hxxp://pay[.]financialeducation[.]us

Analysis

user interaction
yes
max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/11/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://pay.financialeducation.us
Sample261104-tkpbqsxy9j

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2000	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{969BA0A5-B903-4F16-A1EA-EF6BFA985F57}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4496	msedge.exe
4496	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 4604	4324	msedge.exe	83
PID 4324 wrote to memory of 2000	4324	msedge.exe	84
PID 4324 wrote to memory of 2452	4324	msedge.exe	85
PID 4324 wrote to memory of 2452	4324	msedge.exe	85
PID 4324 wrote to memory of 2452	4324	msedge.exe	85
PID 4324 wrote to memory of 404	4324	msedge.exe	86
PID 4324 wrote to memory of 404	4324	msedge.exe	86
PID 4324 wrote to memory of 3844	4324	msedge.exe	88
PID 4324 wrote to memory of 3844	4324	msedge.exe	88
PID 4324 wrote to memory of 3844	4324	msedge.exe	88
PID 4324 wrote to memory of 4176	4324	msedge.exe	89
PID 4324 wrote to memory of 4176	4324	msedge.exe	89
PID 4324 wrote to memory of 4176	4324	msedge.exe	89
PID 4324 wrote to memory of 3740	4324	msedge.exe	90
PID 4324 wrote to memory of 3740	4324	msedge.exe	90
PID 4324 wrote to memory of 3740	4324	msedge.exe	90
PID 4324 wrote to memory of 1340	4324	msedge.exe	91
PID 4324 wrote to memory of 1340	4324	msedge.exe	91
PID 4324 wrote to memory of 1340	4324	msedge.exe	91
PID 4324 wrote to memory of 2404	4324	msedge.exe	95
PID 4324 wrote to memory of 2404	4324	msedge.exe	95
PID 4324 wrote to memory of 2404	4324	msedge.exe	95
PID 4324 wrote to memory of 3400	4324	msedge.exe	96
PID 4324 wrote to memory of 1072	4324	msedge.exe	97
PID 4324 wrote to memory of 3400	4324	msedge.exe	96
PID 4324 wrote to memory of 1072	4324	msedge.exe	97
PID 4324 wrote to memory of 4476	4324	msedge.exe	99
PID 4324 wrote to memory of 632	4324	msedge.exe	100
PID 4324 wrote to memory of 632	4324	msedge.exe	100
PID 4324 wrote to memory of 632	4324	msedge.exe	100
PID 4324 wrote to memory of 1296	4324	msedge.exe	109
PID 4324 wrote to memory of 2220	4324	msedge.exe	110
PID 4324 wrote to memory of 2816	4324	msedge.exe	111
PID 4324 wrote to memory of 4016	4324	msedge.exe	113
PID 4324 wrote to memory of 4016	4324	msedge.exe	113
PID 4324 wrote to memory of 368	4324	msedge.exe	114
PID 4324 wrote to memory of 368	4324	msedge.exe	114
PID 4324 wrote to memory of 1972	4324	msedge.exe	115
PID 4324 wrote to memory of 1972	4324	msedge.exe	115
PID 4324 wrote to memory of 4496	4324	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://pay.financialeducation.us
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ff981d5c188,0x7ff981d5c194,0x7ff981d5c1a0
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,3332872954829051883,12801384242112341804,524288 --field-trial-handle=2264,i,8371967404223023482,2763852586475768584,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,9678024015893053931,8828885059441438382,262144 --field-trial-handle=2264,i,8371967404223023482,2763852586475768584,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,9127178467866774199,18229448318459223403,524288 --field-trial-handle=2264,i,8371967404223023482,2763852586475768584,262144 --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:8
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,17124958781852136461,15558603328177983159,2097152 --field-trial-handle=2264,i,8371967404223023482,2763852586475768584,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,10513603205198834326,11707594759498111095,2097152 --field-trial-handle=2264,i,8371967404223023482,2763852586475768584,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,14053427405702473630,17199267269432406385,2097152 --field-trial-handle=2264,i,8371967404223023482,2763852586475768584,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,8359637627735197960,11749667475949741518,2097152 --field-trial-handle=2264,i,8371967404223023482,2763852586475768584,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5052,i,4651111663056517473,1450823843381647337,2097152 --field-trial-handle=2264,i,8371967404223023482,2763852586475768584,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3532,i,15388554864127829320,14884206578202942072,524288 --field-trial-handle=2264,i,8371967404223023482,2763852586475768584,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:8
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3524,i,2470144387499323917,9183471664262060468,524288 --field-trial-handle=2264,i,8371967404223023482,2763852586475768584,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:8
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,14396032189444653532,8400548236443275828,524288 --field-trial-handle=2264,i,8371967404223023482,2763852586475768584,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,14396032189444653532,8400548236443275828,524288 --field-trial-handle=2264,i,8371967404223023482,2763852586475768584,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6184,i,4628177087530504483,2151875092390793005,2097152 --field-trial-handle=2264,i,8371967404223023482,2763852586475768584,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,7170721442046839379,985268940319973408,524288 --field-trial-handle=2264,i,8371967404223023482,2763852586475768584,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:8
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,8716439246594964475,9771870880718188889,524288 --field-trial-handle=2264,i,8371967404223023482,2763852586475768584,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3612,i,9496514442769419944,12894013943812244295,524288 --field-trial-handle=2264,i,8371967404223023482,2763852586475768584,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:8
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2768,i,1613796840583684374,2984619789451765113,524288 --field-trial-handle=2264,i,8371967404223023482,2763852586475768584,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:8
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,16775688985291668078,14746430041753986875,524288 --field-trial-handle=2264,i,8371967404223023482,2763852586475768584,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,17604014174102905147,14410322639953729229,524288 --field-trial-handle=2264,i,8371967404223023482,2763852586475768584,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:8
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6072,i,2682641492756536794,13106689825669000709,262144 --field-trial-handle=2264,i,8371967404223023482,2763852586475768584,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4496

