hxxp://costamarine[.]com[.]br

Resubmissions

30/07/2026, 03:11

260730-dp5lhsah998

27/07/2026, 09:38

260727-ll7wgazdlg3

27/07/2026, 07:23

260727-h77k2sbj5w8

Analysis

max time kernel
898s
max time network
896s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 03:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://costamarine.com.br
Sample260730-dp5lhsah99

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3804	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298547620293469"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{B7523BC1-DA99-41C6-ABDD-AF0EB4B2CA7C}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
388	msedge.exe
388	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 3844	4112	msedge.exe	85
PID 4112 wrote to memory of 3804	4112	msedge.exe	86
PID 4112 wrote to memory of 3796	4112	msedge.exe	87
PID 4112 wrote to memory of 3796	4112	msedge.exe	87
PID 4112 wrote to memory of 3868	4112	msedge.exe	88
PID 4112 wrote to memory of 3868	4112	msedge.exe	88
PID 4112 wrote to memory of 3868	4112	msedge.exe	88
PID 4112 wrote to memory of 3272	4112	msedge.exe	89
PID 4112 wrote to memory of 3272	4112	msedge.exe	89
PID 4112 wrote to memory of 3272	4112	msedge.exe	89
PID 4112 wrote to memory of 2396	4112	msedge.exe	90
PID 4112 wrote to memory of 2396	4112	msedge.exe	90
PID 4112 wrote to memory of 2396	4112	msedge.exe	90
PID 4112 wrote to memory of 372	4112	msedge.exe	92
PID 4112 wrote to memory of 372	4112	msedge.exe	92
PID 4112 wrote to memory of 372	4112	msedge.exe	92
PID 4112 wrote to memory of 1664	4112	msedge.exe	93
PID 4112 wrote to memory of 1664	4112	msedge.exe	93
PID 4112 wrote to memory of 1664	4112	msedge.exe	93
PID 4112 wrote to memory of 4104	4112	msedge.exe	97
PID 4112 wrote to memory of 868	4112	msedge.exe	98
PID 4112 wrote to memory of 4104	4112	msedge.exe	97
PID 4112 wrote to memory of 868	4112	msedge.exe	98
PID 4112 wrote to memory of 4052	4112	msedge.exe	100
PID 4112 wrote to memory of 1940	4112	msedge.exe	109
PID 4112 wrote to memory of 460	4112	msedge.exe	110
PID 4112 wrote to memory of 2124	4112	msedge.exe	111
PID 4112 wrote to memory of 3412	4112	msedge.exe	113
PID 4112 wrote to memory of 3412	4112	msedge.exe	113
PID 4112 wrote to memory of 388	4112	msedge.exe	114
PID 4112 wrote to memory of 3056	4112	msedge.exe	115
PID 4112 wrote to memory of 3056	4112	msedge.exe	115
PID 4112 wrote to memory of 4656	4112	msedge.exe	116
PID 4112 wrote to memory of 4656	4112	msedge.exe	116
PID 4112 wrote to memory of 4612	4112	msedge.exe	117
PID 4112 wrote to memory of 4612	4112	msedge.exe	117
PID 4112 wrote to memory of 1712	4112	msedge.exe	118
PID 4112 wrote to memory of 1712	4112	msedge.exe	118
PID 4112 wrote to memory of 3988	4112	msedge.exe	119
PID 4112 wrote to memory of 3988	4112	msedge.exe	119
PID 4112 wrote to memory of 2320	4112	msedge.exe	120
PID 4112 wrote to memory of 2320	4112	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://costamarine.com.br
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffa85a4c188,0x7ffa85a4c194,0x7ffa85a4c1a0
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,15401190668547057873,14371036452170174745,524288 --field-trial-handle=2360,i,9589770705935158291,7888229633453218047,262144 --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2376,i,6077730768623074314,14299723715689964712,524288 --field-trial-handle=2360,i,9589770705935158291,7888229633453218047,262144 --variations-seed-version --mojo-platform-channel-handle=3012 /prefetch:8
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,8628558726607840566,5469518520228577638,262144 --field-trial-handle=2360,i,9589770705935158291,7888229633453218047,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:2
