hxxp://costamarine[.]com[.]br

Resubmissions

22/07/2026, 07:33

260722-jdkpvs1dlf3

05/06/2026, 18:36

260605-w86a9sdx9l6

Analysis

max time kernel
899s
max time network
733s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/07/2026, 07:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://costamarine.com.br
Sample260722-jdkpvs1dlf

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2672	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134291792137552669"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{6BC69D36-DA6A-4C75-918E-57C249CA61B5}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3264	msedge.exe
3264	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 4116	952	msedge.exe	85
PID 952 wrote to memory of 2672	952	msedge.exe	86
PID 952 wrote to memory of 3232	952	msedge.exe	87
PID 952 wrote to memory of 3232	952	msedge.exe	87
PID 952 wrote to memory of 3232	952	msedge.exe	87
PID 952 wrote to memory of 4532	952	msedge.exe	88
PID 952 wrote to memory of 4532	952	msedge.exe	88
PID 952 wrote to memory of 2104	952	msedge.exe	90
PID 952 wrote to memory of 2104	952	msedge.exe	90
PID 952 wrote to memory of 2104	952	msedge.exe	90
PID 952 wrote to memory of 2952	952	msedge.exe	91
PID 952 wrote to memory of 2952	952	msedge.exe	91
PID 952 wrote to memory of 2952	952	msedge.exe	91
PID 952 wrote to memory of 3852	952	msedge.exe	92
PID 952 wrote to memory of 3852	952	msedge.exe	92
PID 952 wrote to memory of 4268	952	msedge.exe	93
PID 952 wrote to memory of 3852	952	msedge.exe	92
PID 952 wrote to memory of 4268	952	msedge.exe	93
PID 952 wrote to memory of 4268	952	msedge.exe	93
PID 952 wrote to memory of 5036	952	msedge.exe	97
PID 952 wrote to memory of 5036	952	msedge.exe	97
PID 952 wrote to memory of 4564	952	msedge.exe	98
PID 952 wrote to memory of 4564	952	msedge.exe	98
PID 952 wrote to memory of 3996	952	msedge.exe	100
PID 952 wrote to memory of 4816	952	msedge.exe	105
PID 952 wrote to memory of 1016	952	msedge.exe	106
PID 952 wrote to memory of 1804	952	msedge.exe	107
PID 952 wrote to memory of 1304	952	msedge.exe	115
PID 952 wrote to memory of 1304	952	msedge.exe	115
PID 952 wrote to memory of 3264	952	msedge.exe	117
PID 952 wrote to memory of 4552	952	msedge.exe	118
PID 952 wrote to memory of 4552	952	msedge.exe	118
PID 952 wrote to memory of 4428	952	msedge.exe	119
PID 952 wrote to memory of 4428	952	msedge.exe	119
PID 952 wrote to memory of 2448	952	msedge.exe	120
PID 952 wrote to memory of 2448	952	msedge.exe	120
PID 952 wrote to memory of 2156	952	msedge.exe	121
PID 952 wrote to memory of 2156	952	msedge.exe	121
PID 952 wrote to memory of 3920	952	msedge.exe	122
PID 952 wrote to memory of 3920	952	msedge.exe	122
PID 952 wrote to memory of 4892	952	msedge.exe	123
PID 952 wrote to memory of 4892	952	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://costamarine.com.br
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffbd8d7c188,0x7ffbd8d7c194,0x7ffbd8d7c1a0
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,700958245936333263,654676949979734937,524288 --field-trial-handle=2280,i,15409810514891767077,13241751292710672000,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,2219917760834142006,1879796738796934403,262144 --field-trial-handle=2280,i,15409810514891767077,13241751292710672000,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2632,i,14422945526006860275,4280888128332066216,524288 --field-trial-handle=2280,i,15409810514891767077,13241751292710672000,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,17174095401737098318,5479472510807506737,2097152 --field-trial-handle=2280,i,15409810514891767077,13241751292710672000,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,775796623109715640,2087613397171667391,2097152 --field-trial-handle=2280,i,15409810514891767077,13241751292710672000,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,17416461247686408997,16312321451588728307,2097152 --field-trial-handle=2280,i,15409810514891767077,13241751292710672000,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,12294220203090343809,10779890157686116678,2097152 --field-trial-handle=2280,i,15409810514891767077,13241751292710672000,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:2
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,10053751967165177622,7529151818938620960,524288 --field-trial-handle=2280,i,15409810514891767077,13241751292710672000,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,15996854736577294881,1279542481972651774,524288 --field-trial-handle=2280,i,15409810514891767077,13241751292710672000,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,3441680273998126660,17204959466775300997,524288 --field-trial-handle=2280,i,15409810514891767077,13241751292710672000,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,3441680273998126660,17204959466775300997,524288 --field-trial-handle=2280,i,15409810514891767077,13241751292710672000,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,1256834664914801572,16906451021889053630,524288 --field-trial-handle=2280,i,15409810514891767077,13241751292710672000,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:8
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,6512751797412515099,2062595843608834709,524288 --field-trial-handle=2280,i,15409810514891767077,13241751292710672000,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:8
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,12700997357997700467,17663401687248441415,524288 --field-trial-handle=2280,i,15409810514891767077,13241751292710672000,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:8
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,13657156719651802942,16757719449350290316,524288 --field-trial-handle=2280,i,15409810514891767077,13241751292710672000,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5748,i,15345347366146439645,5347981192253496815,262144 --field-trial-handle=2280,i,15409810514891767077,13241751292710672000,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,13071365273343713257,11741051465825914515,524288 --field-trial-handle=2280,i,15409810514891767077,13241751292710672000,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4244,i,972152056902200616,16610705991228858128,524288 --field-trial-handle=2280,i,15409810514891767077,13241751292710672000,262144 --variations-seed-version --mojo-platform-channel-handle=1532 /prefetch:8
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,15569750768397101575,18551869566837278,524288 --field-trial-handle=2280,i,15409810514891767077,13241751292710672000,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,1308303265650288820,17121005401272227688,524288 --field-trial-handle=2280,i,15409810514891767077,13241751292710672000,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,1934631837817017064,5968649625758504301,524288 --field-trial-handle=2280,i,15409810514891767077,13241751292710672000,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,13844747116898481920,16429456428291076114,524288 --field-trial-handle=2280,i,15409810514891767077,13241751292710672000,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:8
  2⤵
  PID:4892

