hxxp://paypa1[.]com

Analysis

user interaction
yes
max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/07/2026, 13:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://paypa1.com
Sample260711-ql2rnsds7s

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1204	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134282497158285063"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{EAE1EDFF-1D7E-40C9-951C-1DD82EC83937}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1316	msedge.exe
1316	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4384 wrote to memory of 4300	4384	msedge.exe	84
PID 4384 wrote to memory of 1204	4384	msedge.exe	85
PID 4384 wrote to memory of 5028	4384	msedge.exe	86
PID 4384 wrote to memory of 5028	4384	msedge.exe	86
PID 4384 wrote to memory of 5028	4384	msedge.exe	86
PID 4384 wrote to memory of 4560	4384	msedge.exe	88
PID 4384 wrote to memory of 4560	4384	msedge.exe	88
PID 4384 wrote to memory of 2120	4384	msedge.exe	89
PID 4384 wrote to memory of 2760	4384	msedge.exe	90
PID 4384 wrote to memory of 2120	4384	msedge.exe	89
PID 4384 wrote to memory of 2120	4384	msedge.exe	89
PID 4384 wrote to memory of 2760	4384	msedge.exe	90
PID 4384 wrote to memory of 2760	4384	msedge.exe	90
PID 4384 wrote to memory of 3672	4384	msedge.exe	91
PID 4384 wrote to memory of 2804	4384	msedge.exe	92
PID 4384 wrote to memory of 3672	4384	msedge.exe	91
PID 4384 wrote to memory of 3672	4384	msedge.exe	91
PID 4384 wrote to memory of 2804	4384	msedge.exe	92
PID 4384 wrote to memory of 2804	4384	msedge.exe	92
PID 4384 wrote to memory of 3804	4384	msedge.exe	96
PID 4384 wrote to memory of 1620	4384	msedge.exe	97
PID 4384 wrote to memory of 3804	4384	msedge.exe	96
PID 4384 wrote to memory of 1620	4384	msedge.exe	97
PID 4384 wrote to memory of 3948	4384	msedge.exe	99
PID 4384 wrote to memory of 3024	4384	msedge.exe	100
PID 4384 wrote to memory of 3024	4384	msedge.exe	100
PID 4384 wrote to memory of 3024	4384	msedge.exe	100
PID 4384 wrote to memory of 2780	4384	msedge.exe	101
PID 4384 wrote to memory of 2780	4384	msedge.exe	101
PID 4384 wrote to memory of 2780	4384	msedge.exe	101
PID 4384 wrote to memory of 4020	4384	msedge.exe	104
PID 4384 wrote to memory of 4020	4384	msedge.exe	104
PID 4384 wrote to memory of 4020	4384	msedge.exe	104
PID 4384 wrote to memory of 4356	4384	msedge.exe	119
PID 4384 wrote to memory of 1780	4384	msedge.exe	120
PID 4384 wrote to memory of 4116	4384	msedge.exe	121
PID 4384 wrote to memory of 3572	4384	msedge.exe	124
PID 4384 wrote to memory of 3572	4384	msedge.exe	124
PID 4384 wrote to memory of 1316	4384	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://paypa1.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff92152c188,0x7ff92152c194,0x7ff92152c1a0
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,7848979442561676802,5031978975995152131,524288 --field-trial-handle=2272,i,9837185749872598065,6189448598724889049,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,3050111979280905776,1831818156960301601,262144 --field-trial-handle=2272,i,9837185749872598065,6189448598724889049,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2528,i,1989940538014126027,4756247308931276500,524288 --field-trial-handle=2272,i,9837185749872598065,6189448598724889049,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,2638749059083273353,13394497911018654385,2097152 --field-trial-handle=2272,i,9837185749872598065,6189448598724889049,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,9684445956024740948,3163816434857115897,2097152 --field-trial-handle=2272,i,9837185749872598065,6189448598724889049,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,8774309652804964854,1812954333979373593,2097152 --field-trial-handle=2272,i,9837185749872598065,6189448598724889049,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,2426371564313607440,10122835439117833991,2097152 --field-trial-handle=2272,i,9837185749872598065,6189448598724889049,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:2
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,4423262486810151664,1949718710411324719,524288 --field-trial-handle=2272,i,9837185749872598065,6189448598724889049,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,13042507021829699146,3988504887696634541,524288 --field-trial-handle=2272,i,9837185749872598065,6189448598724889049,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,4032370759760710702,17349196446313850692,524288 --field-trial-handle=2272,i,9837185749872598065,6189448598724889049,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,4032370759760710702,17349196446313850692,524288 --field-trial-handle=2272,i,9837185749872598065,6189448598724889049,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6204,i,11133421521743647709,11749731456194036710,2097152 --field-trial-handle=2272,i,9837185749872598065,6189448598724889049,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6196,i,3048162848291863199,782810304306521969,2097152 --field-trial-handle=2272,i,9837185749872598065,6189448598724889049,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6188,i,1357667845682487688,11620533135138701151,2097152 --field-trial-handle=2272,i,9837185749872598065,6189448598724889049,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,3614186995147573676,7507436351019240901,524288 --field-trial-handle=2272,i,9837185749872598065,6189448598724889049,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:8
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,13670229066359421255,1488494235476798974,524288 --field-trial-handle=2272,i,9837185749872598065,6189448598724889049,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:8
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,16478373814867541952,7156029009680398085,524288 --field-trial-handle=2272,i,9837185749872598065,6189448598724889049,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:8
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2096,i,225699888805287047,13703629880195965995,524288 --field-trial-handle=2272,i,9837185749872598065,6189448598724889049,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6148,i,702220221135123779,10265832114848546226,262144 --field-trial-handle=2272,i,9837185749872598065,6189448598724889049,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1316

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 201729318e073e437978c4f830a6df095e397d14193bbab8cb94016e3e0e1540
MD5 038903102cb76ddedd18207430e00005
SHA1 e694b970e01eb43fddfb00d36857e2b64f8c931b
SHA512 bacb50167c8d736bccc259f2ffbffff915c7c6dc188c6c2c1476ded8cbd822ff968f690173d1b8e35c352ec62f9ace3913a556b80bc1a59211be000ee9ea7447
TLSH
T17DD092207759A6C3E24704BA94A5AB52A916C57AA0B7F7027232640CAE66089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000081

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000081
Size 373KB
SHA256 555fd0a56bc4d82eb19240bfcec1574547d8f358fae3f3c4ee781fb6ab090f0e
MD5 c4146a564cbb959cdaf2b89f094c7d90
SHA1 6c30832e0546bada0913f0be058aa41add682ff6
SHA512 9a0082b6c893eb0ba9ff8784d2045741e3d8dfa14d0cf1d85efc2988b2816791d07f90169ede9497152027e1b3357159a17f7f64a23ee5105b957853fb603c7b
SSDEEP 6144:bBJrp9XIMsAWa2DFx18FEqFfidxwAvUV2jWLnqqZK00T1I3veGV+9mAP1Qis:bj4L3B/q2wAve2iLqqI00ZI/eIqP1Qb
TLSH
T121842314159545FF42E9C7FAC1A969AAE0AE9D08F10BF1EA22C4F35264C0B3F1ADE531
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 81fa6a1d1c9778ab3890ab9904fdd3df114b7e09b543b828fb2e0f333a730e81
MD5 2d6d0bf30b6362c4c780536e801bd890
SHA1 daea6fc075e5fa9fd7af02f5628892a353d52585
SHA512 51a9de6f077872455e9a0da3df946a561b28022c1699c78849f3f3ade0eacbfd00d8e2aea88a5bfc77c77170a020eafdc08c9fa190a914ccff3b40b21590879a
SSDEEP 48:rNzJNuJXxiv6vWVDZkc0pAjtVllB/h1hz4WcVHk0mpqLkxoJrPpqczl:h1wJhAgpAZ/pYK0dQ8McJ
TLSH
T1BB91D7324196479BFBEE827191C11655B131AEE5FDB3FE021F1374794A0AFF08166349
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe584d31.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe584d31.TMP
Size 3KB
SHA256 128c63093813fe2ddfda07d45efcac766fc8493dd8e1cac9899ad30687d2fc7d
MD5 ce27243d95b6f77d5842f1215be4aaec
SHA1 8a919dab8fc1092bf0613199f98cf0168961705d
SHA512 9c49565994ccba67d91967cce902a7f336c46812afe22b08a82c132080c63f15286b8725ed18d5927b12354c245d251d3031489afa002dc58baeb20e6af22369
TLSH
T171719334551657DFF7E602B290C12259F6328DEAFE273E412F2379B55A01FA08169388
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 bda2cb3b6a4968e1a988192012eb8229faeca54911b4c91d463ed1b3621292eb
MD5 c30efe20b3a08bc7cf37420c9078e01e
SHA1 eee2e5770c7cb3e250dce1a605872644f33383e3
SHA512 e45bddfb921071d1622f7a415374d977824f80d9aae3a5092fc3d76a31e8f7301e4b0ad88734a5565210c12694366b6469198d753d69aec42bf039c5b4e28a58
TLSH
T1CD515AF783F0852DCE116AF0AA28AE1BCF5D0511432C3D6589D4BE97A3E2461E206A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 67482130d7d64ca9c14f89806528d664fa5a3a95593fcb721f039db902f0c32e
MD5 7b7f89b808216b2cbe7547e82707f70a