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,386879946172155450,3690457462931666920,2097152 --field-trial-handle=2360,i,9589770705935158291,7888229633453218047,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,6427233628486349533,12967570028761402792,2097152 --field-trial-handle=2360,i,9589770705935158291,7888229633453218047,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,13635847902819608484,9745032094991182033,2097152 --field-trial-handle=2360,i,9589770705935158291,7888229633453218047,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,13462481460969730526,16688287428051110440,2097152 --field-trial-handle=2360,i,9589770705935158291,7888229633453218047,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:2
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,6778776260916860512,6768349037096604860,524288 --field-trial-handle=2360,i,9589770705935158291,7888229633453218047,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,17115521567542998509,1248172698782887951,524288 --field-trial-handle=2360,i,9589770705935158291,7888229633453218047,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,12084297654858175750,16344533585417479156,524288 --field-trial-handle=2360,i,9589770705935158291,7888229633453218047,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,12084297654858175750,16344533585417479156,524288 --field-trial-handle=2360,i,9589770705935158291,7888229633453218047,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,4656383145907731446,237278576837816985,524288 --field-trial-handle=2360,i,9589770705935158291,7888229633453218047,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:8
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,7061108542935848493,9856218336721986740,524288 --field-trial-handle=2360,i,9589770705935158291,7888229633453218047,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:8
  2⤵
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,10342795442208547951,14910233600670352920,524288 --field-trial-handle=2360,i,9589770705935158291,7888229633453218047,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:8
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,8517937348344252435,6420016690198831140,524288 --field-trial-handle=2360,i,9589770705935158291,7888229633453218047,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:8
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6164,i,17678199986719169369,7258625664934625637,262144 --field-trial-handle=2360,i,9589770705935158291,7888229633453218047,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,16093095645144450808,4342817620426689285,524288 --field-trial-handle=2360,i,9589770705935158291,7888229633453218047,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,16618728370649745941,17150033461383145727,524288 --field-trial-handle=2360,i,9589770705935158291,7888229633453218047,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,18296370420548279567,14246149242411997017,524288 --field-trial-handle=2360,i,9589770705935158291,7888229633453218047,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,802663129125551382,16283333184691451311,524288 --field-trial-handle=2360,i,9589770705935158291,7888229633453218047,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,2638618373177965284,6459411589760867430,524288 --field-trial-handle=2360,i,9589770705935158291,7888229633453218047,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,11738974301609518987,10332252071436483475,524288 --field-trial-handle=2360,i,9589770705935158291,7888229633453218047,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:2320