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

1ddb51a8-6354-4466-bd1e-fdb05884de51.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1ddb51a8-6354-4466-bd1e-fdb05884de51.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 87eba684604288e7d1967fba4d7ea65e7eca4136680ba88a1ade04d56cc04590
MD5 d61c1a140a780954c97d0b57cc7f1470
SHA1 66211afa3e738977afed960de844f750232acaa2
SHA512 83e60c9ea4bc8acb17f5cc915a495e4cdbcc03eaca11bd98f9c02fc0ba9f52fa34444d030bc0a94d31f31db1ccaf1205416c3d209f56173e769ea884d8c9571f
TLSH
T1FCE020B44CCDC35DA11064C765F6734C81C5370BE3CCFA1A2708845A74026C4F792954
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 d0307a5de501aaae72edb236bd077abb7106dc65df72fa3febe2b8f530008f2f
MD5 be8b59beb7bcf70e41fc22f394304e5f
SHA1 0d5edb56a6a167a9eff2aab7737475bbfb5e634a
SHA512 36b923622cdd1fd7cd9b8e3cf1a2033bb92da79761cd6c26f73dfe3042c123eeedcd70a2fc46ffb39e6a8c6061dcc13141f705a0fde35b1226ffed9848798301
TLSH
T12FE026A895CCC23EA202644B4368575C8286370BD3CCB94A6728CCC87801464B3F3690
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 328B
SHA256 0ce07fed7a3a7c1c0e3c16ec04bfd0e93c535033ca9c00f2009b6ba9755a1f6c
MD5 1f35934feac89939b15c7069cbe4048f
SHA1 d96efc0ad36be2b3e25d2fb41c2e40f5e68305ab
SHA512 cb4213a9ced11b1bdee41725dc761438a5700c144ed5becef605496f0bd3d4ab3a6f46daaae6b93ec224f969841383ea0bfbab0065334603ef27c8389a117e49
TLSH
T19CE026A406C8C23EF204E44B4268970C8386370BD2CCBE1B670C8CCC7402480F3B3690
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 04df52e96007314f52bc84f52c56c8df541852f3d90d061897c719e48ac0f843
MD5 a449570934b441933fbcd310b9fbb328
SHA1 c02fdbe81099d01d60dae72e63bcc2ca437c33d7
SHA512 91cc32d2448456b332ffb9dc8771ebf6e9b6873ff1614a1f4c90865e2eb567218c5d669513bd9821d53a18ea74f1401600ca64abcec22142bf3e874869b26851
TLSH
T12E51DBF002A21B49DF311AB190E11B41B67583EDF5237E194652A9BD3A3EF63852207D
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 22b2522c6d1c2be62203c1d9a263ceed7c80386810795c316314a3a25854b0d4
MD5 c8f6db29beb5320e65c3adec551040ff
SHA1 968d89bd905674c576c28a1211293c2b240899fb
SHA512 d1a7cc90d7d644b27d459af6c56856f288df34dce8e6d70dc0882734dec68ee4f2418cb729f73ccbcf233e8bc944cc46549c201641f6807907847a6ada5c2289
TLSH
T15B2189B3C3D5C26D890556F0AA28BE27DE1D091583287C59C5D8EF9B93E3471E20154F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 99469ca0295cb49d3e313bdaa6b65211b512d4cd8da1b00f278c34dc73c601c3
MD5 051f2e95d82b1c1b879ffda7aee625f3
SHA1 bf8222f3affbbcacba7769a945d8c58fbe068b96
SHA512 46a0dd8cdf63b30b4807903afffc7bb8a8efb0fdd5a75a0d1b3b96897fbc9cf01682e944bac6b8904043d881796601a952b5a8f51d91da836dc013bd6b1c7a31
TLSH
T18221ABF783E182AED91196F0AA18BE27DE1C0515832C7C6985D4FF9B93F3071E142A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 dbc4a79b6952b95dce92a23be56c17fc42bea151e6d78da122d59d1cab2d9793
