hxxps://parvatifabrics[.]com/[.]gr016295/

Analysis

user interaction
yes
max time kernel
30s
max time network
34s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 12:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://parvatifabrics.com/.gr016295/
Sample260930-pcbnfstydy

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2476	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{EBBBF804-5F7D-489D-A0DD-957AF2C2D064}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 4408	4816	msedge.exe	86
PID 4816 wrote to memory of 888	4816	msedge.exe	87
PID 4816 wrote to memory of 2476	4816	msedge.exe	88
PID 4816 wrote to memory of 888	4816	msedge.exe	87
PID 4816 wrote to memory of 888	4816	msedge.exe	87
PID 4816 wrote to memory of 512	4816	msedge.exe	89
PID 4816 wrote to memory of 512	4816	msedge.exe	89
PID 4816 wrote to memory of 5048	4816	msedge.exe	91
PID 4816 wrote to memory of 3052	4816	msedge.exe	92
PID 4816 wrote to memory of 5048	4816	msedge.exe	91
PID 4816 wrote to memory of 5048	4816	msedge.exe	91
PID 4816 wrote to memory of 3052	4816	msedge.exe	92
PID 4816 wrote to memory of 3052	4816	msedge.exe	92
PID 4816 wrote to memory of 3968	4816	msedge.exe	93
PID 4816 wrote to memory of 2540	4816	msedge.exe	94
PID 4816 wrote to memory of 3968	4816	msedge.exe	93
PID 4816 wrote to memory of 3968	4816	msedge.exe	93
PID 4816 wrote to memory of 2540	4816	msedge.exe	94
PID 4816 wrote to memory of 2540	4816	msedge.exe	94
PID 4816 wrote to memory of 1120	4816	msedge.exe	101
PID 4816 wrote to memory of 2920	4816	msedge.exe	102
PID 4816 wrote to memory of 1120	4816	msedge.exe	101
PID 4816 wrote to memory of 2920	4816	msedge.exe	102
PID 4816 wrote to memory of 1224	4816	msedge.exe	104
PID 4816 wrote to memory of 4440	4816	msedge.exe	112
PID 4816 wrote to memory of 4440	4816	msedge.exe	112
PID 4816 wrote to memory of 4440	4816	msedge.exe	112
PID 4816 wrote to memory of 4136	4816	msedge.exe	113
PID 4816 wrote to memory of 4136	4816	msedge.exe	113
PID 4816 wrote to memory of 4136	4816	msedge.exe	113
PID 4816 wrote to memory of 4848	4816	msedge.exe	114
PID 4816 wrote to memory of 4848	4816	msedge.exe	114
PID 4816 wrote to memory of 4848	4816	msedge.exe	114
PID 4816 wrote to memory of 3620	4816	msedge.exe	115
PID 4816 wrote to memory of 3620	4816	msedge.exe	115
PID 4816 wrote to memory of 3620	4816	msedge.exe	115
PID 4816 wrote to memory of 2860	4816	msedge.exe	116
PID 4816 wrote to memory of 2860	4816	msedge.exe	116
PID 4816 wrote to memory of 2860	4816	msedge.exe	116
PID 4816 wrote to memory of 1284	4816	msedge.exe	117
PID 4816 wrote to memory of 1284	4816	msedge.exe	117
PID 4816 wrote to memory of 1284	4816	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://parvatifabrics.com/.gr016295/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffbbcd7c188,0x7ffbbcd7c194,0x7ffbbcd7c1a0
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1876,i,12231369873402685961,1753376265942602961,262144 --field-trial-handle=2252,i,2096358970580565706,12612549221946594316,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1988,i,8812871175877850476,15178950114757079245,524288 --field-trial-handle=2252,i,2096358970580565706,12612549221946594316,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2560,i,11501801744585257094,10147491499887967897,524288 --field-trial-handle=2252,i,2096358970580565706,12612549221946594316,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:8
  2⤵
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,14406444576083238477,9457749290124808846,2097152 --field-trial-handle=2252,i,2096358970580565706,12612549221946594316,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,7472667140985589014,8451135394681250323,2097152 --field-trial-handle=2252,i,2096358970580565706,12612549221946594316,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,9389244052299496862,10311904081070304945,2097152 --field-trial-handle=2252,i,2096358970580565706,12612549221946594316,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,14722962880925944329,2085030608187796229,2097152 --field-trial-handle=2252,i,2096358970580565706,12612549221946594316,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:2
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,13080662218054228615,8510021297939819283,524288 --field-trial-handle=2252,i,2096358970580565706,12612549221946594316,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,10934331650256329322,5768937241006270870,524288 --field-trial-handle=2252,i,2096358970580565706,12612549221946594316,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,3805213282591365383,3930598809344156195,524288 --field-trial-handle=2252,i,2096358970580565706,12612549221946594316,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,3805213282591365383,3930598809344156195,524288 --field-trial-handle=2252,i,2096358970580565706,12612549221946594316,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6296,i,16442132072400520323,14095686384486595596,2097152 --field-trial-handle=2252,i,2096358970580565706,12612549221946594316,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5672,i,8305821819414389601,9356713059908584036,2097152 --field-trial-handle=2252,i,2096358970580565706,12612549221946594316,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4276,i,18213410842469752299,3198639912102341469,2097152 --field-trial-handle=2252,i,2096358970580565706,12612549221946594316,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6232,i,3123387032748647224,16941179069122060558,2097152 --field-trial-handle=2252,i,2096358970580565706,12612549221946594316,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5824,i,4576771405134566462,18033493750181968738,2097152 --field-trial-handle=2252,i,2096358970580565706,12612549221946594316,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4604,i,13101378320839541148,1441362917600341110,2097152 --field-trial-handle=2252,i,2096358970580565706,12612549221946594316,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:1
  2⤵
  PID:1284

