hxxps://www[.]facebook[.]com/share/v/1GmjAJTWYe/

Analysis

user interaction
yes
max time kernel
148s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/10/2026, 13:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.facebook.com/share/v/1GmjAJTWYe/
Sample261020-qddd4sbf93

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3328	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{64FC7688-F673-4F13-A9A0-A50B6D51B5B0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4376	msedge.exe
4376	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 3900	4720	msedge.exe	84
PID 4720 wrote to memory of 3328	4720	msedge.exe	85
PID 4720 wrote to memory of 4852	4720	msedge.exe	86
PID 4720 wrote to memory of 4368	4720	msedge.exe	87
PID 4720 wrote to memory of 4852	4720	msedge.exe	86
PID 4720 wrote to memory of 4852	4720	msedge.exe	86
PID 4720 wrote to memory of 4368	4720	msedge.exe	87
PID 4720 wrote to memory of 4124	4720	msedge.exe	89
PID 4720 wrote to memory of 4692	4720	msedge.exe	88
PID 4720 wrote to memory of 4124	4720	msedge.exe	89
PID 4720 wrote to memory of 4124	4720	msedge.exe	89
PID 4720 wrote to memory of 4692	4720	msedge.exe	88
PID 4720 wrote to memory of 4692	4720	msedge.exe	88
PID 4720 wrote to memory of 2788	4720	msedge.exe	91
PID 4720 wrote to memory of 1136	4720	msedge.exe	92
PID 4720 wrote to memory of 2788	4720	msedge.exe	91
PID 4720 wrote to memory of 2788	4720	msedge.exe	91
PID 4720 wrote to memory of 1136	4720	msedge.exe	92
PID 4720 wrote to memory of 1136	4720	msedge.exe	92
PID 4720 wrote to memory of 3204	4720	msedge.exe	95
PID 4720 wrote to memory of 3204	4720	msedge.exe	95
PID 4720 wrote to memory of 3204	4720	msedge.exe	95
PID 4720 wrote to memory of 928	4720	msedge.exe	97
PID 4720 wrote to memory of 4428	4720	msedge.exe	98
PID 4720 wrote to memory of 928	4720	msedge.exe	97
PID 4720 wrote to memory of 4428	4720	msedge.exe	98
PID 4720 wrote to memory of 2800	4720	msedge.exe	99
PID 4720 wrote to memory of 2800	4720	msedge.exe	99
PID 4720 wrote to memory of 1028	4720	msedge.exe	102
PID 4720 wrote to memory of 4128	4720	msedge.exe	112
PID 4720 wrote to memory of 1408	4720	msedge.exe	113
PID 4720 wrote to memory of 3256	4720	msedge.exe	114
PID 4720 wrote to memory of 1204	4720	msedge.exe	116
PID 4720 wrote to memory of 1204	4720	msedge.exe	116
PID 4720 wrote to memory of 4376	4720	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.facebook.com/share/v/1GmjAJTWYe/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffef294c188,0x7ffef294c194,0x7ffef294c1a0
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,10347866549477296741,729519684829468127,524288 --field-trial-handle=2352,i,17860453572062896943,17988759381067949103,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,18250554196530272762,10168766968143829958,262144 --field-trial-handle=2352,i,17860453572062896943,17988759381067949103,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2376,i,10951477910715757697,8243740865764492970,524288 --field-trial-handle=2352,i,17860453572062896943,17988759381067949103,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:8
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,6428474635492048466,17051461096777554646,2097152 --field-trial-handle=2352,i,17860453572062896943,17988759381067949103,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,1793417469328439629,16095445150378453013,2097152 --field-trial-handle=2352,i,17860453572062896943,17988759381067949103,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,2688242375936070301,13597807303228563725,2097152 --field-trial-handle=2352,i,17860453572062896943,17988759381067949103,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,18350212000686657219,9468889735279574178,2097152 --field-trial-handle=2352,i,17860453572062896943,17988759381067949103,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:2
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5052,i,10703611918743322637,13168506344969426312,2097152 --field-trial-handle=2352,i,17860453572062896943,17988759381067949103,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,3357681074206357139,12560366368046768483,524288 --field-trial-handle=2352,i,17860453572062896943,17988759381067949103,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,4460043712713844377,525286643190107770,524288 --field-trial-handle=2352,i,17860453572062896943,17988759381067949103,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,2685690592110195514,12998953954694346453,524288 --field-trial-handle=2352,i,17860453572062896943,17988759381067949103,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,1767984561218694391,7268226720609752002,524288 --field-trial-handle=2352,i,17860453572062896943,17988759381067949103,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,1767984561218694391,7268226720609752002,524288 --field-trial-handle=2352,i,17860453572062896943,17988759381067949103,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,7673154210666581266,8998135324816788066,524288 --field-trial-handle=2352,i,17860453572062896943,17988759381067949103,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:8
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,14909675757731787045,1444119331964169981,524288 --field-trial-handle=2352,i,17860453572062896943,17988759381067949103,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:8
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,6993233446174784076,1162945691437137701,524288 --field-trial-handle=2352,i,17860453572062896943,17988759381067949103,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:8
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,1855662566970164723,2464407264244233049,524288 --field-trial-handle=2352,i,17860453572062896943,17988759381067949103,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:8
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3656,i,4800471296608797131,10457549343776253644,262144 --field-trial-handle=2352,i,17860453572062896943,17988759381067949103,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4376