MD5 ac21e005f78fdfa6d12e35c8e7563860
SHA1 36dc228cfdcaf11246e0d9404da4476ea77f825b
SHA512 6e1f90409d1d90db18a662c9d652b4ce94a134732151b7206cefd67d6fac5e6070db53287bc0252fb0dd858d8d090b542a97817082a4a9ed74c3702da192f53a
SSDEEP 192:sxZgRokR/fZsr+aOWfIdpr2Hlk6+WN91Z/Y9ItUcqIgrJ:sxZgxR/fZsr+aOTKHPB/y9
TLSH
T18222C8566E38A97B5CCBE20AFA55BF53E2F54072A1941E48E6FC860C04E7ADD230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 61227e6407981ea4b91273b2da52ca20c8c31fec570adbc3be524235980b0c4c
MD5 f7b4605cdd6867bb999d50738c16e76a
SHA1 4ba1226d8b37ebf1e1b0e557a23d379d231f342b
SHA512 53cc3a04b7ac798b0117ed10d969644aa3882fded327b2a30e10da5118efb1f5efcad47dcf7d874d13258841ba91682165bd3d5683d6e8f26d8f86347640fbfd
SSDEEP 192:sxZgRokR/fZsv+aOWfIdpr2Hlk6+WN91Z/Y9ItUcqIg5TJ:sxZgxR/fZsv+aOTKHPB/yD
TLSH
T13332C85A6E78997B5CCBE21AFA55BF53E2F5407191941E48E6FC860C08E7ACD330740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 4da58fafbcdc80dea75c4563999b13aeb70e8e2bb3dde05120fc08455cb2c520
MD5 60e999d69cb4eedb927d0712859dbee0
SHA1 78cc0254d449fec5c0ae378a52a03d41be59af64
SHA512 c340005616438d7b75920433b46540fcccd38d78d441e4c844a195b005b636bde876ddcc363b6d0f4ddd46497c7f318046c338899a7ce3c0048aab7eedc6dba5
SSDEEP 192:sxZgRokR/fZsveaOWfIdpr2Hlk6+WN91Z/Y9ISwcqIg5hJ:sxZgxR/fZsveaOTKHPB/B1
TLSH
T1F632B75A6E78997B5CCBE20AFA55BF13E2F5407291951E48E6FC870C05E7ACD230740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 25KB
SHA256 38d2b96ae5bfb70f668a906b9d76dd40479f47bb334804db3a413d7a61036f4f
MD5 1f3c5a3821c01a9d8cc36742abe720fc
SHA1 6d9475f437daecfcefabe469b8547ab3552ef061
SHA512 cb23dfe124c10206868f4f2acce0186ce566215da9743bbf72fd47d417b7097959ad9e2d2e012238fd6043c5908f052578046c4120ab068a0bb17d74bf20111b
SSDEEP 384:sxZgxR/fZsvA66s8qMpRiYnazAW8pZS15posJWeT+SaOToHPB/E1:sIxR/f6A4Mnc7WeT+SaOcHP14
TLSH
T1B7C21909A924C8779EC36D19653C7E3399EC406262C5CEDE56FCCA0C019E1FDAB4B457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 7c33917d577502f6071ce8c56177e03b489f7b4547800824af85d11a882e9fd1
MD5 80e36178812e6d38335dd5df4ef958b6
SHA1 a33533128cdf94c8e3074dc35e4da482efe653dd
SHA512 362f853440595198d0a3ad88c8830b00c427249affcf22d6f3f04a05eacebcc1811ca55bf38c85e3d4e5c6123a161feae3236e61f16355e83dc3c7eff56a8453
SSDEEP 768:P5yvIZwWvu+Q+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDFLlwmW7kro+bqL:P5yvIZwWvu+Q+u1jamFLeR7v+u
TLSH
T104C2E92F240CCB7E5F801A9DDD5A6F9B3EA802CB57588D4047FE994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6539c260-5404-4f2d-80ed-ee2bdb57a400\index-dir\the-real-index
Size 360B
SHA256 d04e5674eb85fe9481137d3f2913f2cabc95f3bb395237400d33bc027d8e56b9
MD5 3fdd052ede2173c323b532e18187e163