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
MD5 34d661b06bc0857903247c15b32b3124
SHA1 72b12aeb58848c0b8474acb525b5e3c41cf32367
SHA512 ff623932c1d85ab3c9cf10c993d26b94c5e1d9968c6a6f9a48925137edcf7379ba3bc8d216e7fc052000ec59dab883f4b498f2262f7941a46d3328c62092e788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T1E0B3A931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 c541295f18f8e4ef2fb32c986f525d2ed94be0b4108768c94f63a310d5184d4a
MD5 e888b387211f90c914024216e8c7fd56
SHA1 ef5f1c90a7bae0734f3c6fe35806790679e9c1f2
SHA512 e124b66756716dc948c3a6673859c6da96b9224749aac96dfb01b2d718072c7e06003eb0d0e6697c55ca6c8466cf23c48db1334de3f53181a5e363c1cb2ce10a
TLSH
T134E026E884CAC27EE348A4CB4274634C92B23A0BA3C8791A6700C9AC3002480E7865D8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 410136b55aa1022de7961318a295fe6b027dc26b31dc2d091917edb26991edb5
MD5 99656fea5b7236eaea7d8bffd52f9a8b
SHA1 c08b713d44a492e0fadc2a9d9f53c53fbb885631
SHA512 1eab56f6951a1f9d3197aad37343eff7199e84f0f3e3bb25e9b795031bd729e4f46dcf1f2ad3215cafaba8e8297481e472008fcfe19f39efaffd52e6715df09a
TLSH
T195E0DFACF280C1A49302D58A816A62AE45346005DECCC86E3207EEAC34040109B4C2C8
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 3162af488c283bbdb6565f4200727821b4e60ce0c47948b8d5b3655271a2625a
MD5 7b9f1e9c5ca7be7a0fd051116a616b72
SHA1 8a88b30a2e0c8a2c94e5512f0a5bb56573a6d8b9
SHA512 2c13705b178f640305a8b7685e6b6a7e49374c53b0713e7e54da2205c3c290a3f79ad3280c111728c5383ffc23941c73a23b34049e67b876aa1915e6e2992364
TLSH
T183C08058798C845DC280187FA726F400177155115817962705A1FCD031406A01F2D124
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f1725178aba6d938b22081abf3c573163c1a1429a5d464e80609d236d89a9dcf
MD5 6d0aeb55fc05574726efce070807b85b
SHA1 321e9792114fcf4a91ea56c31eab1e1ccc865d68
SHA512 bca27a302410cc6e117bc8c2776c5e25320347f574adf7fc141a59f66b13ad32d50012ee902e820204999ae8baf96c777a8754995b0c02bb7ab327a835dd6e67
TLSH
T10171B30402AE05B2F3A20F72E9D00651B47183792E771DE732F6E93CF91EF22412948A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4ebada8736b082c5a7d8b3ddbe71c058f6715fc7fa40b3f3e596f00ba64c117b
MD5 0914e864b7cf690e79bf2522536161a1
SHA1 408fb807b54e14b509cc811946cd8aa555358e45
SHA512 2dd1b25dcbd113d148d594c5aee8eca94ce2a8d04284017efd875f68769a0787c957bc0eac9584dfe99b5d0e4e7aa29b3044621374ad8190e5f8c246952eb1bb
TLSH
T1DC71D60502AE06B2FB620F72D9D11650B4B243786E2B1DD733F6E97CF91EF13542908A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58944c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58944c.TMP
Size 3KB
SHA256 190d342c84f7e5e632ef25b0dfd02442d266b07defca2c22c7f400dccdf9018d
MD5 c8786a50886aa31c9b4763e413e3a906
SHA1 6f94159fd9404828918798ea0ac148dd97fa2f36
SHA512 1d7e5637e6045c878f145e77ebec1158722ddf183c14a7c8e7d4b5bcd10809ffa8161cee96fe74a0770e7ad762f19b790e367eaffff450343dab604285d95e17
TLSH
