2fe16eca6497a717dc9ccfa878074553d46ec246b72ecc77af122d119fabdc06

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/10/2026, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mParivahanV1.112.html
Size 198KB
Sample261018-prhejsba43
SHA256 2fe16eca6497a717dc9ccfa878074553d46ec246b72ecc77af122d119fabdc06
MD5 9ef9839dd20b1bac0e25033ccb77a224
SHA1 d18022cbd5394644956e6817a3c1889fd1ae9b7e
SHA512 676936676a04ebf79f0894e151498c91c36e10c2c5032ae58dc3bbe9c307d2ff9a710b8a25fe7c50d5f968a90ddbb770f6f7e0e71d3d19497772c3bd4e6b817c
SSDEEP 3072:Jrf2Vtktd7HvrMEJmJ8HmHsq41RDd0UjdZOakc7MLa+7I5SfwKof7j2Z3cQRV8O6:JrMO57af6
TLSH
T10214D8808874CD171DC43FBC78A67E025E8A6381A6B54907BB545A6436F88FF32DB74B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4316	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{35FEAEEC-1CC9-467F-B8A8-A20A58CB461A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 740	2864	msedge.exe	86
PID 2864 wrote to memory of 4316	2864	msedge.exe	87
PID 2864 wrote to memory of 972	2864	msedge.exe	88
PID 2864 wrote to memory of 972	2864	msedge.exe	88
PID 2864 wrote to memory of 972	2864	msedge.exe	88
PID 2864 wrote to memory of 4264	2864	msedge.exe	90
PID 2864 wrote to memory of 4264	2864	msedge.exe	90
PID 2864 wrote to memory of 1524	2864	msedge.exe	91
PID 2864 wrote to memory of 1524	2864	msedge.exe	91
PID 2864 wrote to memory of 1524	2864	msedge.exe	91
PID 2864 wrote to memory of 3480	2864	msedge.exe	92
PID 2864 wrote to memory of 3480	2864	msedge.exe	92
PID 2864 wrote to memory of 3480	2864	msedge.exe	92
PID 2864 wrote to memory of 4516	2864	msedge.exe	94
PID 2864 wrote to memory of 4516	2864	msedge.exe	94
PID 2864 wrote to memory of 4516	2864	msedge.exe	94
PID 2864 wrote to memory of 2356	2864	msedge.exe	93
PID 2864 wrote to memory of 2356	2864	msedge.exe	93
PID 2864 wrote to memory of 2356	2864	msedge.exe	93
PID 2864 wrote to memory of 3468	2864	msedge.exe	99
PID 2864 wrote to memory of 3468	2864	msedge.exe	99
PID 2864 wrote to memory of 2736	2864	msedge.exe	98
PID 2864 wrote to memory of 2736	2864	msedge.exe	98
PID 2864 wrote to memory of 2720	2864	msedge.exe	102
PID 2864 wrote to memory of 1600	2864	msedge.exe	113
PID 2864 wrote to memory of 3748	2864	msedge.exe	114
PID 2864 wrote to memory of 448	2864	msedge.exe	115
PID 2864 wrote to memory of 4064	2864	msedge.exe	117
PID 2864 wrote to memory of 4064	2864	msedge.exe	117
PID 2864 wrote to memory of 2364	2864	msedge.exe	118
PID 2864 wrote to memory of 2364	2864	msedge.exe	118
PID 2864 wrote to memory of 4880	2864	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\mParivahanV1.112.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x214,0x264,0x7ff8c562c188,0x7ff8c562c194,0x7ff8c562c1a0
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,3659907287268623832,17241102648780869196,524288 --field-trial-handle=2212,i,13157335681937183825,12849773554991289365,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,12734362140019171976,4666961328811359251,262144 --field-trial-handle=2212,i,13157335681937183825,12849773554991289365,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2372,i,18138188105957046882,18335815881873169124,524288 --field-trial-handle=2212,i,13157335681937183825,12849773554991289365,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:8
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,13392815682891161420,13290595564550165287,2097152 --field-trial-handle=2212,i,13157335681937183825,12849773554991289365,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,3570330360394208287,3122508397453914319,2097152 --field-trial-handle=2212,i,13157335681937183825,12849773554991289365,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4156,i,12666228467309414117,2798874818421537355,2097152 --field-trial-handle=2212,i,13157335681937183825,12849773554991289365,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,18005454541002258351,2258724261440271899,2097152 --field-trial-handle=2212,i,13157335681937183825,12849773554991289365,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:2
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,15863181854709952738,18441439237353976798,524288 --field-trial-handle=2212,i,13157335681937183825,12849773554991289365,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,7726738341556940009,10102040064990036007,524288 --field-trial-handle=2212,i,13157335681937183825,12849773554991289365,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,15998649828361075890,18090673837384116146,524288 --field-trial-handle=2212,i,13157335681937183825,12849773554991289365,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:8
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,15998649828361075890,18090673837384116146,524288 --field-trial-handle=2212,i,13157335681937183825,12849773554991289365,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:8
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3412,i,15084586721586257375,6968414815034677481,524288 --field-trial-handle=2212,i,13157335681937183825,12849773554991289365,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,15505627152572946647,15794171041990449897,524288 --field-trial-handle=2212,i,13157335681937183825,12849773554991289365,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4404,i,6383783850468920726,10276492759437897846,524288 --field-trial-handle=2212,i,13157335681937183825,12849773554991289365,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2820,i,13206115634098938648,14136618129175347750,524288 --field-trial-handle=2212,i,13157335681937183825,12849773554991289365,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,16085370772075760549,8979334163220372212,524288 --field-trial-handle=2212,i,13157335681937183825,12849773554991289365,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6152,i,13245142256998291230,17390565840360298617,262144 --field-trial-handle=2212,i,13157335681937183825,12849773554991289365,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4880