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2e50a6c9-119e-4c9e-a35d-90f166fb3d90.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2e50a6c9-119e-4c9e-a35d-90f166fb3d90.tmp
Size 8KB
SHA256 560cbaa3c8f4cf847ea3ad31af7a76047c1570ea88a91ad4276227d645a457bf
MD5 cc96d549abc58add69b107c850a09108
SHA1 4a5d3cd3061e13fa1a8aa922a040f15100ef6db8
SHA512 a8047370fd698cdeca5e39ad09c6eef2b2491a99ae32f6d4fa32190b3efd77afdee302002df7aaeda01341f8f3841fa257ac863bcff49a26c4c9d9bd3f035a28
SSDEEP 192:SONh6iDCQmiUywNHq5u88PEvIBBSqaABROU6:SONh6/THq5u8igA3a4OU6
TLSH
T16C020B396C787C7BADE2AD15F5877B179FA4013FE6941B84DAE8172C01E768C1303822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

404a351d-6b86-4eb9-9b72-bf4ba8421a36.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\404a351d-6b86-4eb9-9b72-bf4ba8421a36.tmp
Size 18KB
SHA256 cbbce9436b0727181537c6ebc25720682fd150025c039654d7a2f277615d0bb7
MD5 dd6006d6edf9cd90cc2442ca8bf21646
SHA1 b020dfaa2e18da16dcd89a2523267d65b067ae8c
SHA512 58f2a24acb560516ddafc864a6d63a265bfe8849a2da6b5f2bb267e25259f3eb3cca791ba739216a319298cde9971a3db83ed84025e98b978fc79b40723a9bef
SSDEEP 384:3QkUSv0sNsQmewwNxu7p5u8igAAZYofa5H7vBE5BIIlG:J0QkjkjEna5H75EHL8
TLSH
T1C1828E31A8B86C3B5DA3A525F24F3607DEB8825BD7D85F80D9DDAB1C01DB2C82347916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