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

298e42df-70b1-41b1-90f6-9277e9fb1e12.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\298e42df-70b1-41b1-90f6-9277e9fb1e12.tmp
Size 8KB
SHA256 724372eb413dc00ce878cb770f3f0188c564175b0cda31c1f1bbbfdb049c2b0c
MD5 60ea3903e5e09bb2291377d7fd1ff6c8
SHA1 42a505cee6ce05281cbaab8057e6c7495ac5b94d
SHA512 9bb8a8927d4cb2d4760e36156e5afa456d12c9d92a600013fde92acdf3ed36ee10890cdd5375898f2cf6e136a8e3a4f11dca5bb2934884bc63581a60f0a1481d
SSDEEP 192:vONF6wlDeQmiUy+4nv4X58gZejzorxJgXA7R+2YrvesqkU6:vONF6kamv4X58EC8xJgXw+2YaaU6
TLSH
T10F121835E468AC2B5DE2A546F08731039FB59227EB896F90D6EC1A2C01EF69C134AC13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3ba6f7ce-7825-4d10-bdcf-8fc0401a13e2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3ba6f7ce-7825-4d10-bdcf-8fc0401a13e2.tmp
Size 18KB
SHA256 589a777f29a4875d95ba0a04b9f7c963e26f41f7791a950df69cc7a80fdcc407
MD5 924ead9488d13d9f201aa85f8d2ddc60
SHA1 a27f3291f4e12711275df9f518af9f98b03a47b8
SHA512 031a605dc5508c7ba5f6f85f5212d292b89430a16e1a03f40b89eb851235bb37ecdc07dd7c2e30287ccb7cc04d213801aa7b7e0f09bf39e77db0672318c4e97f
SSDEEP 384:KQkUSv0sNsv5IJZhr0duHX58EC8xJgXw+2YYraif2IIl+:y0NKL0WaHwl/aif2Lk
TLSH
T106828E316878AD374AF7A145F18935839FB4912BE6C92F94C6DC6B2C00DE2D9230BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

93128ed3-467d-4dc3-95be-98de05b86b53.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\93128ed3-467d-4dc3-95be-98de05b86b53.tmp
Size 26KB
SHA256 683eddb453132271d7bae76a411c507d163a899b2d188e672f13cc018806b625
MD5 4d2769eec26f64d1cc5da5fa4e96ef55
SHA1 bf7fdda0b1c4cba68a9b4999fa0ab2cf92eefcbc
SHA512 bd62257fc58e62267a62c918f11a0e4c8db218eb64b120e992ae0274d7bcc4dcecba70cc295b7ce1893e7ec8d4c3858e55163ede7ffe70d28ad940af1fe7d86e
SSDEEP 384:oiFzQkUSv6zsNk8TUNTUlIlv5IJZh/0duHX58EC8xJgXw+2Yvnaif2IIl+:zFdS9wgfKf0WaHwlEaif2Lk
TLSH
T194C228F258D79937DAAE5743A37D2D428EBCC167F5856A50B388191CCC8A1BFD30AC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b81d8521f4289b1259fa60587a7bc7131f06581c3a734224a7de2fe2669bfb7
MD5 46bc1ee7f1b3386bbc305d48ade31614
SHA1 b5e469cf75c16715fb850bd86db01e329da2928e
SHA512 09a97914c725107f4c125aa0ff0826f0410030841011f0bc5c9eed9e023261ab13abc5f59c9c311d02baf1b25e7398de5ea81438c8a8ede3cc60ca3906edfce9
TLSH
T152D022F2B3A208E8CCC02A3C20030B080208C8000C83B320C832C0C22ECEBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 58b461967016818ce2213ba739aa830e079c4747cc98baea5feaffc8b09c915d
MD5 8800a672498272bad98dd79644e30101
SHA1 14a42c33d6271869cc680cadc5ae061e7092e3ae
SHA512 a17f90c73859841f3e0a3211d7f8d1027a7f8ec3a4ef87ddc96b1a39e0b52bc65decb3dd694a7092e22f06f2124864535e2e8632387dd42184abe2d3e22d7e12
TLSH
T135D022F2F32200E8C8C02A3C20030B080208C8000C833220C832C0C23ECCBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

