hxxp://bit[.]ly/2MSeRJ6

Analysis

user interaction
yes
max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 13:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://bit.ly/2MSeRJ6
Sample261102-q8aayatzd1

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2420	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{3C8E818F-4A15-4767-B6FB-4648F4F84FCE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4708	msedge.exe
4708	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 4692	4664	msedge.exe	84
PID 4664 wrote to memory of 2420	4664	msedge.exe	85
PID 4664 wrote to memory of 4620	4664	msedge.exe	86
PID 4664 wrote to memory of 4620	4664	msedge.exe	86
PID 4664 wrote to memory of 4620	4664	msedge.exe	86
PID 4664 wrote to memory of 2696	4664	msedge.exe	87
PID 4664 wrote to memory of 2696	4664	msedge.exe	87
PID 4664 wrote to memory of 5732	4664	msedge.exe	88
PID 4664 wrote to memory of 5048	4664	msedge.exe	89
PID 4664 wrote to memory of 5732	4664	msedge.exe	88
PID 4664 wrote to memory of 5732	4664	msedge.exe	88
PID 4664 wrote to memory of 5048	4664	msedge.exe	89
PID 4664 wrote to memory of 5048	4664	msedge.exe	89
PID 4664 wrote to memory of 3612	4664	msedge.exe	93
PID 4664 wrote to memory of 3612	4664	msedge.exe	93
PID 4664 wrote to memory of 3612	4664	msedge.exe	93
PID 4664 wrote to memory of 5496	4664	msedge.exe	94
PID 4664 wrote to memory of 5496	4664	msedge.exe	94
PID 4664 wrote to memory of 4336	4664	msedge.exe	95
PID 4664 wrote to memory of 4336	4664	msedge.exe	95
PID 4664 wrote to memory of 2016	4664	msedge.exe	97
PID 4664 wrote to memory of 856	4664	msedge.exe	105
PID 4664 wrote to memory of 856	4664	msedge.exe	105
PID 4664 wrote to memory of 856	4664	msedge.exe	105
PID 4664 wrote to memory of 5976	4664	msedge.exe	106
PID 4664 wrote to memory of 5976	4664	msedge.exe	106
PID 4664 wrote to memory of 5976	4664	msedge.exe	106
PID 4664 wrote to memory of 4404	4664	msedge.exe	107
PID 4664 wrote to memory of 4404	4664	msedge.exe	107
PID 4664 wrote to memory of 4404	4664	msedge.exe	107
PID 4664 wrote to memory of 5400	4664	msedge.exe	113
PID 4664 wrote to memory of 6012	4664	msedge.exe	114
PID 4664 wrote to memory of 5164	4664	msedge.exe	115
PID 4664 wrote to memory of 2892	4664	msedge.exe	117
PID 4664 wrote to memory of 2892	4664	msedge.exe	117
PID 4664 wrote to memory of 5180	4664	msedge.exe	118
PID 4664 wrote to memory of 5180	4664	msedge.exe	118
PID 4664 wrote to memory of 4708	4664	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://bit.ly/2MSeRJ6
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ffd2e23c188,0x7ffd2e23c194,0x7ffd2e23c1a0
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,12562728085441391879,5130855714154053886,524288 --field-trial-handle=2300,i,3294907252179278901,11668586087388868057,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1760,i,9805749820522199173,17619199347201209169,262144 --field-trial-handle=2300,i,3294907252179278901,11668586087388868057,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2612,i,11333047765322730521,10649925825949924840,524288 --field-trial-handle=2300,i,3294907252179278901,11668586087388868057,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,13531656328732110595,13900492188742525560,2097152 --field-trial-handle=2300,i,3294907252179278901,11668586087388868057,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,7430168885250702694,16473876767763743517,2097152 --field-trial-handle=2300,i,3294907252179278901,11668586087388868057,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4920,i,16964763982287590823,8030533982706623151,2097152 --field-trial-handle=2300,i,3294907252179278901,11668586087388868057,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3480,i,1173271689161016641,13598451309863828330,524288 --field-trial-handle=2300,i,3294907252179278901,11668586087388868057,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:8
  2⤵
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4672,i,15644355397864689401,11891653553767377872,524288 --field-trial-handle=2300,i,3294907252179278901,11668586087388868057,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:8
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,10865767543752251468,16509629390658803042,524288 --field-trial-handle=2300,i,3294907252179278901,11668586087388868057,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,10865767543752251468,16509629390658803042,524288 --field-trial-handle=2300,i,3294907252179278901,11668586087388868057,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6120,i,3261741144971383663,10752187677227372783,2097152 --field-trial-handle=2300,i,3294907252179278901,11668586087388868057,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6260,i,17636468968895592791,18408721748517217324,2097152 --field-trial-handle=2300,i,3294907252179278901,11668586087388868057,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:5976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6380,i,16476122095039905385,15250806323990082583,2097152 --field-trial-handle=2300,i,3294907252179278901,11668586087388868057,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,13337874922276333332,9370713757729401197,524288 --field-trial-handle=2300,i,3294907252179278901,11668586087388868057,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:8
  2⤵
  PID:5400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,11473885096595557809,16700443355042964717,524288 --field-trial-handle=2300,i,3294907252179278901,11668586087388868057,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,16178257966330647880,8177672882023854349,524288 --field-trial-handle=2300,i,3294907252179278901,11668586087388868057,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:8
  2⤵
  PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,13746035190785460041,16632175833633995075,524288 --field-trial-handle=2300,i,3294907252179278901,11668586087388868057,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:8
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,18017012202038720557,8871081549752333617,524288 --field-trial-handle=2300,i,3294907252179278901,11668586087388868057,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3640,i,1156058070021830879,545879021595666406,262144 --field-trial-handle=2300,i,3294907252179278901,11668586087388868057,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4708