SHA1 ba3e3a570fb257280c96595f0b37865191ebc8e6
SHA512 32e9299f78e9aa1686804e679c4c4924e4a61bc73a950317a392dae07bc3f0ccd6e28147f15be50493484b245b32e677fd99d66e4035201b360710572382baac
TLSH
T15EE02B14AE810936D564073628B649A573B14DFCA528D507543D457A2C5529C651A2DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cf729.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6539c260-5404-4f2d-80ed-ee2bdb57a400\index-dir\the-real-index~RFe5cf729.TMP
Size 360B
SHA256 41b7b1434cd58b76c194aeded60a35f9f8cd38bb4fdfbea1621888b902e56870
MD5 5295688445d26e073820ace9eeb7f013
SHA1 7568c74ef38e9d5eada74f305872ac19a031f6c6
SHA512 51dfbc664f2d09b8b0f924a3e9ebffbdfcf9f8a07e55134e6562feba1e344c2227ebad8a1926677ee8f4499a08a4fb7ea9aada91d45d63c7ec7a81d8bc5eda07
TLSH
T115E095C5C7824E21E5540537281748DDF27544B0A514F603393C543D3C25ACC5F470CC
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 abb3090552177dabff697aeee62f5ef4595c13d5ab3c7dc8060148d72420b9ad
MD5 7683091353177029ab9dcf13b5951bb5
SHA1 b25674783d5a1b7df7f042194490205a7cf28dab
SHA512 5867cddee88bd9936cf5730948ae46928a1550c2fd2638f6b0fc4bd4231c6546cf203021f0c76710e6c26d586c9dd1d66a9a9c198f0b1da37630b35547d61ccd
TLSH
T119E0D8BA2EE71D20FD5FE3D9293144E900157C888D48FD4E642A6A8B64F02502426C73
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 66f5fb593229f527472ca2c02eb4443674d360a6b43fe13c93647d4ccb8e9d33
MD5 195a739d806e099840bc75431657d8bc
SHA1 872bca20cf64152337b8666eace8f748734ae49b
SHA512 36e4360dcb998302a44fe9a2ac09b65a208be1342ead36a4d4f6ac499fbecf0cf2cea949ffdd05dbbf3fc48bbcba2bba249729f209f4eb7915fbccf2b457e218
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDaAYKhy+iVoZFf7Xkn76P59kKBB53ktlFaV:mTXjiVoZFf7Xe76B9hB53ulFafyU
TLSH
T1C6B14552B13A029239BF681DA3A299768E8231637514F97F7FB805618F27E111DFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5939a4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5939a4.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 8e435180058170cc8b07c04f8c59fe4c9e313fb865ffe58063e468bfcab6c5a9
MD5 855cf3f658155e792176cf26e1e65f51
SHA1 36bb95a6ae608961b703dd0118c20d9599ec141a
SHA512 ba1b397d3603661d8a8c10ae69d8f7d66651f8fccbefd455791d59716d064290650f95c499210655487aa3a660bced9d50d4394a2298cc1e7d8665175df91477
SSDEEP 192:u2LsNMUXQuIt9+YLeRQQmiU1ruj24e+CGp+Fdes9omOQNDJiCq/HQeVyn:PsNMUX+9ziKgZe+CndHeReU/HW
TLSH
T176425B3AA8385C6B5BE7A246F44736135FB451A7D6C53F84E5ECAF0C02DB6EC1306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 3cf4a3e156078bc1caed78e6f220e45f4b3a53a8db08807f8c55c00a7f0a2b5e
MD5 f5606e711c075c9164c278e9590f5986
SHA1 6635f366bb4870630081b3fb5d8418ee0829ae35
SHA512 9f0f0131b6b2d250042e56806bee5d8d53cd002dfa8fcdafbb0b489a0e82a68a2c205749382631f705b8b7d25cbd63c0bfd077b1251a630e535a591db2efeb66