0bbe53a5-e635-4a81-928c-4a08abaff818.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0bbe53a5-e635-4a81-928c-4a08abaff818.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

18c47f64-4401-4fc3-8071-c8a403d1d035.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\18c47f64-4401-4fc3-8071-c8a403d1d035.tmp
Size 27KB
SHA256 88d922fc7672d9e2fd8965bc931427b9f82bf85d80b467625608973ac8b8bba8
MD5 ae6dcfd0a8fb55acb293fbd5c45ca971
SHA1 444884846ff1867fc75a0b8668d25a17f456fa98
SHA512 1c6a9de68c1218cbcf49c3e5debfef47eb4da74c38bc532e389a00f0683c6474c810610db21c387821bdc5c8f7fc8426ffbacb53fdd40c6cc185dd9f5f234341
SSDEEP 768:mjy4J/DWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCiLlc2Tb5roR1m:mjy4J/DWvbtBhu1jajiLm0by7m
TLSH
T155C2FB3B684CCB7E4FC00A9DDD5E6F9B3E9802C796948D4047FA994C02C77EA91264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

522f6b95-d3f2-4a39-9383-21734c208de1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\522f6b95-d3f2-4a39-9383-21734c208de1.tmp
Size 11KB
SHA256 f43c82cd92aa55f160f1f731f2cc9aef8e3f1f9cbe9db19c540960024f94771f
MD5 2b0faca6bf2aae000d509d14d209718f
SHA1 6abe540d16157b1e978bfb067cfd5efd1999c478
SHA512 0a73aba41a7af4a4e19496f49d2a44ba8dadd5b4119e21944fe45622ac9f69a23877c554d8ef772000258a78af51f4b7ca172b4ce3f58232b55248621ae1b8ad
SSDEEP 192:sxZZ2RJWt/fMsEldIdpv6qgzENFB/W6+WN0E546dYrLJUplxaIg5kJ:sxZUmt/fMs6evfbTdvx6e
TLSH
T1A532DA536E28697B8CD7D219FA55BF53E2F55031A1D11E48AAFCCA1C14EB6CD220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

