
PID 1724 wrote to memory of 3680	1724	msedge.exe	96
PID 1724 wrote to memory of 1284	1724	msedge.exe	98
PID 3680 wrote to memory of 1260	3680	msedge.exe	99
PID 1724 wrote to memory of 4844	1724	msedge.exe	100
PID 1724 wrote to memory of 5068	1724	msedge.exe	101
PID 1724 wrote to memory of 4828	1724	msedge.exe	102
PID 1724 wrote to memory of 1892	1724	msedge.exe	103
PID 1724 wrote to memory of 1892	1724	msedge.exe	103
PID 1724 wrote to memory of 3752	1724	msedge.exe	105
PID 1724 wrote to memory of 3752	1724	msedge.exe	105
PID 1724 wrote to memory of 4828	1724	msedge.exe	106

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://p3ryv3x1.r.eu-west-3.awstrack.me/I0/011301a01c4f47c6-bf6798b2-2dd2-4f63-8bce-68fe1d6133c5-000000/5PcazNelxTV2PfloXZAKzoA8zYo=258
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2ac,0x7ff85f9bc188,0x7ff85f9bc194,0x7ff85f9bc1a0
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1740,i,538115620364660671,9944722834689367860,524288 --field-trial-handle=2148,i,1761824543988451616,12986390299252583724,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,11595782393985043404,4803111055791227065,262144 --field-trial-handle=2148,i,1761824543988451616,12986390299252583724,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2108,i,15798489009446265714,4895507560545544858,524288 --field-trial-handle=2148,i,1761824543988451616,12986390299252583724,262144 --variations-seed-version --mojo-platform-channel-handle=3028 /prefetch:13
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,3553761427389744811,17009806681752101388,2097152 --field-trial-handle=2148,i,1761824543988451616,12986390299252583724,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,3000346165359523199,15418179507250035968,2097152 --field-trial-handle=2148,i,1761824543988451616,12986390299252583724,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4144,i,1442029689064812784,15949854240414167509,2097152 --field-trial-handle=2148,i,1761824543988451616,12986390299252583724,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,10288343151947311383,18359472757875497148,2097152 --field-trial-handle=2148,i,1761824543988451616,12986390299252583724,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:9
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4232,i,8019833365114611974,16493011419149771544,2097152 --field-trial-handle=2148,i,1761824543988451616,12986390299252583724,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4276,i,10780435824688459416,5258232523450313484,2097152 --field-trial-handle=2148,i,1761824543988451616,12986390299252583724,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:9
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,3323868495697026844,10608247220622148426,524288 --field-trial-handle=2148,i,1761824543988451616,12986390299252583724,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,4548189395629769003,2283537819912073564,524288 --field-trial-handle=2148,i,1761824543988451616,12986390299252583724,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:14
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,10016290017467159190,18128065577934928881,524288 --field-trial-handle=2148,i,1761824543988451616,12986390299252583724,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3680