662548df-fadf-4a57-85ac-548648c9e7b7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\662548df-fadf-4a57-85ac-548648c9e7b7.tmp
Size 18KB
SHA256 f067898f0e54a217ccb7c4f3989c1102e35f34d9095892728c9734c90003e6c7
MD5 37ac8ecdd228126b289379e0799f0fc6
SHA1 105a8f7273e6bbb2d175885a891e14d0b67a980f
SHA512 4b95114f48de52de492972aaf231c35179eda504bca5f206ed2bbfa62922b23a7435ff1020e8ec42ee3558d9b93eafd02534a374775e33b92b4b6e55eb15df49
SSDEEP 384:JQkUSv0sNsBmewwNxu7p5u8igAAZYofa5H7vBE5BIIlG:r0BkjkjEna5H75EHL8
TLSH
T191828E3168B86C3B5DA3A525F24F3607DEB8825BD7D85F80D9DD9B1C01DB2C82347916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7205457a-30ba-4e9a-94d5-7a0fa96e8c81.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7205457a-30ba-4e9a-94d5-7a0fa96e8c81.tmp
Size 21KB
SHA256 82e9c4b3e6b8aa67dcc0566cf1fc497583495fd69e660da06219577d2d7c9d9a
MD5 dcac6a18cf6f6b9abcbe4cb286fa30eb
SHA1 9417f2c74ae1105f707b874ea5a113698ed67123
SHA512 7b68ea071dcb37d3aae85fda80328c177d2368c523e1051a9eadb08af0062bf42df2717fc7b19a23d8924c0b8cc8101a8f43a9900ae86328cde1d540dd22dfac
SSDEEP 384:HiFzQkUSvWzsNk8TUNTUlIlBmewwNxu7p5u8igAAZYo0a5H7vBE5BIIlG:CFdm5wgTkjkjEMa5H75EHL8
TLSH
T151A26D3298989D3FADB29A65F24E3607DEB4425BC6D4AB90E6CD9A1C01DB1CC234BD11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 61a97be736e0441d45644d31b38bd9bef6c1bd260fa1ecbb5d099fa493fee6b4
MD5 99bbd8400adc948f85ebd87cb24b3fcb
SHA1 c8fb9564ede7ecb06cef446bdb527025127a796e
SHA512 75b3ee70eca487cbbfb3d5b4b25bae158ff99188ab36d55f391e9f80c51ce9fa433897d79a0ae37ad64698bc3eb5aa9a10a49116fb8f7f35ed0a6e98aa8321b7
TLSH
T109D022C8F2A0300CE00C3233A02BCE022B88CEA8F0032BCA000E8C80E8800C80CF2C8E
MD5 SHA1 SHA512 TLSH

Submit Download

161a8458-454b-49c9-b61e-cc9b75ef4956.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\161a8458-454b-49c9-b61e-cc9b75ef4956.tmp
Size 10KB
SHA256 2bcbe6dc4b5bc16a437b64452d419dc1dd19faf60056c78f4791314ab48a208c
MD5 95e7864bef9874426a89bcdf8b232206
SHA1 3183513f39b10899cc692b8c06b273e4a118fdfc
SHA512 7170a9e8e61dcdae695b4041005dc9f7c4fd2152aaadaf3f725d9246bba658e275b74a3e2826ca3e26831ea092b797ef8cc29924bc051fbd89ff96efaf900d6b
SSDEEP 192:sxZCRGWZ/fesJoIIdpkAHnA6+WN9yXYaJTA4Ig52J:sxZCfZ/fesJo5BHZkVU
TLSH
T1E822B651AE68A97B8CCBD219FB19BF43D6F9503291D01E48EAFC851C05E76DD224780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2076cbc7-dfc9-49ed-aad4-398730e32492.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2076cbc7-dfc9-49ed-aad4-398730e32492.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

80f34223-df4f-47db-a9a7-d1d48542acb5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\80f34223-df4f-47db-a9a7-d1d48542acb5.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 7729a6a1d1a93a83735ec81542b13667c39c03dd868b7c3772742006a32806be
MD5 bbc57f6dbd1c7eb9e9a6f73fb9de6072
SHA1 b0df3f198316cc992c83be5d5abf3421fda58755
SHA512 50c363338236ecc2a1f34b472ba93a3c9db083e38690a238d41a8cf0b538f261914fe11dfa9ea763547860c5270e12eef279ff83d1d4008862ecd4a0e9a0d679
TLSH
T146E0268A04CBE33FAA0874C701B8674E8380361A93C0BD0F1B04C584F241880A69BAA4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 568a412662e987cf9a9cdae25a4d2e15ad63180ef33f9af1013013b466a03fb2
MD5 0946e78f6fae264dd10c8d8b9f630dea
SHA1 a9ee5e172f554590eed545ad90883fe660c4034f
SHA512 af46f8d5123a13246765a3aa42f3a57ad44f26c18de1559cd46d3c78f3a5a4f1c34654b959e1ac9319236923f3087dd4f1fefbf1236707d4a3fb8ccf4bcac35e
TLSH
T1E3E07D8505CADA3FA248B4DF41EC5B0F82D1372EE3C06D0E5F08C584F101840B2CAAA4
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 fec0e13e1a4f2cfd8e1d96571ff72c0eff7d08d6af2675b8d5185c8ac25a26f0
MD5 eb8b4601b38220c209241c6cbca0bf96
SHA1 3e33ac1ef9dba5ba274ded865b9c0d3196b6cbd2
SHA512 86d710ca602d8667cee1a16f91a4dc97e0aec1176e7e513dddfcfce10a5a8d29c52d9c5645fc7af74913476e7f58a592cdac89e90d33973dfa33460b0d293e55
TLSH
T1906181B5F44434A8FBA8C0F394E5ED8B3A795081B9C31E221168FBFD68463C49F3A118
MD5 SHA1 SHA512 TLSH

