2fe16eca6497a717dc9ccfa878074553d46ec246b72ecc77af122d119fabdc06

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/10/2026, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mParivahanV1.112.html
Size 198KB
Sample261018-prhejsba43
SHA256 2fe16eca6497a717dc9ccfa878074553d46ec246b72ecc77af122d119fabdc06
MD5 9ef9839dd20b1bac0e25033ccb77a224
SHA1 d18022cbd5394644956e6817a3c1889fd1ae9b7e
SHA512 676936676a04ebf79f0894e151498c91c36e10c2c5032ae58dc3bbe9c307d2ff9a710b8a25fe7c50d5f968a90ddbb770f6f7e0e71d3d19497772c3bd4e6b817c
SSDEEP 3072:Jrf2Vtktd7HvrMEJmJ8HmHsq41RDd0UjdZOakc7MLa+7I5SfwKof7j2Z3cQRV8O6:JrMO57af6
TLSH
T10214D8808874CD171DC43FBC78A67E025E8A6381A6B54907BB545A6436F88FF32DB74B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4024	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{D2D9ED03-C096-495E-A3D6-948F45B45991}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4508	msedge.exe
4508	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4320 wrote to memory of 1632	4320	msedge.exe	89
PID 4320 wrote to memory of 5824	4320	msedge.exe	90
PID 4320 wrote to memory of 4024	4320	msedge.exe	91
PID 4320 wrote to memory of 5824	4320	msedge.exe	90
PID 4320 wrote to memory of 5824	4320	msedge.exe	90
PID 4320 wrote to memory of 2668	4320	msedge.exe	92
PID 4320 wrote to memory of 2668	4320	msedge.exe	92
PID 4320 wrote to memory of 5044	4320	msedge.exe	94
PID 4320 wrote to memory of 3460	4320	msedge.exe	95
PID 4320 wrote to memory of 5044	4320	msedge.exe	94
PID 4320 wrote to memory of 5044	4320	msedge.exe	94
PID 4320 wrote to memory of 3460	4320	msedge.exe	95
PID 4320 wrote to memory of 3460	4320	msedge.exe	95
PID 4320 wrote to memory of 6096	4320	msedge.exe	96
PID 4320 wrote to memory of 2212	4320	msedge.exe	97
PID 4320 wrote to memory of 6096	4320	msedge.exe	96
PID 4320 wrote to memory of 6096	4320	msedge.exe	96
PID 4320 wrote to memory of 2212	4320	msedge.exe	97
PID 4320 wrote to memory of 2212	4320	msedge.exe	97
PID 4320 wrote to memory of 4908	4320	msedge.exe	99
PID 4320 wrote to memory of 2004	4320	msedge.exe	100
PID 4320 wrote to memory of 4908	4320	msedge.exe	99
PID 4320 wrote to memory of 2004	4320	msedge.exe	100
PID 4320 wrote to memory of 6024	4320	msedge.exe	102
PID 4320 wrote to memory of 4888	4320	msedge.exe	106
PID 4320 wrote to memory of 5776	4320	msedge.exe	107
PID 4320 wrote to memory of 2612	4320	msedge.exe	108
PID 4320 wrote to memory of 4540	4320	msedge.exe	109
PID 4320 wrote to memory of 4540	4320	msedge.exe	109
PID 4320 wrote to memory of 4508	4320	msedge.exe	111

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\mParivahanV1.112.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffed949c188,0x7ffed949c194,0x7ffed949c1a0
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,15767238626605177670,8878626980323873716,262144 --field-trial-handle=2364,i,1250185422824218045,1135421217179062099,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:2
  2⤵
  PID:5824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1672,i,7529017419371294327,4071567772244590373,524288 --field-trial-handle=2364,i,1250185422824218045,1135421217179062099,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2196,i,7012619099253127745,7845132160970643467,524288 --field-trial-handle=2364,i,1250185422824218045,1135421217179062099,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:13
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3660,i,6465973872651341490,4345873516631139104,2097152 --field-trial-handle=2364,i,1250185422824218045,1135421217179062099,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3664,i,2127816683104772554,3927368317626969920,2097152 --field-trial-handle=2364,i,1250185422824218045,1135421217179062099,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,13127825907376920369,16136110956754076129,2097152 --field-trial-handle=2364,i,1250185422824218045,1135421217179062099,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:1
  2⤵
  PID:6096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4308,i,2314536846508919188,8954749024869051737,2097152 --field-trial-handle=2364,i,1250185422824218045,1135421217179062099,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:9
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3708,i,11086688339974030496,1194729897450472287,524288 --field-trial-handle=2364,i,1250185422824218045,1135421217179062099,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3784,i,11898893904460582570,16567883945164403384,524288 --field-trial-handle=2364,i,1250185422824218045,1135421217179062099,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,13370031299336672457,15405502751710376789,524288 --field-trial-handle=2364,i,1250185422824218045,1135421217179062099,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,13370031299336672457,15405502751710376789,524288 --field-trial-handle=2364,i,1250185422824218045,1135421217179062099,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
  2⤵
  PID:6024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,3940249636581097159,12409203393474528856,524288 --field-trial-handle=2364,i,1250185422824218045,1135421217179062099,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:14
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,13053558604013328278,8188825811478492980,524288 --field-trial-handle=2364,i,1250185422824218045,1135421217179062099,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:14
  2⤵
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,7770634793477975781,6189594748694354549,524288 --field-trial-handle=2364,i,1250185422824218045,1135421217179062099,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:14
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,17944179250313644778,1777137543901108339,524288 --field-trial-handle=2364,i,1250185422824218045,1135421217179062099,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6508,i,5892869756393138406,5094036039034006299,262144 --field-trial-handle=2364,i,1250185422824218045,1135421217179062099,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4508