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6713d96e-079b-41bc-9916-e2c7c6f730bb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6713d96e-079b-41bc-9916-e2c7c6f730bb.tmp
Size 26KB
SHA256 d327eadb1bbf6d4f9d990cb36b75374b465f98deab1f2c1272521018a8565664
MD5 5876def8bbb3be017fd4aa0381852072
SHA1 b81d7dec84758b087304c0aa99551e0174ea49c9
SHA512 cdd2774b4d536a4d2780f667ec79c02554a4e91cc30f09554b299e8dd8d5dd9bf349ce509625f8260be4585a9a4b0cf1424192500ae051c8a925c6bc1cc75557
SSDEEP 384:nIiFzQkUSvpMsN08TUNTUlI4I5mg0ZSu4zf8BsuYWToigS5PBH7vBElhgL/7IzT8:TFdCJwgilZBsuetgBH75EllL4
TLSH
T10AC25B72E898DEBBEDE68B95A30A7647EEE04153C9DC5AD4D9C90D1C00CB1DE170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

89bc5c66-e778-42a8-9d44-026154f4c26b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\89bc5c66-e778-42a8-9d44-026154f4c26b.tmp
Size 25KB
SHA256 8db57a71afff78180171fbfcff5473323272945ac4db322f6f57b37a6552288b
MD5 9206e9f802c7eebd088435ab45999d5e
SHA1 635d8d6a8dfbb819ec9cd04caf026a9b33405d41
SHA512 140cf9219c923f9ad2dd9516af0624c8d7c6cd3acb4397cb38964e49907412079b6225b27b0b48a2b655c39ef38444d3a3e61d47936d72fee7dc3c126ac3d670
SSDEEP 384:nhiFiZcI63sNf8TUNTUlIm25mg5dn4zf8BsuYWToigBb7O6R2FeoqgL/7Iz6oz:IFQ63ywgSqJBsuetBb7TRiQ
TLSH
T176C25C36DCA4C9BBEDFA8FD9A74A7A07DEE10163859C8AC0DAD85D1D00875DE1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9fef4bf6-c41e-4898-b1fc-401be13cc0b6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9fef4bf6-c41e-4898-b1fc-401be13cc0b6.tmp
Size 31KB
SHA256 9c8aa07eb1b58717ced5984c78eb9993ba8cf9b2cb4909dd50cae9e528ea7f05
MD5 e90b546ea4f7d06bf3b537e11d69f371
SHA1 f072ac23336476f9328b9769ef7b7c22e6802dff
SHA512 34e1c6bc60b26f0ecdafc161277b973c19d77fb8e09721b2f4af43400f7a335de1db5bfb3ff9e244acc967d017ab6b1dd8fd0bbc27d048a33082b73fb13575de
SSDEEP 384:nKiFzQkUSvHQMsN08TUNTUlI4I5mg0kSu4zf8BsuYWToigS5/BH7vBElhgL/7Iz4:BFd1JwgiYZBsuetGBH75EllL4
TLSH
T139E2B3F198D7997BD8AE4B97633D2E0699FCC113B5984A84BBC80D1CCC861BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