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 63b3e051645c9957f53c538586c3b5463f3ba4412c230d66eb66f06ad6052604
MD5 0070abe22a07fb36149648973e990688
SHA1 c8a203457b36afa6d0ce9b56d26cb7817d832d37
SHA512 cda9b7179f6f997dac4ee0624ff9f92ed77b7c27218584fb07f6b2ebc24d10fc25d45c3d2781b766d834f82054e29ee150712e7ab7d7a11465c468d0f8a31fd1
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P79:fwUQC5VwBIiElEd2K57P79
TLSH
T175B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 27f6aa5d39c98b4843eaed7972cf93d10e75e08f497afafa54ccf4057f6d52c9
MD5 a91eafa1aeb7b35d5c7abac6d2c83384
SHA1 a76b97105496dbfe28857282f5b661789a032b25
SHA512 4bebba8a121156a8e7e31bb49955c0375f1ca3be7dcd3c9b113d261a4618ecdf6781fce438d8e56020e438286e1619d3844f48e91b2b2c3cbb4a55d4c199972a
TLSH
T17AD02B24C9E41E90D0131434002241453F8CC03858023012D0B812AE15419D60A21020
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e364ae2365b95ee5142a1a0abe3ee5065b85c554bc5cb9fcb1f31bcd0a1af4e
MD5 75bc6f9debcf49d2312740dfba56733a
SHA1 af0f5dfe4b330cf62c24c0003f6c57159b23e268
SHA512 c0a6cf9272c224460d1e7d25cf8159aa43733ebfb5f2761293ec6a5f2b4d71e061daa60092335856322f566a072c79184d7ad45d2b04b7cf8f3628e3a4bd4d35
TLSH
T176D02B2489E41E90D4131434002141453F8CC03858027113D0B812AE05429D60A21020
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 1aa3d4195d2b4ce1403dcece5a7ca312915bd436b9a726b325c2f442b678488f
MD5 c2043dea10d117c54e5a55bb002d500f
SHA1 e597462a7732bd678b492b3a6dedb81d20792f62
SHA512 07f70dace576aa16c78832575a656fd21810edb9b4e077d3524ebd4e1d4b887a2acc0569690c5e9536f8300c2eebd3c9b8900cd11940c7f01a14911ca744734e
TLSH
T18B51A5C027D8A278F79480B082D921B371F885BB3D875F0B00E4F9795A0EB2B5D07B60
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592acf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe592acf.TMP
Size 2KB
SHA256 566d3c7d2e0ec64781f2e9e015c0c66f23495b8fc7dc716f7af9ddb2e9d6d927
MD5 b946cfc3565fa777939460f523923e6d
SHA1 0d16b91de57e7927dacf56acf5f306704c476f4d
SHA512 942de6596b34e91bef542f57cf41df62ce5f5d4eec359274c55e02e94b5a4db51258ffa7afaffeaa9f611440960bfd7c9615ded444c0f1bacc11f237d8ba5a4d
TLSH
T17C5196C467D8A678F79484B086D921B371F885BB3C875F0B00E8F9795A0EB2B5D17B60
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