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,2442329048873226140,13643068378410256274,524288 --field-trial-handle=2148,i,1761824543988451616,12986390299252583724,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,2442329048873226140,13643068378410256274,524288 --field-trial-handle=2148,i,1761824543988451616,12986390299252583724,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4204,i,8001962432719823989,9685443536271760565,524288 --field-trial-handle=2148,i,1761824543988451616,12986390299252583724,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:14
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4248,i,2390281360850397974,3759304984850546305,524288 --field-trial-handle=2148,i,1761824543988451616,12986390299252583724,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:14
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,17183671717416246351,5509312913275198736,524288 --field-trial-handle=2148,i,1761824543988451616,12986390299252583724,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:14
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,7816380315608273449,13748786607273570654,524288 --field-trial-handle=2148,i,1761824543988451616,12986390299252583724,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,12339633077693408122,9877539959287172430,524288 --field-trial-handle=2148,i,1761824543988451616,12986390299252583724,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:14
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4172,i,16275299756489199808,11621912595138404333,262144 --field-trial-handle=2148,i,1761824543988451616,12986390299252583724,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4828

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 44ad41f86fc5dfdef9271828918ef29a810e56b8958f687546cd2d840b9240aa
MD5 a5cac29eea53b9fcab74bee9fa34b5ae
SHA1 f8ce725ee9f0504c0c06499e9e661e57b450faea
SHA512 b9b4caa28d7e2513df4fe005dbaadbee5271cc930e71893250588b597acfb3d61d0eac54efc7443d690048513be0217cff1f84fceb1bc7dbb7a69e098a92df54
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
TLSH
T1B0B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7da5fd99a0ab66e77a1c7d418475484f3755ec6c2945de3295f2577e789df01a
MD5 39ab0f1d6d7946d873f1bb6929a4c13e
SHA1 c59f4f27654295f008fbfc2411a1ef79ea54cec0
SHA512 e470432f3c728552a9408dd90789bb6c2ace1ee0142fae2a37ea0127d228691c3150637174b3202058e5952e25dfd9256f96a6af74b77d36328dc528bee21aea
TLSH
T10BD080332F1D7041FB1D4730D463CB24277F845638478616B211C40C99754C493C5587
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 23823794b3b6267e9c083ddaf520ee01fa32d4516798865f1445a1abc4b04bbd
MD5 83250c7c4d7b6ef62bd1bf26f4c3e0c4
SHA1 e9602c3da743490459da2b565766ef634e141b1e
SHA512 ca69ff689a6f6e3b7d2372cd69b840c4bfc55765ed02240fdf7742b99373e9bfcada680b5f79ef47adfa800608d07b4a31cf3835f5c30b056283e46bca076180
TLSH
T189D012232A5D7041EB1946309463CB24266E845628468616B211840C89664C493C5587
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 454c29fdeb767742c8f0b529bd844de4144ea19d5bf8cd1ab15a268843126826
MD5 63077dc6fa4cbc8f81f8ce1072be5e5c
SHA1 69735529d371c37159061942ed2ffe4e195ce472
SHA512 734e1a4a2935a6f2000ea4a63c8c784c13e55ce5b6411f9174cebf7eb83ce2ac3c0162bb7789be357ecf04c5f3dcd97d63f488675c26d6a5df62031a7ff53bf2
TLSH
T1F561D73D016D295FD3E1053170FA03417C73C75A9DFB2E24D9A4997FA51ABF8C259208
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5899da.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5899da.TMP
