hxxps://pgwfj3k3[.]r[.]sa-east-1[.]awstrack[.]me/L0/https[:]/www[.]tiktok[.]com/link/v2%3Faid=1988&lzdlang=enFSmPWg&scene=bio_url&target=adclick[.]g[.]doubleclick[.]net[.][//]pcs/click%3FCIO7IfjWKRXTAP84695-JulYkd&&adurl=/%2562%2565%2561%2564%2569%2576%2565%2572[.]%2563%256f%256d/%2577%2570%252d%2569%256e%2563%256c%2575%2564%2565%2573/%2574%2568%2565%256d%2565%252d%2563%256f%256d%2570%2561%2574/%2561%2570%2570%256c%2569%2563%2561%2574%2569%256f%256e%2578/%252d%2532%2563%2563%2564%256f%2563%2533%2571[//]1/010301a0212acef3-fed518cc-6066-4eb7-891e-bc1674961735-000000/bwVbIKSZBOeoF04IyyWKQqYMM_o=258

Analysis

user interaction
yes
max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/08/2026, 00:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://pgwfj3k3.r.sa-east-1.awstrack.me/L0/https:/www.tiktok.com/link/v2%3Faid=1988&lzdlang=enFSmPWg&scene=bio_url&target=adclick.g.doubleclick.net.//pcs/click%3FCIO7IfjWKRXTAP84695-JulYkd&&adurl=/%2562%2565%2561%2564%2569%2576%2565%2572.%2563%256f%256d/%2577%2570%252d%2569%256e%2563%256c%2575%2564%2565%2573/%2574%2568%2565%256d%2565%252d%2563%256f%256d%2570%2561%2574/%2561%2570%2570%256c%2569%2563%2561%2574%2569%256f%256e%2578/%252d%2532%2563%2563%2564%256f%2563%2533%2571//1/010301a0212acef3-fed518cc-6066-4eb7-891e-bc1674961735-000000/bwVbIKSZBOeoF04IyyWKQqYMM_o=258
Sample260822-aahxesdg65

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2572	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134318304351108081"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{30376BB1-090D-4FBF-B644-FDEA7A986E73}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3932	msedge.exe
3932	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 1624	2444	msedge.exe	85
PID 2444 wrote to memory of 2572	2444	msedge.exe	86
PID 2444 wrote to memory of 5040	2444	msedge.exe	87
PID 2444 wrote to memory of 5040	2444	msedge.exe	87
PID 2444 wrote to memory of 5040	2444	msedge.exe	87
PID 2444 wrote to memory of 4036	2444	msedge.exe	88
PID 2444 wrote to memory of 4036	2444	msedge.exe	88
PID 2444 wrote to memory of 3296	2444	msedge.exe	90
PID 2444 wrote to memory of 4392	2444	msedge.exe	91
PID 2444 wrote to memory of 3296	2444	msedge.exe	90
PID 2444 wrote to memory of 3296	2444	msedge.exe	90
PID 2444 wrote to memory of 4392	2444	msedge.exe	91
PID 2444 wrote to memory of 4392	2444	msedge.exe	91
PID 2444 wrote to memory of 1512	2444	msedge.exe	92
PID 2444 wrote to memory of 4148	2444	msedge.exe	93
PID 2444 wrote to memory of 1512	2444	msedge.exe	92
PID 2444 wrote to memory of 1512	2444	msedge.exe	92
PID 2444 wrote to memory of 4148	2444	msedge.exe	93
PID 2444 wrote to memory of 4148	2444	msedge.exe	93
PID 2444 wrote to memory of 4628	2444	msedge.exe	97
PID 2444 wrote to memory of 4628	2444	msedge.exe	97
PID 2444 wrote to memory of 1508	2444	msedge.exe	98
PID 2444 wrote to memory of 1508	2444	msedge.exe	98
PID 2444 wrote to memory of 956	2444	msedge.exe	100
PID 2444 wrote to memory of 1220	2444	msedge.exe	115
PID 2444 wrote to memory of 1220	2444	msedge.exe	115
PID 2444 wrote to memory of 1220	2444	msedge.exe	115
PID 2444 wrote to memory of 4560	2444	msedge.exe	118
PID 2444 wrote to memory of 1036	2444	msedge.exe	119
PID 2444 wrote to memory of 548	2444	msedge.exe	120
PID 2444 wrote to memory of 4504	2444	msedge.exe	127
PID 2444 wrote to memory of 4504	2444	msedge.exe	127