539a8f07-6dcd-4c48-a323-fd2b56bc23d1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\539a8f07-6dcd-4c48-a323-fd2b56bc23d1.tmp
Size 10KB
SHA256 369dbde18c630cb646d1d6bf59f1f1dd2bccd518f97f57c98c41e3807bebfc87
MD5 520af55d9e965b4c76e5cdc92e9197c2
SHA1 8b38b81d88866068904ac8ff749fed02c8753bcc
SHA512 8dd428c54150ddcbea5a6cdf570f9c6f77846a6c7769cc4881045a2684def6b609fe723feac10ede8b826838adc1592654e35e8b14f492e959b91a03f5236108
SSDEEP 192:sxZZ2RJWt/fMscldIdpd6qgzENFB/W6+WN0p2dYrQ1plxaIg5OJ:sxZUmt/fMsSepfbHd/x60
TLSH
T18432EA526E38A97B8CC7D219FB55BF53E6F54031A1D11E84AAFC852C14EB6DD220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 4b0dd6d8e2a67aa0a29eab12224863eeff05bffb55b5f095097055f967571182
MD5 cd40ab692cc8be2fd3f6a62a094f0d6c
SHA1 d50f94b25b264553ebfb89d51a154b687f9e634f
SHA512 ecf16831f8dc6ada91e18c8e7e7a0b1bc94c06d695c84647627ce2d83237a7cebd9d6bfccc25326e741ba53b272e03b325e2b0b77126b8bfe132699d515534ff
TLSH
T19B81634AA09E04A2DB74A9FC9DE12CCB3538C7F5929B5D5A0794E8781F72F5272B401C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 d01155e81b921b80fe38935d55435fe4f28b9ff7b0e370d8bcbe75569d473312
MD5 55cf9a2ec1c7c0f3876b603e471717df
SHA1 39ead857fa4cbdcf5fd05313a6f5cdbd12ec5b3b
SHA512 9ae1676107043ecd1c6d08dd5e911dcf6d3a2298c36caf5be5098ea1e9be1534bb203a7f1a07918bf04afe902b1c3510849332ffa9a568b3cd55c1381ca078a2
TLSH
T11971644AA09E44A3DB74A9FC9ED12CCB3538C6F5829B5D5A0794E8781F72F5272B401C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 207b144de1a47d14274b18ec8267b420e7350c2769861f0bf5d654f3bbb4cd99
MD5 614375e7fe57d89ba109ec47f6ed6b41
SHA1 62c48d3019c592b89b0d418fb675ffa8d29df27d
SHA512 df138da9d7b088e27986c02f84d11e407718b56eaeae42322fb4e70fec6f66586b875ca18bcdda5c82e85d3b146a69396c2840c8f9656c30904ea132ca19e9be
TLSH
T1AD612E86E48E4463DBB491FD9DE12CCB3938C6F046AB1D5A0798D8795F27F5272B005C
MD5 SHA1 SHA512 TLSH

Submit Download

2d8a0fd7-659e-47d6-883d-3b5bab175e55.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\2d8a0fd7-659e-47d6-883d-3b5bab175e55.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

351b1b66-443d-40b8-ad27-9780a7f19e13.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\351b1b66-443d-40b8-ad27-9780a7f19e13.tmp
Size 4KB
SHA256 db560f82114449b22ea2358a8b8cc28df7dc350c27989192d2cdc36c0469a0f5
MD5 df5ddd2bfed7ae6bc7b724cd59b989ce
SHA1 79d769427e1d05803b2d685b90949874f8da288e
SHA512 d9d2d74f88764c00070f8619cbd94e3b3a7b4391bd7d2f346fbc3d3c95ab9b85ebc11e8ef9dfb004400757eef8fc84be7eee249a819c034f8147e10b45a7f363
SSDEEP 96:DfmOCmiNRhg6xKrOdszO09BEu5TVKbLwBF4:DfFCmiNRhg6xKrOdsy07Eu5TVKbL0F4
TLSH
T19C919DE6C7E4963CEC21D2F09B257A2ACF1D091492583C5FC8DA9F97A7E6030E101E5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c56a4ba0-f6b8-4067-8249-13f12f968f0d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c56a4ba0-f6b8-4067-8249-13f12f968f0d.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