T13F71C40402AE05B2F3A20F72E9D00650B47183792E775DE732F6E83DF91EF12412908A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 62a5ae5b4acbf5c4fdfb17a93dcd98c5de19830c51bc488adf3b6b374d7c8ea1
MD5 90ed8eec62f8377463347905dc5f8067
SHA1 3391f5cd3f6f74b58c5361eccd4de41d77c10242
SHA512 61a786565eeee793348f082083df3391db831c2679b27687fd0b477226ef940ce7782c87eb3986b24d33c68cb7ce367ae6e413aa7c24b08339e9446c094d0d69
TLSH
T1D121AAF3C3D4C26E881656F0AA28AE26DE1D091583283C19C4D8EF9F93E3075E20194F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c518416bfe9159f8355de409c1cd8aaca3bbe46368aef2a30ad7a507d32de5f2
MD5 3affba2b5b5a2b1a5ef39cd3aaed8c96
SHA1 6a41c569cf93c5f57f787d31c02f719b6eedb4ac
SHA512 aab202e2b90a9a52fb063d5f9c56a38778fe8ca637e45a8b41ef5153962f8437ec500e0cd02f3cc9d616d5d51867cd70bb6826e899b965735295768d93c97757
TLSH
T13D21EDF783E182AED90556F0A918AE27DE1C0415832C3C69C5D4FF9B93E3071E142A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 928B
SHA256 5881d0c44a4daa821e675ad406d348853a616cdd956dd0853e9a6ceca8101015
MD5 fa767ef3c0dc6a1d152680fbebad7290
SHA1 fab30070dcc0ee876db886b168ee21eea2e9e2ee
SHA512 28d4c951e15fe7e3969ceb455e1933482999aa9b19375bfb4d74f9214a71411549bff97a63db61d109dea2dfa22d2d502680ddb6ebf4ef53514dad752e116b52
TLSH
T14E117DF3C3D5856E891517F06A24AE27CE1D050583187D1989D4EF2B93E3075D10195B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c4978cf957b6e55920381eb733454bd3764a2087f50c6dd4b01bbcbfecce243d
MD5 8ca47a694156f6793d955f118203c171
SHA1 fb16a4378b5c39d52a55622522c7c126dc26e94c
SHA512 cb42436c54a91e5c37d74e822aa873b2a849d665c58b8f61121913168ffaa36094f9f8c2e79880915eeff0a4c9d054c604d0e9dafc6372b271317271313bbad3
TLSH
T1AC21ACF383D5C25EC80656F0AA28BE27DE1D091583287C59C5D8EF9B93E3071E242A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 92790e801b3eb471a9321ee444413213b5e4e1637a7fd1f5fb1a8155a90e0d7a
MD5 0504fbac35d63bff3fb69cc320122b02
SHA1 44a1755c8da8f78f47ec8231cbd961642e4fba19
SHA512 5ae9547d6ecadf275c18337dda8705935ce38784b1b55d91094ea9b364ccc736b727e8ca7303b8cfc2f311594ba07610c5828aee2fe4a363c003b4b71448bfee
SSDEEP 192:sxZCRcyM/jK1Ml8MkZ/fusprk9IdpJHlb6+WNGYLlWctIgrJ:sxZCSMZ/fusp4+JHSGo9
TLSH
T11742E7166B345977CCDBD209BA55BF53D6F90472E2901D84A9FCDA0C04E6AED230782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a37c1585f39a0caf56f6cec20cc104d6c6191259640ea6c18c0f0c976b6421ea
MD5 20fce1e9f450945c4b2a9b31277a29a0
SHA1 de182f2251b5e8352c434ee7caef050de8791372
SHA512 3d1e8b27a589fa4b8e3c8258538c78197800d8d5af0fef21be56ace259e68575f8a52327ea9d9efa169c8c0645cb93bc072ec999c7642b53e6160c9224c9528b
SSDEEP 192:sxZCRcyM/jK1Ml8UQZkZ/fusdrHnOuIdphIHlb6+WN9zg/YLfdJtIg5NJ:sxZCaqaZ/fusdTnO/mHSq/wZ
TLSH
T18252D6166B389977CCDBD219B951BF53E6F50462D2941E84AAFCDB0C00E6ADD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 fdcd17578e55ea2ca558bfd08763b3e92918f60c0eba5b0b90b3cd23d71d5a80
MD5 4ec7381d059064e9edb68fc771459472
SHA1 13c115325c79250c72411a84de154513146e4e94
SHA512 7ac7417a55132b025af56da4c7b58f6528259b905a25ed0698ddb184a435f165a5bda6ad57e5e03e16c816f78d6914fbc1dbb4bd16f9efb7830e5143cd11ca5a