Submit Download

dd5fd2e0-e4a7-4a0a-a272-abc125c5d512.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\dd5fd2e0-e4a7-4a0a-a272-abc125c5d512.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

32fd1027-59af-4923-a12f-10754f5186a7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\32fd1027-59af-4923-a12f-10754f5186a7.tmp
Size 1KB
SHA256 a5711eca9ea635d552cff3cfa8d2a25c45bb0e8880da505ab1162e3b7a9e340b
MD5 f99f8e9beeab4e60bae83029cb579c00
SHA1 cf00948ec3a3f71528f8bda79bbc9c04398577a1
SHA512 c24940fbab4270d58010cf2e72ab2c3118ec9f24f6d97c3c42cabd80b314a6e09b8c4b23e2ed4d0890c6df08fa01ce406b3522b7714668859788faaa96b59ffa
TLSH
T13B31B9F7C7E4917D89010AF09A18AE2BCF2C0A66031C3D5AC4D4AE1BD3E38B1E20161F
MD5 SHA1 SHA512 TLSH

Submit Download

4846f308-c053-40de-abce-00e290b01d64.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4846f308-c053-40de-abce-00e290b01d64.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

65e0533c-846e-4e8c-963e-9f851c17380f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\65e0533c-846e-4e8c-963e-9f851c17380f.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 49ae01c6a1358de10a71294f38bc6995bb28db56630a7e6d9485ea2297e40354
MD5 9130f13f8e1a6ffebb8e044d4975ae88
SHA1 12148e39227da2dceec45a22465e39489782136c
SHA512 299465d54b1ef2c2e980346ca458810a91f168ddbbb49c11c7a5d06e7ff9be855110a31b440f3abeb43e5b41ca9d1ab559ae091ef57c792538238445cd777962
SSDEEP 192:sxZCRGWZ/fes3oIIdpkAHnA6+WN9yXYa+/A4Ig5cJ:sxZCfZ/fes3o5BHZkc+
TLSH
T1A922B751AE68AD7B9CCBD219FB15BF43D6F9503291D01E48AAFC8A1C05E76CD224780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 72510d536746ae17231e8169ca12833b2b43aca17d5cbe6ed4a692c46e5ba0dd
MD5 b081dc143d0aa118805e463e9b17c3e5
SHA1 90ec3795e702fe0d8eff5170fccfdef1f9fc1311
SHA512 20f42176c0655e8ae828f3ef88e0d1dfe283690a15f49b2f9520a542a007579628df9fb9465d2ee82aaf5dc3db8e662a5afe9371957394a8827f856c3325d883
SSDEEP 48:K0nDnmnHnjnNnln1n2bnlnon9ISnjn2K9nT1nBn2xnLnmYnwnRnDnnyLRAthrvzA:KE4gK1eySOEKXq07OKUI2P
TLSH
T11191885231770340797E298C44B8971B41A271B37108EABBFF7D85A6DD2AE046CFE8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c424864a-973e-408a-b948-fe2b26f6a616.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c424864a-973e-408a-b948-fe2b26f6a616.tmp
Size 10KB
SHA256 b3c94effe36d5b80e0c18336b6f1d3caff4326505085fda395ab05fbaf4a9ffd
MD5 ef47ca2ef3231d328ceb662ca6363426
SHA1 062d8bc71c5ec4f4649bd98b50aa230b9381f288
SHA512 e4a8e2e8dd742463cc98564d0174a9279a87dd242ccd3e532361f2c7e854a0f69a87ee516b5c72b8616baa0188df6d62b7f07da108c903f770b2b6dfd0c29dc8
SSDEEP 192:sxZCRGWZ/fes3oIIdpmAHnA6+WN9yXYanMr4Ig5cJ:sxZCfZ/fes3o5rHZk5+
TLSH