PID 2444 wrote to memory of 3932	2444	msedge.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://pgwfj3k3.r.sa-east-1.awstrack.me/L0/https:/www.tiktok.com/link/v2%3Faid=1988&lzdlang=enFSmPWg&scene=bio_url&target=adclick.g.doubleclick.net.//pcs/click%3FCIO7IfjWKRXTAP84695-JulYkd&&adurl=/%2562%2565%2561%2564%2569%2576%2565%2572.%2563%256f%256d/%2577%2570%252d%2569%256e%2563%256c%2575%2564%2565%2573/%2574%2568%2565%256d%2565%252d%2563%256f%256d%2570%2561%2574/%2561%2570%2570%256c%2569%2563%2561%2574%2569%256f%256e%2578/%252d%2532%2563%2563%2564%256f%2563%2533%2571//1/010301a0212acef3-fed518cc-6066-4eb7-891e-bc1674961735-000000/bwVbIKSZBOeoF04IyyWKQqYMM_o=258
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b0,0x7ff8e9d2c188,0x7ff8e9d2c194,0x7ff8e9d2c1a0
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,5711681801851571216,8549474893490880586,524288 --field-trial-handle=2208,i,17542326850413497549,18177749464558827661,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,6652582529745953223,8753186992473962109,262144 --field-trial-handle=2208,i,17542326850413497549,18177749464558827661,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2180,i,8234690388605476579,7844540142874671672,524288 --field-trial-handle=2208,i,17542326850413497549,18177749464558827661,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:8
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,7260567775704074015,2665756706616721630,2097152 --field-trial-handle=2208,i,17542326850413497549,18177749464558827661,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,12587738802731993666,10061726161158767575,2097152 --field-trial-handle=2208,i,17542326850413497549,18177749464558827661,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,4663116225060495219,10707079768418317949,2097152 --field-trial-handle=2208,i,17542326850413497549,18177749464558827661,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,15557378824771094562,11573939882300324561,2097152 --field-trial-handle=2208,i,17542326850413497549,18177749464558827661,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:2
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3648,i,9964786391781334165,146123362600079683,524288 --field-trial-handle=2208,i,17542326850413497549,18177749464558827661,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,5305859229874226602,1616547655212866889,524288 --field-trial-handle=2208,i,17542326850413497549,18177749464558827661,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,2203792312045813154,2589644617425306063,524288 --field-trial-handle=2208,i,17542326850413497549,18177749464558827661,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,2203792312045813154,2589644617425306063,524288 --field-trial-handle=2208,i,17542326850413497549,18177749464558827661,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4416,i,7362024140567380691,15612581181177905170,2097152 --field-trial-handle=2208,i,17542326850413497549,18177749464558827661,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,16567221622344470352,11141014528097868472,524288 --field-trial-handle=2208,i,17542326850413497549,18177749464558827661,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:8
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,3277581182721249435,17111141757477582217,524288 --field-trial-handle=2208,i,17542326850413497549,18177749464558827661,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:8
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3468,i,17732446937070271096,10588041316279814903,524288 --field-trial-handle=2208,i,17542326850413497549,18177749464558827661,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:8
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,5757551925836132005,10022222934740597010,524288 --field-trial-handle=2208,i,17542326850413497549,18177749464558827661,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:8