Size 3KB
SHA256 00d1c0c53e688676d9b4269642da78fce25c3ebcd89cebf3bba0ec25dd496483
MD5 6683e58147fb4c45d6214d2d6cb26418
SHA1 ee3eb454fe8e28fecaaf55d6b7aaa6c512b09f4c
SHA512 654a0112da748c88304ef528ce2d5bfffb7018a0bb9b7ad3bc4da2279ff2dfa7d6bcc504cbedd51b66c64aa48f70816c96e9c89cb764103803730f481d5bdde2
TLSH
T1BE61C53D016D295FD3E1053170FA1340BC73C75A9DBB2E24D9A499BFA61ABF8C259208
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 838B
SHA256 3608f48b41e02a246fc11da55cca781a123f8a4c735943471b22dfecf55bc4b1
MD5 06158749333b7ad7eed6f752ead3d849
SHA1 8d03227cb48cb65c9ba3467bd597e43ff058ba5a
SHA512 6eb5cb005274a06bccbc32ffdba32334090a744ed72e9442c3b0d12916898c39e8321a275983a3c7b5e28bb1fc3703a4b17f089e0bc5c833ed248539dbb8aa37
TLSH
T11C01ABB783E589AEDA1112F05A24EE1BDF1C0502431C7D29CAE0EF27C7E3065E40256B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2f8034e84ba146338b19483b87a3c2f82215c49d7f34e4c006df7a19cf2a6d02
MD5 3c9202d706849cc6426386d3299ec2ed
SHA1 dfb9d89994ec2a2252661f764df631e3f0d3edf6
SHA512 ddfe98fdbab0c35ef5e8be1277ad696a08f9dcee2773e1a0d1c83a885b0d0d6a14e51f468a2320538e31cc10fac51b42d89408fc8adea15288a51e598d95f6e7
SSDEEP 192:sxZ7/yM/jK1Ml8MFN/fEFsfsd8I/IdpM/W6+WNGY0uBHxl0lIgrJ:sxZ75dN/fAsfsd8IwM/bG5uQ9
TLSH
T14F42E7126B346977CCCBD209FA15BF53D6F90472A2900E44ADFC9A1C04E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d318eaed055d6441f162d8f469a25dd9930dd3813f640ebff9be42dbfea2edf2
MD5 190749d9811368eac1dbc3ce21ead9f9
SHA1 a83d4ac69c7f3bd43c3ec193b5a83f46e9220177
SHA512 df8990ef119a81fb4cfd022f179a89786ff536074fdd48af80e029b2949e6815214c69ad0c50df51c61dc22353ba2c3e3530e52e8dcf02f75cbf08ed8ce07009
SSDEEP 192:sxZ7/yM/jK1Ml8MFN/fEFspspLI/Idpwg/W6+WNGLTJ/Y0uBHd30lIg56J:sxZ77dN/fAspspLIw5/bU/5u2Q
TLSH
T1BA52E8156A346977CCDBE209BA55BF53D2F54473A2900E44AEFCDA1C00E6BDD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1465fde117ec39f35eb2eac7ab68ec59c8e4ebbe2bf014453d2464dbb9831756
MD5 2a4f0cf24bef75362ad4c6130fa4b92a
SHA1 ba66e6687440b283a8d4b078e67ea0a691dc7a88
SHA512 af3939e60e38bfa2c6a7fa3976f158d1fb5faf45bf3f3426e3cbb1368e4bca8b3548f4fc075864ef87bb1aa102579d2bee6061d3a5c98899f25d6b470833c092
SSDEEP 192:sxZ7/yM/jK1Ml8UQAFN/fEFspspLI/Idp+g/W6+WNGLTJ/Y0uBHfwElIg56J:sxZ77q2N/fAspspLIw//bU/5uJQ
TLSH
T19252D8156A346977CCDBE209BA55BF53D2F94472A2900E44ADFCDA1C00E6BDD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 8546d6dc3eee8e7d3be14a1a7ebe6c9070c0a71da04019867931cc6199f837f9
MD5 6a984892e619bad10e60a4cc3750b67f
SHA1 b647519d3b83c1e6be373a75b57c5ef03e6bbde6
SHA512 0545b6a9acb7a524acc876314c77ca912757016e98fe5bd0b2a7187458c8525a8b2c30a39b6d400d4d3378ed6283d501a567ae4a07d3436a8b6d2cbe1bdcbc8d
SSDEEP 768:zy/Lh8dF2/kWRmAcQ3w8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3KjLl/060lOArozp:zy/Lh8dF2/kWRmAcQ3wu1jaKKjLp0Dla
TLSH
T146E22A3B690CCBBE4F840EADEC26AF976ED801CB56584D5447EA894C03C73EE411A59F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 152c12422e3783f02d375a04fab9ed4b7015ae576527ccd4b056232c71df4b26
MD5 b3f386a34771c75e7dbf55f5b478fd76
SHA1 45305c4018c7cff8d293363301e36f6aee10d740
SHA512 d3a239e48f94f4b5aef3755a8f141820f447cc2190825c729b4f882253a861d3f70a3f4d9d618fd390d9337ce4598fda48df42f3df34e7f8007568884d625843
SSDEEP 24:KdHfel8a5dttd4pl+QIjZdKiqhaXd1EPNSm3MEfrAhaedWGC4+6+xIjsCKiBhaSu:K08I/KFGsD9IVK+w43ylJI1KaoIqv