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

21fdd94f-1461-40e9-b0c2-0dee44fe3475.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\21fdd94f-1461-40e9-b0c2-0dee44fe3475.tmp
Size 8KB
SHA256 96506c8131d965bbc58502fb94dc78830ee5f3c68a1d7228f9e4ad4c422aa78a
MD5 728201070d75a5bfd831ceed2b82be3b
SHA1 63c960389d49bf473b3099b836de29e558217110
SHA512 713a8beb376f50c30fa75304a603bbb102248e631dabc71058c6858194f38e42ddde83fc8f4d8b355461f57643b7ceffff54e14e4a3a23f37e605d58e60f81b9
SSDEEP 192:LONU6AmwprQmiUyS26siX5FPjzorE3O+JiuBU6:LONU6ipdw6siX5FX8E3OruU6
TLSH
T12502FB35BC786C7F8AF2AE49B54737139FA5116BEA946F84CAE81B2C01D765C1306833
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2f746835-d2ca-472f-aaf4-8e9ff53aebfe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2f746835-d2ca-472f-aaf4-8e9ff53aebfe.tmp
Size 18KB
SHA256 9f34be4283e5cfb41520098747a8e4c43f7f1661c43ce9c03151514b6c7e401d
MD5 22773ae99a6a0415787697b40a6b6ff3
SHA1 f0083aa8a71a51d5c3e66a26fc70d88307b88ae7
SHA512 9d1080fc80f6cbd4fe4859400c34603ee1800270823d8b8fb61a7faeca74c212651aa69dc76c5878819aecf6cef1dbc7e9ebf2c8ba734ebd1191c5dae7e5891a
SSDEEP 384:TQkUSv0sNAZykwpu5pt9iX5FX8E3OzXdJrzaFMTNIIlZ:90aSTapEdhzoMTNLX
TLSH
T120826D366874AD7B46E2B555F14F32139FB89117EAD81F94CADC9B2C01CA2D9230B933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