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5596,i,9090424581043790315,9596794777148989209,262144 --field-trial-handle=2208,i,17542326850413497549,18177749464558827661,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3932

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 10a0b910d2b7a5a267ea3f76e0e8b36609068741f05e0dc289f0a031c2f9d4a7
MD5 ff0d3d15e2129b8b1b3352f74cb9bfa7
SHA1 bd3624192aa5a2db2a51a30fa1672d6d5e4a25b1
SHA512 2788615e831c6a4f233c308db2b788f06dd33bedf31fab2913f0b3c27c622ad53530eb0dd94010049212eb060bba30f560b55cfbbd9727ef187567151913736d
TLSH
T1F6613B380B5E0482E3A116B1B0E20104707182F9FF8FDE4DEF149DF55A3632AC99289B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bc08.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58bc08.TMP
Size 3KB
SHA256 242012844f3b42cc2d1ce57a90bb73748995dd0e624964c0a014f4b8280b9a66
MD5 001708effe41d80e3b4209204fa2ecdc
SHA1 e21a547d23a07bf5f2ae783240bed8827a527162
SHA512 4c8c6696a07085c10ab0f01faf8881d9ff0da68d66a8cd5ed98508b10595c120ca8cecb3b7a13c5b6541730059e7fd33e7555f9ba7265b1649533d5b54aea585
TLSH
T1066119380B5E0482E36166B1B4E20109717182F9FB9FDE4EEF149DF55A3632AC99249B
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 454c26aabf0ebd4f96f765b76fac2cf5e87c0fa3b08bdd1b381f4f1a5d38fd1e
MD5 bfb78c8e93b6b0ab4cd6e467a7fccb11
SHA1 e304c6694d96ba63d8d57adc717d23bdfb89751b
SHA512 9f071ab34b1dd3c21f5c8b3edb46236d420b7d7bc5b6cb0be9918c44e127ec4118ac066f3c1e8003209beda844ac6fbc058fb5a321170f16cc538f980d81580a
TLSH
T124118BF787E485AE8A0156F05A24EE2BCE1D0505431C7C19C9D4AF2B93E3475E00295B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 9ff288ec14648ead96ba3f14280a0cb4c88a312f7cc5e222bd1953e2d688f109
MD5 a5d463cefb15f79773e18d2a83f01805
SHA1 49b1bf708aa3c00e044ae48a457c81d3d6bca38f
SHA512 ac6cc277c67e3ed397183a3d0cfb919ed6eb212abd2278095e2f99595453414773da5b549c5a6aadaddde47c9d171a98b3b8cf994973a4730f27f145814cf66a
SSDEEP 192:sxZjRIyM/jK1Ml8MkX/f3szfgVIdpJHW6+WNGY9Iolc+1IgrJ:sxZjiMX/f3szfrJHbGbI9
TLSH
T14D42C6166A346977CCCBD209FA557F53D6F8157292A00E48ADFCCA1C04E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b31e5aa575c128a995273313c9848a5c90cb2fd18ed44bf5d76dc74eac53037a
MD5 c9a4a6a72d882d9d456c29161d77d21b
SHA1 f928778d86be5359223fd5a6f03529a249008a3b
SHA512 90b2ff17d02fafa6347e5fecae54450804ce4ed53e9067a0a6027503d7adaaef1808f62683d80bb7d89608a6f292e4f41d26d0952bde1a9beed605b163c736cc
SSDEEP 192:sxZjRIyM/jK1Ml8UQ+kX/f3solFVIdplEyHW6+WNGY9IAIc+1Ig5UJ:sxZjKqVX/f3sol8ayHbG0I+
TLSH
T1E552D816AA345977CCDBE20DFA557F53D6F8147292A00E44A9FCCA1C01E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b55159f1d3f0db4c9644305f56c5c40c2064cd903caf99888ca6ede404570050
MD5 ae1723a44f23e588ed0bad1e3b84ff1d
SHA1 da3ed3248d043bffd86953cccfa32f735e8aea9f
SHA512 8eb3119de590ea421e4979df894bf116d9c222ef4d1818a1094637486c724597dd229406f9f127278e897a2d75067c74ee04ce4a67bbfbade3f399de9e8d1be1
SSDEEP 192:sxZjRIyM/jK1Ml8MkX/f3solFVIdpPEyHW6+WNGY9Iuzc+1Ig5UJ:sxZjKMX/f3sol8MyHbGJI+
TLSH
T15442D716AA345977CCDBE20DBA557F53D6F8047292A00E44A9FCCA1C05E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 aed1117dbd5d40daa6c701454064a51906d89528ba8a86f1c3e022d321bdcd7c
MD5 f829c6d63dfd7e7413f77bf9b01fb372
SHA1 d1f98d388966bf1bdf718aff14bb48ba628ff43c
SHA512 0dcff72503fe99636e9e222d5999ecccee2c5ecad1ed36075bfa7fe49b0d871657ab1aed16f497e64a2069d843cc90295d37796dba19487abf3a4e945e2a9e7a
SSDEEP 768:j8cv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWN5ro1g65:j8cv21wWvu+Z+u1jaeFLeRNy1p
TLSH
T189D20A2B280CCB7E4F841E9CED2A6F866ED801CB57988D5447FA894C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 55831977eadc79fb8f1fb6222dae2fa5290e85dcb2c83e734cc7c0d912847c30