24e598f4-5022-4efd-aa94-7d4d8cd4c517.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\24e598f4-5022-4efd-aa94-7d4d8cd4c517.tmp
Size 12KB
SHA256 660585fe6675c854c5c1f0458d1b67a11066a788b437f4765b4c812b0b9eba4b
MD5 0e30777626a8a05e70c24b8219dcb40b
SHA1 4977f1a97a173f2d9445d3d07a18a4fc725ad33c
SHA512 ca9e29c79e8533bfb4c7e2ebfebc798aad01cf584e2d58af3ebbf57e34e5542af20a6814261ebef4e5271b68d2c8ba355b514272f3b2ac7349cce95b0f07e4c6
SSDEEP 192:sxZORrke/fBsfQZZCZzodp1LRHW6+WNbDLY/YbImkL8Yjt1Ig5SgJ:sxZO2e/fBsfOZCSDHb8/FkYPQE
TLSH
T1D642D755AD38A93B9CD7D219FA55BF53E7F91032A0941E48AEFC8A1C05EB6CD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

75b83f42-7cd0-4048-832e-de0700290cca.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\75b83f42-7cd0-4048-832e-de0700290cca.tmp
Size 12KB
SHA256 fb5c774195f0f538eaf7069f8f8b8bf3311862789f53d6aaf8d5d63ff2ffa7b8
MD5 47d4df90549f54b46217a6588ca2c995
SHA1 40bc1d6aa93a1f0bdf557353b097161be7d75b5f
SHA512 645f62004e8b9a51ddacd66faba18ca79f7f726e01d96f2981e99eebb738bdb4985111d25d2c942df071f3cfddca3e069d654e7dd7a541f77fa0d0581eea1549
SSDEEP 192:sxZORrke/fBsZQZZCZzodp1LRHW6+WNbDLY/YbI+kL8Yjt1IgjgJ:sxZO2e/fBsZOZCSDHb8/FMYPjE
TLSH
T19B42D755AD38A93F9CC7E219FA55BF53E7F91032A0845E48AAFC8A1C04E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8f485232-bea1-4e44-8e1e-c63bc7e9c3b4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8f485232-bea1-4e44-8e1e-c63bc7e9c3b4.tmp
Size 414B
SHA256 ab6e91e9825df8b3efbea3ba384a18b2c9838d9cdb39237c988a28177ac5e430
MD5 a062e4b0d58a09f64b8a79239b736bd9
SHA1 c121653f289f49a9f57e5fef0e66b72ebb9dd34d
SHA512 0c7991825df9c521bebba0c6f5fd0bc116d4f157090b3afc4afd05266f6401af0a09f73da07752a481d30252a01ab780a175b2703f443d8d6dc88ec97e85549b
TLSH
T173E02BF5C816BC774CFC076854640686EB51034B3A80884F7B3D900D8FB16364586CAC
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 c92d2780c8731bc40a78187f79b8dee4ce8be663e489ec7bc18f7cb48aec1f56
MD5 517501186b62fee61512a1dbf5c941d4
SHA1 f1df087ceb96624c63400312e28e713d6e04d8b4
SHA512 e2f7a0cad23d2249f6c2daff18549e05b0641530a7df9c28ca9894ec394c9641f063a15ad671cdddc75dea1c3b1e4b652ad5b6b30237a636b1b04ad2dec89b7a
TLSH
T1B1E026C61BC8C27EA309749B11A8DB0CC281372B93C0790F2708CC8AB042940A6AB6E0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 ace8cd4a5408d892153011c75699852efe75a91a31492e175f3731f2cbded292
MD5 8bfa5fc5adb2e8b50c5f5dac5ca11eb0
SHA1 4aa177ef002ddc3f5a01e2e533098ab538146786
SHA512 c6fb185c19b2ddd3ff5dba558340803389e4e74c3f180fc07fafedf02fe762d32d508aee20d3a0cc2670ecfd1090ca49658a090a417d29482d04c2bff76e9ddc
TLSH
T108611D4D1F934C95F765527391E4624BF6748684588BDFC307B8D4FA594A35CA32CC0B
MD5 SHA1 SHA512 TLSH