cb9da5fc-10af-4f0a-b74b-f1c14f643e9f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\cb9da5fc-10af-4f0a-b74b-f1c14f643e9f.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6db1b8481523cfc180eb51299c0cf49ffcba10cfac9baf5ceeb5b009cf1fa04e
MD5 6285024ef8c3fb61d5423c9943b94060
SHA1 ffb4f30d8e86782366b6ec2903ef9c4e518c8d4c
SHA512 18f34e46a839d99a48b1969762480afe2cdfdf0e5f68e1c8ed44798602ebc853481c6effbedace7c40d225ed9c9be6b4ba8cd163151fa850d480fbf952830db5
SSDEEP 48:KIDI1Ks04jyL10JF3jXYbLuLISTUIzK1Sc/yBAIbK9H:KIDCKs0+iS9UwK1SWiAgK9H
TLSH
T15D910B44727A42413C7E3A9842B5CA1E526235733058F66B7BBC86B55B2BF040DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c28555c5-de72-4f3e-8a92-be2ffa051fdb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c28555c5-de72-4f3e-8a92-be2ffa051fdb.tmp
Size 11KB
SHA256 1f57d12537653af35bead54ddee13af0eaf39034015b400473c51af6a3cdf7db
MD5 bced58813af6b6079358117eab7837b2
SHA1 7f1465439de0ee8de63c9c2306ae4171b7395260
SHA512 94f98c70e31d90400d144af4fb12a7a35ced4b490b276abcd15412af6e1722aa55566ea6cf9d6526de280035c63c795a76c9a8dd8b2312ba2257109f252c290f
SSDEEP 192:sxZZ2RJWt/fMsEldIdpd6qgzENFB/W6+WN0qhtYrenplxaIg5kJ:sxZUmt/fMs6epfbbtLx6e
TLSH
T1CF32EA526E28697B8CC7D219FB55BF53E6F55031A1D10E48A6FCCA1C15EB6CD220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e38017ec-f53e-4d54-bb0b-e75754802041.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e38017ec-f53e-4d54-bb0b-e75754802041.tmp
Size 10KB
SHA256 918b338213cf3f6b04aa6efe2c367dc558bb133fb684eb1868e4ddd8d60d2d2c
MD5 987f74b6c30111c52c093f2b65dcee53
SHA1 f1a64c64f412e607b08e0e27369e791190ce3be0
SHA512 a89a0475a121007676c4b8f9c7bc7f7825a0df355b7044006ae86247d75a8d6dd2649084c359b58d110b3134ce43dc5e57d2c324fead8f51eb85e4e26c740079
SSDEEP 192:sxZZ2RJWt/fMsMldIdpd6qgzENFB/W6+WN0on/YrF1plxaIgrJ:sxZUmt/fMsiepfbD/Wx69
TLSH
T11C22C8526E28A97B8CC7D219FB15BF53E6F95031A1D11E44AAFC851C14EB6DD220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2fcec275-f361-49e2-bdbd-26ef307d30c5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\2fcec275-f361-49e2-bdbd-26ef307d30c5.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ccca6b534abb0fc88036d54286ab400655976b105622775a00c859fdaeb96411
MD5 a167a1f84302f8f06d7dea93b18ec2d9
SHA1 9ddcd7c293f5f28554cc15fa004f7ae4d44d32a5
SHA512 a6fd0b019edfc7d11af11d2cdb8b86ea24047663eca31743c820208397a76cc77f7abfddf7d9b5d37997fe5f3daa51b137ad5353c970635d465c482a55643e8c
SSDEEP 384:KQkUSv0sNsG5IJZhr0duHX58EC8xJgXw+2YYraif2IIl+:y0GKL0WaHwl/aif2Lk
TLSH
T1C9828E31A878AD374AF7A146F18A35839FB59127D6C92F94C6DC6B2C00DE2D9230BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c03ced64-1913-4900-beed-53bad0d64e92.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c03ced64-1913-4900-beed-53bad0d64e92.tmp
Size 8KB
SHA256 9cf9afd2027e7f812621f0510143e464b4bc008fc2dc6937a97e22b9ab237beb
MD5 b488c52c2edb6125d4dc891a8d2fe9a5
SHA1 2ee96b8a5f4e8920ab9bdc0c9062bc9688b9bd56
SHA512 a2f81103a6ecb1fb7c42993c384715b4af4afef854a43d31b204fc7d64afb76b4c0ec90416c147676943ea073913755a5cdf8fd7eb044d4d245765fa5eeb4b0f
SSDEEP 192:1ONO6wlDgQmiUy+dnW4X58gZejzorxJlDlVFU6:1ONO6kgDW4X58EC8xJLXU6
TLSH
T11702E935F9687C6B8EF3AE09B58727139FE5112BE6552F84DAE80A2D00DB65C1306D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0334d423-9593-4887-90e1-74c040b50a0e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0334d423-9593-4887-90e1-74c040b50a0e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5c50f35a43b7268054977e270302d1aad871c601466b46ea7da2ef1b7acde8a2
MD5 212abb9cc8b74c462559909c6dee7046
SHA1 43020e644eee4a2408c17d1354ef8995d4cdca04
SHA512 07cade9409c0e6ce0eda1901680ce321b04e58c0ea41f95e893aed3fb223584e486baf30660037664ec7a31ba7a3c53eb92b48ec456e878ae95e7efcc01796ae
TLSH
T120411A58BBF91144B3B76E5A9BF7A86D447FB9772E06D45D00110D4E0622A00C971B37
MD5 SHA1 SHA512 TLSH

Submit Download