SSDEEP 384:XtNn/s3n9SfsNMX+9ziKgZe+CndHeReU/HScjmwlzu:Xj+9UCNAgfE7v1jhq
TLSH
T169928E376C355D6B9ED69146F84B36178FB851B3C6C12F84D5ECAF0D01DB6AC0312926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 ee7839f8220c1abaccfcc22274e0d6b61a9b2dca9e613349c9ac46101e9a7682
MD5 60ad43e18bfb85d9c9771211ecdf15a7
SHA1 9efd2070a5b6ee5ce519217536f5673f2d96fab2
SHA512 1688265ae80dba1b6c77f99537e38d7a2e84f7e0d79a2cca8d28a404c0cfbc3f0d9a66c6b88160844c5037dc429c91b2cf6917d28efe9ec5e6d0775ca128eb5d
SSDEEP 384:wiF1tNn/s3n9SYzsNE8TUNTUlIl++9ziKIZe+CndHeRev/HScjmwlzu:LF1j+9nNwgDNogfESv1jhq
TLSH
T107C229F758D7493ADA9E5747F77E2E028EBCC1A3B5812A40B7985A0CCD861BFC306911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 fe88511a7cd4b93f41fc040103465e4938503b620ccd8d9d8b0c0a41514c8d36
MD5 b4710842ddbe9685899a6ce51cface91
SHA1 f63cfb816c715ca38ca3d1981532a06d02584218
SHA512 8ca421f687075bbe33a2d194be6701d3eba1fb0b9e78b7ab101e72a265c0ee40e7c2447e8ce0fcb86855e654a266c6bda0c4c77fd1fdbd99034c84a5f13be563
SSDEEP 384:ZtNn/s3n9SfsNM++9ziKgZe+CndHeReU/HScjmwlzu:Zj+9UtNAgfE7v1jhq
TLSH
T11B929E376C345D6B9ED6A146F44B36078FB851B3C6C12F84D5ECAF0D01DB6AC0312926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 33830ab5b882dd2da8ede1672f59205e646de0831c3fe5fefcd2f6b6912d4266
MD5 44805e7309162d2835cb535343b8b26c
SHA1 527acb9c87c89eb3c6183a6df8754d0045d4a48f
SHA512 0219298be763b481856b4be380d11bc4bb1f7e56ed89b169f773ec5cb9802d18419cd0485a0a222aec8c49c3a1b3489251c5c58efdb467204b8cf8c158846fbf
SSDEEP 192:LONd6v+YL2QmiUy/u/bh+CGp+Fdes9omOQNqCHCq/HU6:LONd6vzGzbh+CndHeReT/HU6
TLSH
T13D123C36AC785C6B5FE2A941F48735135EA85277DA863F80E5EC6F0C02DF6AC1346416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2b44fb5f597dd8ae004f054070305c1d9adbc071bdee641c40bd0e358616199b
MD5 f05fd59fd02db2a91789577b96548e03
SHA1 4a5f92615921d118ae8981ecc97bde57f14e6732
SHA512 1c8c2019972d7d9bdcad38b7f3eebb58b9ff783befc25d957c4eb87bb8c3f98b1826b7b9d6f2b6bc066925b675e11b8740782fd1f38f833d6701a9d62f087a75
SSDEEP 192:JONii6v+YLNQmiUyfu/Zh+CGp+Fdes9odusBPU6:JONii6vz/xZh+CndHe9FU6
TLSH
T12102EA356D382C6B9FF2AE45F5873A135FA81177E5963F84D9E81F0C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1e72d275-28e6-492f-bf13-a1c631e1ca3e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1e72d275-28e6-492f-bf13-a1c631e1ca3e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 16f306473ede17b2ea535f48c9f8cb467fe206a0e69286edc552e02201ada2c3
MD5 02e24fba598ed66f25dc2a32ac492b42
SHA1 1f16c2bc4616771f3164d109165d2fc270fc5406
SHA512 f78584e9c1122178b6b4838714e6df9d23030e43b1e44c16cbb1b25304a5ed4530b92665d4d69d642047b0875f4f4bb2bd8fa69856a1482acf3be6c007a295ac
TLSH
T1C741F898A6FA1148B3777F5AABF6A8AD447F79372E0A959D10110E4E0632B00D871737
MD5 SHA1 SHA512 TLSH

Submit Download