Submit Download

8e70a1cb-b095-41a5-aa8c-2c300d3bbe72.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\8e70a1cb-b095-41a5-aa8c-2c300d3bbe72.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

54ea0041-1f71-45f3-b3cd-427de1ea18f2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\54ea0041-1f71-45f3-b3cd-427de1ea18f2.tmp
Size 4KB
SHA256 eea814417c25b1e38650ee522263bb77deb1108cbaa4f94eb754ea9cce148d96
MD5 db6894a7248c927779783a63c2e9d68b
SHA1 ac99d3d13e78cdde3f6c634246275fb986818490
SHA512 60ce33ce5c68d4324b711257e5765548166204916681b9ac25d24b1bb01e0369451a2d1808521846a66cf8b105bc3a9578bd135655c1856220a2d4742ae12ac7
SSDEEP 96:D1aOwYe7RaatzaiVz/BGH/RWB0zPxK1Or6VwQ:D1JwYe7Raat+iVLBGH/RWB0zPxCG6VT
TLSH
T15E918DF7C7F9892ECD1155F4EA146E1BCE190556832C3C0A86D8AE4BA3E2471E285A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dfda1c22-5222-4179-8dc7-57d4be808a75.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\dfda1c22-5222-4179-8dc7-57d4be808a75.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