SSDEEP 192:sxZCRcyM/jK1Ml8MkZ/fusdrHnOuIdphIHlb6+WN9zg/YLfdJtIg5NJ:sxZCaMZ/fusdTnO/mHSq/wZ
TLSH
T17152C6166B385977CCDBD209B945BF53E6F50462D2541E84AAFCDB0C01E6ADD230782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 51146de56357353099d7ca6920dbb9f59da4aec8fe2fc15b8288aab91d970a82
MD5 366272ccca98469b5d15364f01961873
SHA1 503a14aa7f41736cd50ea8b118927bf2924cd73d
SHA512 c0f1189865e03788d2013dd8a1fc20d99cbf18a651f3d600372840370b8be6046891cb1ec05752e2dbb3fae6cf951c5f0d1b03f797186d265ca762cb4ab7fa7b
SSDEEP 768:sKs6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNTrok1:sKs6pD1WvxzWju1jahILIsNgk1
TLSH
T191D2FA3B680CCB7E4F840E5CEC2A6F966DD801CBAB58895447FA844C03C77EA51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\903a2be3-ab32-4cfa-b622-4e95ccd6e856\index-dir\the-real-index
Size 1KB
SHA256 f70fcd0961f0c7ed385ad6617e5531df5feaec9bc42fc6cef056b8f489630d10
MD5 95ab57fc191d3d9cd697b80ba09509cc
SHA1 5149ffffcbf343e57b5db7eff9714db1b3291b33
SHA512 937d1270fda56a485adff17c2b36e1b539abb732b081bc531e43809d5d868a9786841a10a91b7318c98c3cd3072ca1f33a888d927cbb1ddaa8e1939fc48ff03a
TLSH
T11F31124D9EA089CFF8A081F61576F1A4737198DD5B15A3235C2C32327E2335A26575DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ddaa3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\903a2be3-ab32-4cfa-b622-4e95ccd6e856\index-dir\the-real-index~RFe5ddaa3.TMP
Size 1KB
SHA256 c83c5e2784dd35c8e0532281f3c955ccb01f1a1a101264a7e9ea2deb1e6e15f6
MD5 4e9d1a6c85b9fb38587b0b32b088e99f
SHA1 d142cadaa43c734b37ff43c55b6568bd7831fbab
SHA512 13da9d5ff664ed7d1c280c74284e8cc3caa0f97e1152a0ef166d9d8f5e98e9a025c2e8ca7098127a0003629963ffd30e4488e1c5c5155792f60dd6ddfe39a9cf
TLSH
T1F031254E4AD18D0FF894507B1D63B4F8733588404311B393A87C63399D21B8D1A5F0D9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 da9e141f17356a1f570500ee2d6a416c8acc00183bd4acb4556244553e07ef32
MD5 a182a8513622347f8d28a6b49f1a2f40
SHA1 37b7c7ac709922b4dcd69d9fa05d46b41d92d8bc
SHA512 1fa8b97b9313af0a8a200f6a3af6a0aacdb44caf9242dd7ebb9055023ffaa0aeb3df72438533e4b1770bdcf445bfc2a1fbe4b4008474e38602a6d19e86bc1387
TLSH
T1F5E0DFBB6EA76820EDABE3E7287194B50641382CC805BC4F686AA6C390B13567846C65
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 449222937016ea95b8d6cc28220e95647749d3752304f80b98f9d2e4fd1f96dc
MD5 da8c8a3d1a5521b194a9f8be280fe613
SHA1 3e98ba3ad0fcff3c1ce064dba379c5d3b8b7cb9f
SHA512 2ff6ef7a54929edb8743239fd3004268336b698fe11dbccd00901fc0067a922fd74c39a94752cd0352b9d4b28ee0aab505fc0439bc8463cda42a257a8decd4dd
SSDEEP 96:KUAAKtePOrqKgAXe12KeASBCBuC0UEC2MzxgyCKYngICcSabgo:iitMlh9H
TLSH
T171C10602B17702223D3E291CA39997664F42B6633819F42B37A904B55EA7F344DFC9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59480b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59480b.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 4b245423bd35098ce99c5a30c70acf3dc8236e590fb8173783c8e1dc8b02b91f