TLSH
T14B91235231BA02123C3E254C9B6587665E43B2A73058E96F3BB844B51E2BF124EFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4040f036-878a-4eb7-8b15-28ef3ffb00bb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\4040f036-878a-4eb7-8b15-28ef3ffb00bb.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 88b172f286ba690b2448f526bbde7f4c515eb049725fe6c0017bf4a0124273be
MD5 92b03f0152164f8c81eebba092c3e25b
SHA1 b17ba9bca2c05507f70d74a598e01d8519917cda
SHA512 0018a2b58bbd2ce5961ee360a9fee3332377fa9e15d295fcfb54d640cb8d79fd2eae2725b98b61a274d57f2056283f71742af85167cbcc3256610351a9cdc383
SSDEEP 192:umL8NItQkX5p940Hd+QmiU1xjmXI40F2oP1oNjzorFBmsrcXT+VpW4qoU8:z8NItPd40HYfq30FptoB8FHcXSuWU8
TLSH
T164321B366C386C775EE3A594B0473A13AEB54127EBC86B44D9EC5B1C01EF29C230A927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 f7e18e490010ad8eebb3a6e212eb3efa0b71a869d0e78f108a0f710dcc4f69d3
MD5 d4b95a68803aa9c4ca084c3ab9f23c9d
SHA1 62b2994ccef658610ffa09b6e67672c69f13c7c1
SHA512 d6e93a79cc9e570125a99492a53518266d51eae515aeaa539a69c2e02074367f0970b4ff6aada910f41a6c10c9b9bded9b2a30ed110a0f9e80393da8da0f140c
SSDEEP 192:uQL8NI9QkX5p940Hd+QmiU1xjmXI40F2oP1oNjzorFBmsrcXT+VpW4qokB9:p8NI9Pd40HYfq30FptoB8FHcXSuWM9
TLSH
T17B523B765C386C775DE3B984B1473A13AEB58067ABC86F04DAEC9B1D01DF29C130AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 dfdfb795fec5d95feddaf4588b019da391e4f25653328ffc74ec09bacbed9d1f
MD5 8b133c0207bf9cdd6699291c74c6d3d0
SHA1 5f2ac96493affcd06d2ee478347c645f47607cd5
SHA512 41b9b005123e9a2df935e3133bb952989c4e4a770ef255006a474e1afa521d1289c9ba540a6b14cee60120665ab44a3aa552f031ccf49bb9f47f29291c2536a7
SSDEEP 384:z4iFiZcIq8N48TUNTUlIlUPd40HYf830FptoB8FHcXSjWiv83ob:zDFQqBwgA08kb2u0eWio0
TLSH
T14EC23AF208E79837D9AE9787A73E2D039EBDC063B5849600B7D8561CCC9A1BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 8df7f1b05da374950f278f6f27c26acf4a49c914027b0f10c7f4b749fc7e6b69
MD5 ed13ab4b2aab29baaa2e4b357e9d9be8
SHA1 4fd1af93507e7e2d83c9b7ce53718239b018a105
SHA512 aa8f012e14ad86a23b926604e8db4003dffa894434b67172014f087adcc649d6c3a4407faaed6963fccbbbe016c498cb4ecbe5154e10e5e48cba3ede622caac0
SSDEEP 384:mZcIh8NIUPd40HYfq30FptoB8FHcXSuWiv83ob:0h20qkb2u0xWio0
TLSH
T1A2827D765C346C7759F2E684F5473A176FB98027A7CC5B4098EC9B2D01EE698130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7b1078b9f31a83976229240a5e1517a1942a0494f1402268b300e7f3f80c71a0
MD5 4cfd0ca481d81ab19ef45ee99ef6a92a
SHA1 c009859ac57ad34041320e29399a2cacb9064b23
SHA512 7bc935f48c379b882a5495729b7bd61e74952c3cfbfac486144fb8c9f41bf425f812af93c9260933411c250f0164d66eae585e845af7ab9160b525e9de81e9c7
SSDEEP 192:qGNH6d9402QmiUyZvmhTBF2oP1oNjzorFBmsnGw17ZU6:qGNH6740SuiTBFptoB8FRnU6
TLSH
T19502E9356C783C6B9FB3AE89B4473B136ED5116BEA946B44DAE41B1C41DB38C2306827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 60a5d25376c235d5e7eb8d4e3344af62ba9dbf443b34379fa3b8f12fb65c395c
MD5 777bb7cf2175e280f2c18e6b505e0b8f
SHA1 4a6f2e9ef89377ff927b1b1aff4a7e9f61ae4d98
SHA512 c3064e7f9d341ab546520a0d5fa040154937c3445f3c268d93c8a7cdeff769a015881fcf5cc53e0aef1b897b9e7f37cc8e1e68d10a9a04b84ec46454a5847966
SSDEEP 192:JGNR6d940+QmiUyYVmhFBF2oP1oNjzorFBmsrcXT+XiD4qoU6:JGNR67406nQFBFptoB8FHcXSqWU6
TLSH
T1F112FB366C787C7B5EE3B995B44736136EA55127EAC87B40D9EC1B1C01EF29C130A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download