464a9a9c-fc4a-4d1f-b38e-022342e313fe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\464a9a9c-fc4a-4d1f-b38e-022342e313fe.tmp
Size 8KB
SHA256 e26ecf27c4ff6c3e5f9acbb0fdbb3d379cacb2196c1c2a1111f56a9eec7169ee
MD5 c084ffb5b39da93f74146b5308d4e4f5
SHA1 ca6b9c2598303689465e75dab80762c5f70fa99b
SHA512 46d2d1c632c7ba10f2b523c9c0d46f4f67d74645a65ac976285cc2955be45d667c0681edf576b3a129b9590b1ab6c621faf5175a1778352da51838cde2d9cdec
SSDEEP 192:vONZ6AmwpAQmiUyF2vsiX5FPjzorE3OzXCSJrjlRTqJFU6:vONZ6ipAZvsiX5FX8E3OzXdJrXaFU6
TLSH
T11E121C36B8786C7F1ED2B584B08731139EA94157EB996F94C5EC1B2C01DF6A8530A833
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5421c8b0bf6e5f37422a05b412b233cde63f1db63aa71d65c91c5b31275595c0
MD5 07f616e3db8597d59ea940f94c1abb0b
SHA1 eedf28342bbff8c4cae798c2980ea6953992f1b2
SHA512 30782b7b7d8c6db47a40bc15f968f35fca7939aaa4b83a8a19c8f5a415c745b54c161abc0037d24bad8ebf15d5deb4134f24e357c1b5869f1598fa22619302be
TLSH
T163D0243C7F114D50D40041710530D50435D3CC1740D015050C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 daf8c1243ee20a2e95a6bd65ee87f94e97a213f1bc26473da181514314bf0e5e
MD5 22b29b46992ba3d1fd586e35207b402b
SHA1 03a007676fa49e6e9fbeffbbc2e943124c1b3d3d
SHA512 3634d483353d2e9fb49d846c71c6867053c6a8f1ead10608addea75574d5ce0e36c8de933f71d10bae9682752372e6f7925bbc3c9d982dfe840a9d664f859687
TLSH
T1BDD0243C3F514D50DC0041710530D50435D3CC1740D017070C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

2bc2e357-366c-4504-ad6c-cf6be7e2d118.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2bc2e357-366c-4504-ad6c-cf6be7e2d118.tmp
Size 9KB
SHA256 0d86e2f92c2820c1cd4508799656ccdbe67253745876ea324235587b489a94c2
MD5 c6a20b509cb635d8cd661dab1baf2046
SHA1 c2bbfc03ab014a9b275599e31a7ee37ec68b858a
SHA512 6a3fce0d64c6a6623f4d389232579017d7701fc889af82c88645272dd78ae081ce1199f34cdb25c94fcc8cdeda03a4411eaf00338eb9f0bc211375df728eb512
SSDEEP 192:sxZkRSW6/flsgNtIdpdUHW6+WNGY3SZ/zIg5NJ:sxZkD6/flssOaHbGzJ
TLSH
T14A22C8126E38697B8CCBD21DBB55BF43E6F95071A1E41E48A6FCC61C04E66DD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

763f591c-4239-47e9-b1df-db33eadb79e4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\763f591c-4239-47e9-b1df-db33eadb79e4.tmp
Size 10KB
SHA256 df2954bb6d12ca6d82e72c1871fd7a273eed9e6ec1c190285e2f69a6764f27a8
MD5 2405a5871c4be48feee3b03073ffa1ee
SHA1 5ba4d212d0bdd95a27eb8d6dd3424194665fa4ff
SHA512 b2f454c6d2f9c6654bb98b501a36fa645411145f80b21db05fb3a0383236746f3c325902da0bf055e82841175874aa24e1ce484754524b04b4092a078fb9dc5d
SSDEEP 192:sxZkRSW6/flsgBtIdpdUHW6+WNGY3wZ/zIg5nJ:sxZkD6/flsAOaHbG1f
TLSH
T1E122C6126E38697B8CCBE20DBA55BF03E6F95072A0E51E48A6FCC61C05E76DD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 7159cd484a84c3f33bfe90d78b2d14b615ac877419b8c7e5e8ac0e551c381c39
MD5 af6c646f8879b6867b6cb8853a162a1c
SHA1 92b1efe1e8f81a9a04abed03cafd0cbc7bf6d96c
SHA512 f72d27d73f18b7a7521780919ae6de190fca226d8fe8cb2447052f91c55324e8bd17e111be618de40ebceea1fcbc5d47bed007f2d22d84bebc7e7556253e68e3
TLSH
T112E0268549D8C32FA3096B5B01AD630CC3D0372AD2C8BAAE2701C9C87205BC0A6E7690
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 e37d7f193453ad225b8601cbf4f073736c184e9289355cb326cb69ece81062c3
MD5 b6a0295ee3221cf6c7b30dfc31076940
SHA1 3efd507ec1ad922e3e1901bad208db26340a1ffe
SHA512 2905700d2b0d817f195d63bc9f312c0fcba6c5b297ee79524111e35551c026251d51885a7599745d396c4a4736ba3c07b3a7ab415070fb257ae5b994408514c8
TLSH
T1EA6183885684C1EFFF6BF8B0B2E62387F9354E9375D3ED5122BCD4B8589AB505034850
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 69e98610bdd778604409685e91f6a93ba2422658b5316e94c1033f629a3d8d8a
MD5 73906289c51d1510f969c2516fb62ef7
SHA1 9c22c24fe7a9974d776bc0f496633e408a5ed970
SHA512 3d07dc82cdb3a546c8652075144cc204c2924dfd527c010cb04051cabe366176a2153bb930ddc3c55aa7d31a7ad9a15210e8b20e8528fbb289597c6ff5fd4b94
TLSH
T10D6141845684C1EFFF6BF8B0B5D6238BF9354E9275D3ED51157CD4B8189AB505034850
MD5 SHA1 SHA512 TLSH