SHA1 1c9f563bab2aedb09a5cf35f8d60265bee6b334f
SHA512 6df296eeef81f4ea1598fed6b31d4233b263ba0901703c07a2650ada854ec570b2cdfb41b59e6a5aaa14e05ccdfe9cbd7941136be14f5df2dfa37b2b8ede3408
SSDEEP 192:sxZNRyyM/jK1Ml8MkB/f2sRx+fIdp6x2HnD6+WNjpm/YI9+c/IgrJ:sxZNMMB/f2sL+QLH4s/L9
TLSH
T1D052F8526A349977CCDBD209F955BB53D6F50472D3900E44AAFCDA0C04E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d7ea0c71b0be199b9611bcef202d46a547e82a5b055d61cc5067db7fa7cc5ce2
MD5 a34a2d8c4754d517f3f9d8a29345fadd
SHA1 1deaf6fb7b70b30774a97a017f743544697179f6
SHA512 1994cf6d0fe08f1d43c9fcf5904a06bee619133769927956f45be171808f42730781b03e2ad44cd15e2064a659d69b4d945f30d5dd456721b3bfa495305bc482
SSDEEP 192:sxZNRyyM/jK1Ml8UQWkB/f2s4xYfIdp4x2HnD6+WNjpm/YIJ1NRX/Ig5RJ:sxZNMq9B/f2ssYQZH4s/zZvF
TLSH
T1D252E7566A345977CCDBD209F985BB93D6F5047293900E44AAFCCB0C05E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 c1267797f8c396e43d974da820fc2fc9b540985038e047294e2450659c3c4417
MD5 7a3e0a2a5c5b8e1e64dca0094df1a778
SHA1 9421f1d49226614ad0a4383d3fab1cf528fc54d1
SHA512 8062e68256697c86b39022e765fc0fc3d012e5aff2e13d695efd75a8e6ace3be262deabe0317b8983ab7718e9b163c0aaaf270c0c320b0d32bbaceab901d1aff
SSDEEP 768:MesqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9broRHQ:MesqxXlWvJD6Tu1ja54LAs9oRw
TLSH
T1E8D20B3B694CC77E4F840E6CEC266FD66ED801CBA7988D5447FA884C02CB2EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 cfcf62d3be4dd94e67d8365e38c2910e8aa52f697acd2b2f3d37f0887d9043d8
MD5 d10c30c753c5a05a32c07f6106187015
SHA1 2cd56e8063841cca6b20e094a2c48174ee3e0ff1
SHA512 4cd5f3a97954fd110f42f64db0bd829b5cda6a295ee2f279045b2292057ac91c79161ba76ee89b6cbbd1b728d10b90609a9a1373e6c63e028a2477befd887903
SSDEEP 48:KPYNs4iCiac6vpI9IaKGveOaS4K7H2oTy3JMdIdKegIvyNHIFKMkoQR:KYbaKYIKvdCKegCeHuKMkfR
TLSH
T115A1FF1A357A0212387D3868A2669A375F413A63701CE46E3FB850664BA7E110DFDDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a2f80a0c-abe8-4154-827d-1c378283e215.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a2f80a0c-abe8-4154-827d-1c378283e215.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 77cb4fefce2e07892c61293d81199869a61b88200b86e4a8d1d20e869629b2e2
MD5 c04c01b345d33906a6df8895e74dd184
SHA1 f471d0d1e454c5c793afe6080b9717d9ed15d1d3
SHA512 ac0443569222cae987d5cd4ecfd97caad5910d0b90f0eb04593a4927a8475fe0433a56f31ac81601cc06e96a1c1808e98370bd1ad23bebb24f5668fa92e312b2
SSDEEP 384:otNn/s3n9SfsNXiQZbqncDVRNmd2OYo8NOObjI9G6w7VUg:oj+9U3chHmREN29MD
TLSH
T15D929D325C245D379ED3545AF08B36179FF4917B97C92F8096EC9F0D02CB6AC0326926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 1fe3ea8223c66bf2ad42070cb8d0c57091a37978a3024f151fa0faf51936ac8e