MD5 f33cfee32cf6a353dea4bbcc453a99b7
SHA1 1cae1f401c6d5cfeb85b68be889aa300a821ec72
SHA512 7407cd04e3f3e2bb17c023e8725d9617ca1dc5be04b59fe2e554b63b2680a86f13836294f109f747c35829da7db4ca7d5fa16de4bc761fc799f814b3085abd13
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDWeJWKik6qgoKZCs:mTe93z
TLSH
T17291AB1131BA03417C3F681C9265A67F3A4276577458EE3F7B6800A24E67E146CFCACD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5957fa.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5957fa.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 be079dc0ba9fa321c396677f0b2d4e58f22d25ad6741cf1a40083f0031731cec
MD5 900b4738ee3333295b20e835044fc0ae
SHA1 1794987c42e2a45b6848b4a864f78d51b8c3dffd
SHA512 c0bc99678a78cef1c6aa2af598bfe89267d694d018a2922c5599263f3854d1f40aa47ae4c06abc09e92ef96b815775e6d026a0f9f15d8ee4aa0b8ab88037bd98
SSDEEP 192:upLsNyUYXQTJMdk+YLe3IQmiU1B8Y4e+CGD+FdeP9osNOeB83JigWqfU8:+sNyUYXGJMdkziYcne+CBd0esbgbU8
TLSH
T12D322935AC386C675EA7A544F44736139FE84177DA893F84DAEC6F0C01EB6EC230691A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 99cc469757589f1a878d6fd58e8287f75e050e58d9f483f19270e91ae9dfb59b
MD5 7ef70cedb16958176acd1910e6fe9ac6
SHA1 ae2c226023278eaa3e96886fee5936d41d52bc96
SHA512 60b95e0c96a7b87b0a8c3af1e46d139c6659592c609d065e2a4335f00fe708802ecfd18aea21905aa0dccb81a48376c5a1cf01dd745fd6bf7c2863879ea668be
SSDEEP 384:4ZcIhsNyUyGJMdkziYcne+CBd0esbgbiv2uWo6:GhaeeJxsbgbieuWB
TLSH
T1B2827D355C345C661EBAE145F88735139FB88073D6D97F8099ECAF1C01EB6E8230692A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 55aa642b9c570d9ca1094c0cb85f7887352942a6497a89bed56fc832d7047e62
MD5 43fe0f6dc57441d3e8f61851610d5d7b
SHA1 ace7cb4d74feb1693d635d5d0b32780f09170155
SHA512 342005df81c4b635cf9cd07ffbedf3027b2feabc2df3d8209cf8829efee66b626f68f3a1e076d11b5937ce06a26d430bbbf2b2946b9cbd8f64b773150b67dfd7
SSDEEP 384:5hiFiZcI/sNX8TUNTUlIlyGJMdkziYcne+CBd0esogbiv2uWo6:5IFQ/CwgZeeJxsogbieuWB
TLSH
T1D5A26C368C648C7B6EBAAA45F94631138FB84073C9DABB90A6DC9F1C01EB5DC1307D15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4593d46c87c7b1edc1d3bf6670d1c7aff23e0276a350dbec3cd7a672e4dc07f7
MD5 ae87540e2379eb6136efb433e460c451
SHA1 e3501b731a796961cb18009698bdd81390fbffb2
SHA512 5dab30322372a6fd5a62f7db53883c556c10ff4d666005f59ff80d78a59f82b9e00a6fce40495cc4b4c41ba38f9b5db67b3c7d100533eae9f3f5feaa8c20a5e3
SSDEEP 192:JONa6v+YLNQmiUyC7Zh+CGD+FdeP9ospusg32AU6:JONa6vz/vZh+CBd0esJgmAU6
TLSH
T16702EA39AD382C7B9FF2AE45F4873A175FA82177E9912F85D9E81F0C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 db2be3f21335eb58f79d6b9a9df8d5e71b594e4a58961735be5e069da8d9c1e0
MD5 92f348df88c90fc033bf256bd37908a9
SHA1 4d7bc73bf622eff53db905c409b6e8212508e51e
SHA512 e58247bfc773fcb8c7210bad5c95faf1215fe69e130d4749574aa24ee5e383739c49e4daaf5b7d0a081bf2c68685bcab41f41d8b144342cb900d69f530dd4080
SSDEEP 192:5ONg6v+YL8QmiUyH7Vh+CGD+FdeP9osNOeBrCHgWqfU6:5ONg6vzAkVh+CBd0es6gbU6
TLSH
T1A0122C35A8786C6B5EE2A545F48735135FE45237EE8A3F80D5EC2F0C01EF69C2306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7e89501b-63b6-433d-8102-beec445ffea4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7e89501b-63b6-433d-8102-beec445ffea4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7271d3fff30ba3042b9d3b5e0713c6af7c15d61bcba0d3e9157ff8a69bd9956f
MD5 f826ff58d06677bda9e9c072bc595e17
SHA1 7e07e472d26b587b1c31bc63ac65d4048df57273
SHA512 914068c8846b34c0db1396ea5dcd4a8948792733b710f59698c176e201729afbb08b001795c7853fdd33108e5b015f8a49931288a3af35e559912476f31b4752
TLSH
T1C0410B8CB6F91148B3B76E5AAFF7A86E447A79732F07805D00110D8E0A72B44C872B37
MD5 SHA1 SHA512 TLSH

Submit Download