Submit Download

5fd5b6eb-699d-4916-ad2e-8c27bb05c8f6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\5fd5b6eb-699d-4916-ad2e-8c27bb05c8f6.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

3d008b75-c39a-4db5-a255-f14804a46a7b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3d008b75-c39a-4db5-a255-f14804a46a7b.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

56898a14-f10c-4feb-8874-8e372f14a27f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\56898a14-f10c-4feb-8874-8e372f14a27f.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

8e1dd5bf-d307-4627-9889-2652942881a7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8e1dd5bf-d307-4627-9889-2652942881a7.tmp
Size 1KB
SHA256 20feaca49221b503f05ff19425c480e2f9b6ad5f11cdb1d2db656418d87ec944
MD5 740c5b2b3469e90181118fc12461fc41
SHA1 b4385fd881f2dd79ec504d5bf5fda37b1c30293c
SHA512 ec836e85e05c0472ad13104c6dc086f561c627696cfc6db150b9bb4b0c226dabf3c437326d08cc106092bbcd7f1108e8bf15597ab2fabde4cf1561a36c1bd2d1
TLSH
T1E331CFF7C3D4876E891516F05B29AE2BCE1D0946822C3C16C9E4EF2B93E2071D10269F
MD5 SHA1 SHA512 TLSH

Submit Download

acf8c7c1-6f8e-422e-9e1a-d72083563e04.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\acf8c7c1-6f8e-422e-9e1a-d72083563e04.tmp
Size 27KB
SHA256 ebb9abfb17e3f7beecc16a286e87d8380232e5e5b4b2d1cf46c7e217d0c9ee1e
MD5 e9f57b9b9cdfc74b584947336fe66f43
SHA1 0480832a71e4c78fba1d0dc383f0529b1bbb5654
SHA512 7742c9633566aec6de33ae611c7467372a1edd8135faa99dc8daed46820a9d51626335b030ce57ede98ac7208735cc189c35750196bd4295eaed659ae3de13d6
SSDEEP 768:YM30AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72HrolZMm:YM30AbSWvS2l9u1jaLmLZ12UR
TLSH
T112C2DA3B640CCB7E4FC05A9DDC6AAF9B6E9C02C796648D4047FA984C02C77EA91174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b5609d3e-caa9-4170-9021-4f9070fc140e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b5609d3e-caa9-4170-9021-4f9070fc140e.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cf8440a5-5bfd-4c9b-a497-a2a40f6fca50.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cf8440a5-5bfd-4c9b-a497-a2a40f6fca50.tmp
Size 9KB
SHA256 4a399381533f34f26e211d1155fa5de01e2e56210f90d983db84b63cab72ecd2
MD5 c87f3f3649fd48430814ff95c253735e
SHA1 876b61373344af0d9d426103e77dd6fedf9cdb56
SHA512 aba5c53c2885ac23a12608ed99d82803147ae716e4ce2b449d3d6b0ff3647b9daa2c355ef443a839604a94ae598b34814762cda7da6163f0c178382546cc59e0
SSDEEP 192:sxZkRSW6/flsGNtIdpdUHW6+WNGY3SZ/zIgrJ:sxZkD6/fls6OaHbGz9
TLSH
T1ED22B7126E38693B8CCBD21DBA65BF53E6F95072A1D41E48A6FCC61C04E66DD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ec5aed08-9a69-470d-b4d5-3d8ba83f0170.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ec5aed08-9a69-470d-b4d5-3d8ba83f0170.tmp
Size 10KB
SHA256 93ff1c861350323d3b64b2095c9da076121c44054a34c70ce2f264b565ccd8b4
MD5 30437e45adcb7ab16984236678ed5f3d
SHA1 3c1832b8e187eb8e47ee55178f07ba2e1372f396
SHA512 25592aa093fae7ab1b944b3840d8b5a42db1f2e814c733e671e876ef400d388a8d310003751e72cc2ae94a5e9e232041f5c6cf8da318c522d116a913b241e4f6
SSDEEP 192:sxZkRSW6/flsgBtIdpHUHW6+WNGY3EG/zIg5nJ:sxZkD6/flsAO0HbGMf
TLSH
T1FB22D8126E38697B8CCBE20DBA55BF13E6F95072A1E41E48A6FCC61C05E76DD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8bc6dcb9-9a63-46c8-a89d-190a0431a88f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\8bc6dcb9-9a63-46c8-a89d-190a0431a88f.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