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3cc469f4-e23e-4161-9ba7-4eaf1e275d34.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3cc469f4-e23e-4161-9ba7-4eaf1e275d34.tmp
Size 33KB
SHA256 8cdf3ee61136df5b31249ec01fa9c1af859f9c9350a1911daab9ec5f54f03b61
MD5 20a3e2f3aded120e1cb2e1fedc8c1181
SHA1 bac676d97566956ef089ddff20990166cb2e3b72
SHA512 8364288746d07eeb9b712e03b493d11a1c46dfbe098c554683537a091d925e6a09bf6b206f5960b17e3473befdc33d903641e3f35db840527450a55900a8f55e
SSDEEP 768:DJ3nj1nec7fZrKIHLp5XSwQs88uBkiT2jxTfLe:DJ3jTtrl1ILNB+tK
TLSH
T14AF2BF39F8A498B35CB39382765A37466FF0A147C8C40B94C9DE661D02CB79E6747827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3e175945-c83d-4c5c-a76f-15efd39307db.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3e175945-c83d-4c5c-a76f-15efd39307db.tmp
Size 33KB
SHA256 dd4069f205304851bf87069016e77e80bc00f1b6417942e582e05b2f7dc76355
MD5 8a2f1fd639edff08183ff9744b994de5
SHA1 24540a1ce4ef58ca4dd8ef62517503dc7ae75452
SHA512 c7eea1f98215a7a5afc4a59f945cec801bff8c75b50a4fb1f4c4b75a1c6c810d9b7f9ac5fa3aa1ad2e0c00ba0e51399d1f87cefa536968620dc292a63c7e6cad
SSDEEP 768:gJ34j1Nec7fZrKIHLp5XSwQs88uBkiT2jxTfLe:gJ3ANtrl1ILNB+tK
TLSH
T1E0F2BF39F8A498735CB39382765B37466FF0A147C8C40B94C9DE661D02CB79E6747827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5761e638-3b87-47ce-adf3-1e7b2ee292da.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5761e638-3b87-47ce-adf3-1e7b2ee292da.tmp
Size 38KB
SHA256 992d3b61f4f74ee9e56a5ad86fb1941c6429e85630a21327e464d1f8841ab350
MD5 ca7b68dc19b053320ee28a43833e30b9
SHA1 ad4ec1d6ff8299183a12182777951669b81461a5
SHA512 760e535bcc3c0768689a383f259527f390024517f5bf5fa0fbc64373677d27304125dac86a9bb31d4bf5101380a42bf86437c45e2ec2077222a30463f321c669
SSDEEP 768:1/UxvxjgC+W3cEIc7fZrKIHtp5XSwQs88uBkiTzj/P84g:YZj3+W3cItrlTILNBFHg
TLSH
T14203C039F8945873ACB39381365B274BAFF05153C4C41AA449EE7A0E03CB76D674B897
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8435b9cc-6b99-4492-a6b1-a972a59d9d5d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8435b9cc-6b99-4492-a6b1-a972a59d9d5d.tmp
Size 37KB
SHA256 a5171cb1064079758d50b4ffcfe0e424ce343764c465a9a812b6ba8d21eeb362
MD5 36bc1060f172460c3113bd5c34ee01fa
SHA1 e50f97d340b5ef3b857f8b1b1e3c128b9325cc49
SHA512 29c2e030d86e2aec37fad2a1c1307620050badcbe8205816b68d73758f606999c2ceebf9861585343632db870b1391118e1b715ca5c266a83047dc7f7904f100
SSDEEP 768:R/UxvxjgC+W3iOcc7fZrK5p5XSwQs88uBkiTCf/P84g:kZj3+W3iKtryILNB6Hg
TLSH
T11103D039EC946873ACB39385375A275BAFF06053C4C41BA849EE7A0E028B35D6307897
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 932f01682de6215b2c3b5faeb96a07b886e28db2ff6f8242a36da556c4292464
MD5 667b54168424526a7188593696f59ace
SHA1 deeb9f5ad1bccaabad57a386f08ba0c0740b2f81
SHA512 698f5a88d262c546b9bf21ead67e8dbe00ce6bd13f196761a5910f59ff69ca7532cacdf03c070f8d3b9f5d4fb8990b358e9b60ace9e48a0848e4a9da1d92b3ed
TLSH
T1D4D02B79F95ECD23E85204F540D1420832A77581DC04418125018C080A603850001182
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a0b193400a27c0cdf94ac11f5fb5b0747828b5b461169cefeffb96191b9e4834
MD5 edaab58c014c1abbfa900853b2ab2696
SHA1 e35eb02c0343d109af1ddd7dbd39dee3b989aea3
SHA512 b3cca7ed39fd4708b9c01cbefd67aab972f585372e01b5fa39d4a0840a7f579725d1202ab2916cda4e7635fb16dbc74178888461c7b6a2b3ea91d273ce2909ea
TLSH
T1BBD02B75F96ECC23E85204F940D24208329775818C0441812601CC080A603850000182
MD5 SHA1 SHA512 TLSH