T19732B652AE686D7B9CC7D21DFA15BF43D6F9503291D01E48AAFC8A1C05E77CD224780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c8d296b9-494e-423f-bb6d-51bac6359aa3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c8d296b9-494e-423f-bb6d-51bac6359aa3.tmp
Size 27KB
SHA256 9a1e27d3405c481266b0e87682e0bcf1c3220ba49ec773404026c9b757580146
MD5 edb4e2ee5699935876c4a99be15f5d0c
SHA1 f03c8f483e85b60c76d799989d115fcc316e23f6
SHA512 f27734332bbc774b1b86f7923fb1759e91456183cde7da69b46d623592254f927472124bbeaa8d6e138f9b9a64a0c34fe5ddb630c5fa96ec46232412942973b7
SSDEEP 768:D4yQRbrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH3MroTZDAY:D4yQRbrWvvlpZu1jaXKLf33XTZDAY
TLSH
T1F3C2E92B640CCB7E5FC01E9DDC6A6F976EA802C766588D4047FA984C02C77EE512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e1e1ceab-a270-4922-ab7d-55198b21b0b8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e1e1ceab-a270-4922-ab7d-55198b21b0b8.tmp
Size 10KB
SHA256 e761ca8e776d7574213dc83e7c1fa8b82f75485adaefcf6903ce9427ca1bb878
MD5 d22bcb7c064c2414704e015e697c737a
SHA1 6371bc258702bfcb9d8e69e724aeebbd8f078e2d
SHA512 33d31baab046d36543506bedc4f7cd775b097f820b1d6116870eace9c3ddc7ec0b95867e9e3c2fb07943fce359bbb0d2a2426e62fcbd2879853355b4ba169477
SSDEEP 192:sxZCRGWZ/fesCoIIdpkAHnA6+WN9yXYaJTA4IgrJ:sxZCfZ/fesCo5BHZkV9
TLSH
T18F22B652AE68A97B8CCBD219FB19BF43D6F9503291D01E48EAFC851C05E76DD224780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0fa7958f-9f58-4dd2-a92d-18792e422f51.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\0fa7958f-9f58-4dd2-a92d-18792e422f51.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aeae5b48-e99e-4dc4-b338-31d104e9a0b6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\aeae5b48-e99e-4dc4-b338-31d104e9a0b6.tmp
Size 8KB
SHA256 4713da521bae14238947edd87b06396e10b6fdd69f237c5e498d9a05d7dbb248
MD5 edbf082b751eb230925ba29158f1a142
SHA1 9e6aee7ecce61b95990d777f19775b9543500407
SHA512 5ccf29e7477ac114c33d07ea32a0e86b376611ebb9bf92ce242711a2b0b8e1272aaa689cdbeb8d795308d266ff7f8584498de04a343a89fe18ffd9946c48be41
SSDEEP 192:bONt6iDxQmiUyFNZq5u88PEvIBAB3Pwo6uZatq0U6:bONt668Zq5u8igAAZYoda5U6
TLSH
T13B123A3668B8BC7B6CD2A965F58B36079EA8426BD7C8AF80D5DC271C01EF19C1307913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1decca73-c391-4cef-b934-a6d208ff9e96.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1decca73-c391-4cef-b934-a6d208ff9e96.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5dd1c712779417d6ddbd43dc9ffc76dfbcdc02a1b418cd92dcf5002b3376231b
MD5 dc8f99a064c912d43bc49e1b5eafea57
SHA1 c863c1236584bb0aa6143cd59fbefab2497dc8c2
SHA512 8d697b6845bbba9bf01406f1b79b053984ed3ae9eb1864fc618202416b1712084fab0039ce067b81fa1db2c5a308a994e16f8caf4ea341afd69950034a1adc71
TLSH
T1F3411868A6ED1148B3776F5A6BF6A86D487B7A771F07D09D00110D4F4A22A40CDA1B33
MD5 SHA1 SHA512 TLSH

Submit Download