bff83990-3c40-4271-a313-412aec43cef6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bff83990-3c40-4271-a313-412aec43cef6.tmp
Size 18KB
SHA256 1f9467f940d869cfa4435e96eec2e69ead1db6307a410a06f0af20e1c9760cdc
MD5 a240904d580e38ef8a11dbe9f517599c
SHA1 dbcafe1a7b4bd6e79e0133bbc90e3adb0ab01685
SHA512 6ffa27c2d79497f12d2ba729fac1c3c92d51391bfb13e1e5099085888448defa2fa425ade2c7a3cc05020719dbbff9bfd59705b8a87bb04211c5d3049fd5adaa
SSDEEP 384:wQkUSv0sNAoykwpu5pt9iX5FX8E3OzXdJrzaFMTNIIlZ:Y0FSTapEdhzoMTNLX
TLSH
T14F826D366874AD7B46E2B555F14F32139FB88117EAD81F94C9DC9B2C01CA2D9230B933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d20a3fa0-3714-4a5a-862f-9cb7717aca67.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d20a3fa0-3714-4a5a-862f-9cb7717aca67.tmp
Size 21KB
SHA256 e64a8457528a85f67e9fcaf5b16251eb364b63a33e954c6c42b3ef080b517f24
MD5 7cd5be2cddf356bbd690d50772a06770
SHA1 7b639063eadeb2b3eef6e2e9f68d27ff3452716f
SHA512 065199caab0ebd61617a95b8bbb39ed54965c820b7f680301354f417fa05cd3b7656a386da8660c8fe87b105a6ae051c65e08a20af4dc407c5494d6a1faab54f
SSDEEP 384:eiFzQkUSvTzsNA8TUNTUlIlZykwpu5pt9iX5FX8E3OzXdJrOaFMTNIIlZ:1Fd3ZwgoSTapEdhOoMTNLX
TLSH
T1FDA26C3358B49D7B9AE6AA54F14E3203DFB48167DAA45FA0D7DC9B1C01CA1DC230BD22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

021fcff9-5954-461c-a53b-977cfff4e51a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\021fcff9-5954-461c-a53b-977cfff4e51a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 45359bb5ad0241be302c3f1bd7a7a1b13cea08d14177702165917a0632e4f355
MD5 53491ac43b53d22fb15b849720d59bbe
SHA1 b7947df909e47ad92fbfa1ec4c715db52c003a2e
SHA512 620f75f930a59878a66d179def6c38273a76a1680ce5eda369168df463ede9a4939e101f7d4a8aec5c97270d4e7968f0692c3e9df0003f1abfea43fecf90a8f1
TLSH
T1FE410658A7F91148B3776E56ABF6A86D587FBD372F06D15D00110E4E0A62B40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download