Submit Download

51237794-d572-4824-8b2b-c288ffbdcc28.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\51237794-d572-4824-8b2b-c288ffbdcc28.tmp
Size 11KB
SHA256 4e16a8ff2cdf163f8e5e765f5f8bbea1b90fd068de2b53f02f61f56204f3db84
MD5 9b3886fb82a4def88ada22bfd4e4d4f5
SHA1 118bb72229ba369918656b70d44c3ab93e5ceb98
SHA512 2622375fdf18e8eae16240a6e5e58ba5f80ec0273f533b5a357ebb2156c3b1ff2ebfd9e6f65bfe5872a4ee3717b9c15e4dd48b0e2d3d48a55946913267ff6d9d
SSDEEP 192:sxRBR3be/fxsqHRwKzoA8p4c/g6+WNIYEGXTftGKIgDXJ:sxRBZe/fxsqYl/5IUN
TLSH
T11932A716AE28A93B8CCBD21DBB557F53D7FD1032A1901E48B6FC8A1C14EB6DD620741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6463c108-4277-41c7-a61e-92b95d792ce3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6463c108-4277-41c7-a61e-92b95d792ce3.tmp
Size 11KB
SHA256 b118c0082ccf85df4711bbc88b6a5732ea1c04deb6972396d8eef1ff71834d00
MD5 525a765cd28b46a7092bf6f870d8b1c2
SHA1 4612b7c9c0d0ce266754e37aad07e81b25eb8cbd
SHA512 4c382f5a7af96461074be186b2f8285c714f568f899d0f13c81c162d02849c72a714e8d08fd4a7e0d51dd900f1293805d5d6f45a9f643726740a3cc705c9d5ac
SSDEEP 192:sxRaR3be/fxs5HRwKzoA8p4c/g6+WNIYEGXTftGKIgIJ:sxRaZe/fxs5Yl/5IUs
TLSH
T121329616AE28A93B8CCBE25DBB657F53D7FD1032A1901E58B6FC861C14EB6DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 cd6da62441ba351880156efaabb0f82f6350648610063e04b80babb54328c7a5
MD5 8a79150414ab9fbc27c820c76081e863
SHA1 7511b55aa2acb181222e67530c50f5ab1bfa7f2f
SHA512 3af1b499e1cd58000ff2f6ccba12fc064c2f0375966039af3e1c98caf49d16b65e2b51c867ce2331cdab3f6ff0c0482967d769afb99a8124469e4eb31469d67c
TLSH
T1975121439762A074FBA509F360DD3B8F363A8572A44F1EC20594D4B87B4E7194D35C38
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 00cae53b6827a36337a3449671d56fe4c070faeed5b32883c92d157fa9c7778c
MD5 76ac96874b5b57f07b50692db6700577
SHA1 804c83fced80f7d672cb9bbe22edb237e89ddba1
SHA512 11fea50ea967d624ea88082588808a207e7e77a47c58439a55ef4376c244e6e9997c33cf6fe3981e9ba2fcc11d829b6017773f5b672208bfb5315a1094bf0601
TLSH
T139511F429762A074FBA909F360DD3B8F363A8572A44F1EC20594D4B87B4E7194925C38
MD5 SHA1 SHA512 TLSH