edf470ec-ce94-4a08-bc65-be0ed4facd3d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\edf470ec-ce94-4a08-bc65-be0ed4facd3d.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 72B
SHA256 d3e77c2a7ba05722899ef67d12a3ac1403345ecb356f54d15bb7d86e3a81943a
MD5 8e34f54693b46749aacf723c60c03a30
SHA1 defdc15bce3454d8db2441765fc1bee728066c58
SHA512 aa3a3d2e702e343631360800fb0e9c037977732b316449d54debefbf482dcbdcb145ab27a0e383da25d246a67f3d202f0af098de19b0f244fb98e2fc5ff2407b
TLSH
T1F4A002505F52154BD0291B79148DD7442361CC302501831381A956D8CDE02C18D46344
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 c0256fba4e30c4bd086c1dcabb5aeec2b4ce85b9d3a98c909a5825c72ba8fcc3
MD5 8983c305af4c3567d535bacaa53b18bd
SHA1 015a39495db1dba1c01d8c3a439d634311333e8b
SHA512 0cfb272fb71a0f82f4cb3a723c42cfa555a49d12ab2723dc717f61c7ccfb38e7f9a3d382b92616d34b77f3210d70f03cd7cca83d6fa45d33fe5588f91cae02a4
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXYHvc:OtfFvpopPxrB4RhfYPc
TLSH
T1CBB2311471BA421038FE790881B5972F064232B37258E67B7FBD54A69E6BF085CFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a432f109-b4f8-4f93-856d-acacad530a93.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a432f109-b4f8-4f93-856d-acacad530a93.tmp
Size 27KB
SHA256 f230a4ab4e764530740da76557d07216341c8768c7e1efb0b2e77ac27dc0b62c
MD5 8abbcdfa7caeebcbbcd0d5105dc97b2e
SHA1 1e4dad667b45cbc987006d84369b77755c5a1f80
SHA512 a15376caaba7314be4cd64998452f0a51d18c456c02b9982c79ea9ac4e177a4abacc972d1377c7dfa3c866c68dc8676c7d2cf246bc17f9a82357457cebc4b37f
SSDEEP 768:0RyktrnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmWLlMC7fnroGfk:0RyktrnWvDBltu1jaLWLywf0Gc
TLSH
T1BBC2F93F640CCB7E5FC00E9D9C6A6F972DE802CBA6945D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bff0869f-bfc2-4030-bc56-1db9d1d7b7b8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bff0869f-bfc2-4030-bc56-1db9d1d7b7b8.tmp
Size 12KB
SHA256 4f18861706bc208df15a511ca16aff057d85eda68517c3c19b3f530cb511fbf8
MD5 8ce092eeb74ea891af76a0c2989277ca
SHA1 c64862e80ab151a94ab0d8594986ae701285ceed
SHA512 2be644b583769b7ab7fe084d0c0ffc3e44a8ccc0202b75cc1747645ba778ab596c54a3358894fe97ea1bf3d3a0380245973990901f7cc074b7a9cea5b36d7a8b
SSDEEP 192:sxZORrke/fBsOQZZCZzodp1LRHW6+WNbDLY/YbI+kL8Yjt1Ig5SgJ:sxZO2e/fBsOOZCSDHb8/FMYPQE
TLSH
T1B842D755AD38A93F9CD7D219FA55BF53E7F91032A0845E48AAFC8A1C05EB6CD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d301c93b-d67d-421a-b631-0947a5d1d3b0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d301c93b-d67d-421a-b631-0947a5d1d3b0.tmp
Size 26KB
SHA256 06d392f2b8dc8aecca16f884e4ffc6bd2f86a0dfa9fa7a3b554c107de08c799f
MD5 9a8482e0c0741714be17a0ad5cf6eb20
SHA1 99a2b79205df26dcc8c0bbde88e0980116c07d74
SHA512 608b43015bb22a79512eac20fa9425769e54df0e1440e795950108925c5896207bd9ed5e473d414325dcaaf438e9b2209325ce9c0164a955d5eeb3a3d8a35860
SSDEEP 384:nQiFzQkUSvpMsN08TUNTUlI4I5mg0ZSu4zf8BsuYWToigS5PBH7vBElhgL/7IzT8:rFdCJwgilZBsuetgBH75EllL4
TLSH
T15FC25B72E8A8DEBBEDE68B95A30A7647EEE04153C9DC5AD4D9C90D1C00CB1DE170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebf9725e-1a3d-4780-a05a-3c74d1dd2d5a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ebf9725e-1a3d-4780-a05a-3c74d1dd2d5a.tmp
Size 26KB
SHA256 326667aabed36580dfb50e437186d3f80483a914a9a2a67b128401dde31f3a64
MD5 e283b03a6603f0b07ff3e3d5997fa1d3
SHA1 851b3577f5551f034f24e98cac6b17ab52bdd338
SHA512 02f5d21f97f07653022cd792ce36c0e3465dde34f8493bad5128ad0555f601a858c06b943b1b5a644213ffabbb7435cdec7133dba734432c2c39f680cf541e31
SSDEEP 384:nQiFiZcIKg3sN08TUNTUlI405mgTZSu4zf8BsuYWToigS5PBH7vBElhgL/7IzpoP:rFQh3JwgEmZBsuetgBH75Elrk
TLSH
T1DAC26C72D8A4CABBECFA8BD9A74A7A07DDF04153959C9AC0D9D94D1D00D71EE030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fffb6b9b-c2ea-4ed6-8053-6d3c2d6ac536.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fffb6b9b-c2ea-4ed6-8053-6d3c2d6ac536.tmp
Size 26KB
SHA256 ba51f663bbd729c97f141d60ae58eece59b4f097d647746744e692fa6d26dfa1
MD5 50f0ea113f268839e5ab9af0cdfa2c1a
SHA1 76ab6966aeb07d03a70a4d7f8466ea37937e6b2f
SHA512 49a0f207bb6ecf027f3222e3b7bdf8923a685a3f15fc280441ff6a4e41d472d5a7b6c879baa258edc4f9aa175b7a4063ebf522c126062bbec1b58e9883b0d2bd
SSDEEP 384:nDiFiZcI63sNw8TUNTUlIm25mgNzE4zf8BsuYWToigS5VB7O6R2FeoqgL/7Iz6oz:uFQ63ZwgS2aBsuetoB7TRiQ
TLSH
T127C26C72E8A4C9BBECFA8BD5A74A7607DEF14153869C9AC0D9D81D1D00CB5ED070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9bcce62fc48881afefaa224732f26390c89f0994d6f041ca4bd9c58f0f0d2c6d
MD5 ea03da3299f74a38f7cbc461f9fcc8b2
SHA1 5e7263f94d3e06ac5ef1c4b79cf1d0c007a29c32
SHA512 8c22e90a1526c861a8d86d22ec67b7a95d80d8444ffdefdc0698063e7265f8044228cdfa513f0b7ee42e9dce983d5692e7d79c084dbdf2e354375bffa639eeba
TLSH
T196412A5CA7E91108B3B76F5AAFF6A86E487BBD732E06D49D10110E4F0A22B05C971733
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2016-227-0x000001D9500E0000-0x000001D9510E0000-memory.dmp

Download