MD5 da620b1acd2994c9e306af268bb0aeb7
SHA1 d5902f2711263023b8530b3edc91201ee871f027
SHA512 71be346519a281572bf668870381117486d9c4547903838973831b103f1aefbb7d0ec607eed8a1554a67d62c32719f9d43066c56094daa012d10669bd9fa849d
SSDEEP 384:DZcIhsN01GNqGLVa9yO+TQ+2relbhlDzzwYiIWD:bh+4IOuQlrelTDzzJYD
TLSH
T193928D366D645C776AE2A201F94B3A034EF84173D7C9BE80A5D8EF0E01DB56C134BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0c5efeab77f54065f833e21482f6b21c5ddc7c437a342da0b4e2563b01c4db8e
MD5 b95f3439f098553860601862a3aafe82
SHA1 34284cf4d14ad748ae0f65ae7e3db532581ee451
SHA512 eeee0f19d69b12ae42174f35e4ee5e78712ca74f2c0d8f2da7fc5e547adfafa4fd451c6d28ac2e970638c0733cbba533698d359c970fe129d6f257755a3804ba
SSDEEP 192:qONT6O7+3hQmiUyEPExGttb0zO2bH3gGXxU6:qONT61R8xGt9yO+LhU6
TLSH
T19102F9356C686CB74BF2AE45FA872B175FA5103BE9962F80D6E85F0C00D766C2343C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1ab3ee571f7fa48e18194f7a839f62c8720e9ea3f320763fbe7a2462ca711fb0
MD5 e60457b4b74339f0f972ff7e227990aa
SHA1 e9009b531d1a05ee9d12a1910bb6d1a61cf65827
SHA512 daa3a2a629ea4722251d307e42c6735243e4dc543eded7816a9b9a42fa5a4c4720e38716ec06d6687eee9097cc5320ac81793c79d300f8b26da7c3188d3e9473
SSDEEP 192:pONF6O7+3JQmiUyE0Exnttb0zO2bHTQ+2NcNDqk4U6:pONF6FRrxnt9yO+TQ+2qeU6
TLSH
T174121836A8689C771EE3A540F98736175EB9012BEAC67F80D5DC6F0C01DFA6C234AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 11b5533e06a1acc01d686baa11e4dd73578484cd846c0daf90e51034865b7bb1
MD5 b3211e6210595cf75fe74b2588e89c3e
SHA1 76341f2ce8884b6e83ea36addf59acda073b301b
SHA512 9bf5916eca5bc2015389925b09b282f431c2e85e56f4a56f9a4e5af9e0dd4e1d1ca47c93874d13e458f80b32d94bf873facc2881c4d5eb7f6bb0bffc24398f6d
SSDEEP 384:6iFiZcIizsN88TUNTUlIlQGNqeLVa9yO+TQ+2GelbhlDzzwYiIWD:xFQqxwgT4IOuQlGelTDzzJYD
TLSH
T1EDC209F659D78876EAAD5703AB7E2D034EBCC163F685A940B3D89A0DCC8617FD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 15ef961ddee3ae212b662f303d924b72d22a21a384c39f700b9b33552bf91586
MD5 5b3de8971923ba91828e9441f3d2dc94
SHA1 dd98c08d9dd2127c0c750b98944c315983df5f20
SHA512 20f682629039c34ac43bd60484b9250e440836d5cad0010df690d02c2f41afc81a54061367d86632450c8096fc62e4d091bf9b8c356d5b482c129bfbd9e37499
SSDEEP 384:pZcIhsN0QGNqGLVa9yO+TQ+2relbhlDzzwYiIWD:hhh4IOuQlrelTDzzJYD
TLSH
T114928D366D645C776AE2A201F9473A035EF84173D7C9BE80A5E8EF0E01DB56C134BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

04f8700b-87a2-494f-9482-dffabb881b66.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\04f8700b-87a2-494f-9482-dffabb881b66.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 59f7f2add6b399584079b9e0ec2a0840b34b15e01743ef78b374fe1bb5636949
MD5 5bfdb5fa850d33af582068dd254ba11a
SHA1 0e9e68755e7f7c52501fa4944118648a9ac9db23
SHA512 4fd70087f080a46af8ae448458a0cc91eb81ca379f06a3cd4fb3129b2c4c0ca3dd8879fd979317dbc5de16a57d60a47aa9ee9297e6e6167d30f46dc2a1ffcff7
TLSH
T104412858B6EA1108B3B36F5A9BF7A86E487E7D372E06D45E00010E4F4663B40C872B33
MD5 SHA1 SHA512 TLSH

Submit Download