MD5 235f29016e3cbfa8963a6f720feb08c8
SHA1 89245d969e3cab127e498cadc446b688082683f7
SHA512 a626d75360e528b8d1ee7d6448309b14cfbf252825d27ec17e7f98d5c2b5ea4269e0836978d256ba24141de591cb3037346b53f9589c4002a1fd4b43073a432c
SSDEEP 384:siF1tNn/s3n9SMzsNp8TUNTUlIliQZbqw6cDVRNmd2OYo7NOObjI9G6w7VUg:XF1j+9rIwguchHmRTN29MD
TLSH
T164C22AF248D7493BD99E4B47E77E2D174EBCD167B6852A40B3988A0CCD861BFC306921
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 39a6e3b2161d809521b6cc07ac35b8acf81ed9b9660d85b889528db38cec3dca
MD5 360473dc9b5a651e17d8b4e66c5239ae
SHA1 bcf7ef4ef6ec479bafe8f180f7a1cd9c12993e0f
SHA512 f4e0f4fc79901a05f10e6625a7b0da1e6aeef73c085c29218604b1dc3b82c1024798758a471562b9cddf62c85e29fd13ddc07a2d0841c4ed499a2947ffe5cb41
SSDEEP 192:tON06JkRtQmiUyf1W+RN5+Fd107sh3+RHJU6:tON06UraW+RNmd28KJU6
TLSH
T14102B835AC382CBB9EE26D0AF58B37135FA5216BBA952B84D6E81F0C01D765C1307937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fa6d65f081e7dbb853cf99482e7a74c0605aa4e72a4444d54442c97e8c828670
MD5 5e8ca7746cc3a12921807436f2b7f75b
SHA1 e13ee73eb799fd7b5b1965bc5df18563f7a07d09
SHA512 aeee229cd76e3f9697d209b080e678b3db9db94d777676a8680b384b1fc25b69d183dad82ea4a45678fdc1b66af7add78eb0bcd4914593f0393ac215017a434c
SSDEEP 192:tON66JkR+QmiUyP1R+RN5+Fd107ptpefPwoUiVcsqgkU6:tON66U60R+RNmd2OYogNU6
TLSH
T10212F93668686C7B5EE36845F48B35135EA55127EF8A3B8096EC1F0C01EF5AC131BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 03b4a61f0b47fb835719e59f66772a36c95e8c41f950590456c3c56056dd3ab0
MD5 2ecb6c18ca5b61a18432c1741da152ab
SHA1 dba256c91d189bf19bb41acd494b1c4e8cbbe68e
SHA512 4898844335784775169427f0917b65a2b588c77440ba1f01267244c71d50d51e604f34fe67246fc8acc2f57b88650ccd070255f7ad338c9f600e50348eb7f65e
SSDEEP 192:uwLsNXVQv2lgNQkRb7qQmiU1JDcM4VRN5+Fd107ptpefPwoU0SRsqgkK1CG:5sNXVQZbqncDVRNmd2OYo8Nk
TLSH
T1B7422932AC385C7B5EE76445F04B31039EB49167DBC92F9496EC9B0D02DE6AC131BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

54798872-30b6-4528-bead-321b6a8d3493.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\54798872-30b6-4528-bead-321b6a8d3493.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 34d4003f4f1bbc1c0346020e9ebce94e0cbcd7a4b518c37b81634ef627b1d326
MD5 ee68a0bcf4e626248a68fc4dce21f311
SHA1 f8c3f1123292237e674ac82129756808aff7e6e1
SHA512 e840f9a0963b4d50b0a1a5e4a418ec7bcdbfa6c099d98ba55ce28b94d9573666c11bbc51131d74257a70c2ecfe610bfb942e6bb70416de3c7a2e41516462bcce
TLSH
T1BD412D98BAE91148B3B77F5A5BF7A86D447BBC772E06945D10110E4F0A22B40C9B1737
MD5 SHA1 SHA512 TLSH

Submit Download