Submit Download

e8c7e834-7a44-49ff-ac16-955ac2270fe7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\e8c7e834-7a44-49ff-ac16-955ac2270fe7.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

44d5c618-cecc-4e8c-81d9-d3c7c9bd1059.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\44d5c618-cecc-4e8c-81d9-d3c7c9bd1059.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

6ac19bc6-239d-4f30-8eb1-8735bdc0a7cf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6ac19bc6-239d-4f30-8eb1-8735bdc0a7cf.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

c7430bbf-c189-4f3c-bc8f-a01340c5e75a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c7430bbf-c189-4f3c-bc8f-a01340c5e75a.tmp
Size 2KB
SHA256 64ff7fbf83413592649dc8135f968df2ead4fe1c46f4c26969fb5c7776fc9b8b
MD5 76d25b4618db08aa147955a5cbc77486
SHA1 9d500eb451007b9103fe05ca5482cca3d24a3b01
SHA512 5850051c19d8ec13ba037ccae0e5cf3dde39cbf384cdefb578a9b32f34f2e1c754303579f734752867f6161669b68345a7b8555c4f9e596d997082c5132bb8b3
TLSH
T16341CFF783F4867E8A0156F0AA196E2BCE1D0515832C7C5689E4AE2B93F34B1E14169F
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 9939b1378ead50814e4524b73084d410b2256d7b7739b2d52de96f6aa9641ed3
MD5 e3a1aaa06c31ce3f4ba9c97573199d9f
SHA1 67d7aff83f540ddc63665a7d6b4d57e90bae7558
SHA512 28838cd03ec044b532434a9532f8cfa4ebe78f6368fc31b6c866c7d996f7cd5c9316f7bbdd9f93a275757b21762f5f61633a11a8f857d715b8be3406f6ae9e3a
SSDEEP 384:USupCD0fCtg82FfrLKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVQc9hnRXMroJea:U/pCDmWg8KfrL8F1+UoAYDCx9Tuqh0Vm
TLSH
T199B2D92B640CCB7F4FC04A9EAC196FD77D9802CB9A588D4047FE995C02C77EA92194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

b0bf7b67-e057-401e-acc3-eb6741724cc6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b0bf7b67-e057-401e-acc3-eb6741724cc6.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c6c7b1fd-7229-426e-96eb-1445c8de46cb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c6c7b1fd-7229-426e-96eb-1445c8de46cb.tmp
Size 11KB
SHA256 a1f89e9b095c95aa2694150b9b79c04c6985c81d8ba66ad88c9c772bf9a81760
MD5 209057c3b3586e9727386b24beda749b
SHA1 134e096f77ebb0945d758c0230483ae66039404f
SHA512 907ed4eaa3ec93679280aee78a3f402041869717622b6f036a5913fc729187b5cf15bd0e22e6c710c31e931d2b37fb14af02a6824f32cc3e4c9cc376454cebb9
SSDEEP 192:sxRBR3be/fxsEMHRwKzoA8p4c/g6+WNIYE4hTftGKIgDpJ:sxRBZe/fxsEMYl/5ImX
TLSH
T19D329616A928A93B8CCBE21DBB557F53D3F95033A1901E48B6FC8A1C14E76DD520741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

979dc3c9-0787-46f2-aeb4-afec413893cd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\979dc3c9-0787-46f2-aeb4-afec413893cd.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

b547f313-d7f2-4e94-ba01-713cc95ee38c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b547f313-d7f2-4e94-ba01-713cc95ee38c.tmp
Size 36KB
SHA256 cffcfb5e3ce4c11a4d565cc0b331677758b28d6acc0653aa0a60dbf002f9f031
MD5 02b205b9114e55e72098e4db6395f8be
SHA1 fadeec9acfc1a207aafd18116264e6c6b664726c
SHA512 6232e5f2bdcff04a01c093538250bfddd3ee0e87d2697a38ed981cf118d8309d39deb5c46f3245d215f159a3f5e8a25916af0f979efdec926d74e6d812356c03
SSDEEP 768:nFdN3cwgpj1Nec7fZrKIHUXp5XSwQs88uBkiT2jxTfLe:3N3KNtrl0ZILNB+tK
TLSH
T105F2BF36AC94C977ADB79781BA5E3702AFF05157C8C006A4DACE691D02C739E234BC63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8501e1b6-1044-4eff-91be-417f10b0d3db.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8501e1b6-1044-4eff-91be-417f10b0d3db.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download