c6e4850a-83f0-4d86-ba88-a032ec18d057.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c6e4850a-83f0-4d86-ba88-a032ec18d057.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 9d5c7ef053f717489eaa124224c2e617c586b47e71ea1324a74f2402114f52f9
MD5 af82b5d07e58def277128bcfd4181b0d
SHA1 1b73fa75679773c04370913aca8feb4e4bef3518
SHA512 23b7c2c2031a4a268f10ef63a583ad3c71130dd32509391540d13093fb89ef0af4fe66d110f84a4dc3cd0b641a040c3cc11ee2dd007b20e4fed4ac39c39451ef
SSDEEP 192:sxZNR7WQ/f3MsPRIdpJHW6+WNGYgQvsZIgrJ:sxZNYQ/f3MsPaJHbGp9
TLSH
T15412A6526E38A97B8CC7D20DBB25BF53D6F9503265951E48EAFC861C04E7ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 df2a190977f3ab7a05e183a535f1f4cff9627258f06d838339fce177759e0126
MD5 d7b8a6044d4dc0f748bba27e7eb376bc
SHA1 f9051184550b08330d90711787058fde6f658700
SHA512 b72e3d81debd0cc45dbf0e8edfa17b74027ae2dc92a08851dc90492c4fa42cc23232fe36040f531da5cf7b32514bf9b6c999f2be173ad6d9dccc7acf077e836f
SSDEEP 192:sxZNR7WQ/f3MsMMIdp97HW6+WNSNK/Yg7vsZIg5/IJ:sxZNYQ/f3MsMV1HbT/EFs
TLSH
T13B22B6526E38A97B8CCBD20DBA15BF53D2F9513265951E48AAFC861C04E77CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 02e176f9fd14371d064efa2b44a82d105d0ae12744fb1ffbf2479cd00e415b81
MD5 ebf9dac25f45279b95fbe86a33dc1a94
SHA1 eb7f23b3f0de24434a5ed78b91bc063659d5a0ee
SHA512 03379846edc921fec2103b8dab38990c6c20ca7fe2044410fce331e7652953dadc6a1d8af018f57b4691c2ad3c16f4458eef06f6a783853094069a747697114a
SSDEEP 768:XsichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXzsroNja:XsichfPWvPZplu1jan+LKgz3Ja
TLSH
T127C2E97B644CCA7E4FC01E9DDD1A6F9B7EA802C7A6588D4047FA984C02C77EE51264CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b6762968374f9f00369a4ec1d997cc14fb8a8d66e23057ce7b45d225f1ed55d8
MD5 a10a165a1da48e9b38660c138d038333
SHA1 851d4bdab3da5f65d3818d11bf7efa17b10466e7
SHA512 52b059ffde808c93c977c91749141c565d38b90de891bb7baa2ac17fdd0d3ed8eb408a9f55bdb3ed32fa9be22b89ba7997c7026ac63043a50a79784edda300b0
SSDEEP 96:KjeX0QeEkxVwFsfIxKn4f+x7WO9IkS60wKVaurCKwAyD:ceX0QeEk7wF0Ia4f+tWO9IkSPkBD
TLSH
T19B912D01717A0641387D2658C176C76E464239F33028EA2B7FBC42E15A6FE081FFD9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 6d9bb2f7aedd8995e4fd1ded3183f1e6c2ccc7b6876759ef8131c7e521c7aaac
MD5 8c8963a00f5149b4854623789eb95bdc
SHA1 4f591d4b8e1e4c309d6311f108fa28397fabac4f
SHA512 104ebb7f98d05cade1ade9c8d0a12c6b46c69c81ed3077dd7c2d3c35b91e9945e0a0a21451beb00284990476bb4ad8175a0ea084e0b4f535659aa3d36df8ac9f
SSDEEP 384:nZcIhsNcvuzi5aHRU+BGYX5EOv8bOXXftgOIwZOy0jor:Ph7hIGYuO2eXfXszY
TLSH
T1AC828E7398B8AC7B2CE7A141B54B32035FB45527EAC96B54D5FD5F1C00EA598030BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 98dec952f96664c29a1a59287e7fa0bdeb18a6c5ffc8a088ed95386343f3acaf
MD5 736c2d757372084eb85f20f71d4c0cad
SHA1 758b11ed3df0bf4c7a67b84d5689f741b965e833
SHA512 8a13c8cc46de420043b617909feb3577f97d96928c423932aecfea074d1791ab77554baa6be6770a5b80ac229c6e7e293190bfdf4945cc51d1541a70c8f76b76
SSDEEP 192:LJONS6DphmqQmiUy9E9Xq8wGYX59ezXCHjzor4Rukk74gU6:lONS619y4XRwGYX5EOv8RZU6
TLSH
T12F02E735A8B87CBB5EE3AE45B54B26139FE8212BAA952F44D6EC1F1C00D764C1306937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 75a7c92f62ac59c196095774c8f2b61588e3083d8e892afca790f9a3ae3b42ef
MD5 8988a35bc187db1855142664785ad7cd
SHA1 b854bbcb9444ad672e95ae1e3e1648faad25a2af
SHA512 4661860e2b6da2fd96ce90c6b7962fea616a588d2d4ec75d9ce87c8573b1f2555d17d1da0da1df49131f5ee13ebba92588bc451b0638a6b704d4c1053fb5d066
SSDEEP 192:LJONl6DpheqQmiUy9O9X6wGYX59ezXCHjzor4RyOX+eakIITrq56U6:lONl61VyWX6wGYX5EOv8bOXVfU6
TLSH
T175120836A8B8BC6B1DD3A551B44B35139EE4522BEB896F50D6EC2F1C01EF58C130AD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7858b905c369e277094091f459ad996f74e72f7c0a4d42bd200ac0e2b2abb0ba
MD5 39fe25854a1c54338372c3170248a636
SHA1 09f0fc11f4de68a75e1710a7cf34481122fca6c5
SHA512 8d8d81ecc09556b767aeee975e2bd2cb522b9f420dcffe173c4db4beaba2919f203d67dbe04b1d38ce7695fbe2252cffabf8d9792dbbb84db085518da65c84a8
TLSH
T10941185CAAEA1148B3B77F59ABF6686E447BB8632E0AD45D10000D4E0A36A40DC71B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1224-183-0x000001FE9A800000-0x000001FE9A949000-memory.dmp

Download

memory/1224-182-0x000001FE9A800000-0x000001FE9A949000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads