hxxp://costamarine[.]com[.]br

Resubmissions

30/07/2026, 03:11

260730-dp5lhsah998

27/07/2026, 09:38

260727-ll7wgazdlg3

27/07/2026, 07:23

260727-h77k2sbj5w8

Analysis

max time kernel
898s
max time network
892s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
30/07/2026, 03:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://costamarine.com.br
Sample260730-dp5lhsah99

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3740	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298547606168801"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1108628292-2849104889-3743975892-1000\{DB61370C-0EC5-4BE7-A359-AFA1D292E2DD}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
664	msedge.exe
664	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 4708	904	msedge.exe	84
PID 904 wrote to memory of 3584	904	msedge.exe	85
PID 904 wrote to memory of 3740	904	msedge.exe	86
PID 904 wrote to memory of 3584	904	msedge.exe	85
PID 904 wrote to memory of 3584	904	msedge.exe	85
PID 904 wrote to memory of 4036	904	msedge.exe	87
PID 904 wrote to memory of 4036	904	msedge.exe	87
PID 904 wrote to memory of 3696	904	msedge.exe	88
PID 904 wrote to memory of 3432	904	msedge.exe	89
PID 904 wrote to memory of 3696	904	msedge.exe	88
PID 904 wrote to memory of 3696	904	msedge.exe	88
PID 904 wrote to memory of 3432	904	msedge.exe	89
PID 904 wrote to memory of 3432	904	msedge.exe	89
PID 904 wrote to memory of 2456	904	msedge.exe	91
PID 904 wrote to memory of 4616	904	msedge.exe	92
PID 904 wrote to memory of 2456	904	msedge.exe	91
PID 904 wrote to memory of 2456	904	msedge.exe	91
PID 904 wrote to memory of 4616	904	msedge.exe	92
PID 904 wrote to memory of 4616	904	msedge.exe	92
PID 904 wrote to memory of 4896	904	msedge.exe	97
PID 904 wrote to memory of 4896	904	msedge.exe	97
PID 904 wrote to memory of 1872	904	msedge.exe	98
PID 904 wrote to memory of 1872	904	msedge.exe	98
PID 904 wrote to memory of 3192	904	msedge.exe	100
PID 904 wrote to memory of 4064	904	msedge.exe	109
PID 904 wrote to memory of 3604	904	msedge.exe	110
PID 904 wrote to memory of 3908	904	msedge.exe	111
PID 904 wrote to memory of 4900	904	msedge.exe	112
PID 904 wrote to memory of 4900	904	msedge.exe	112
PID 904 wrote to memory of 664	904	msedge.exe	113
PID 904 wrote to memory of 1840	904	msedge.exe	114
PID 904 wrote to memory of 4540	904	msedge.exe	115
PID 904 wrote to memory of 1840	904	msedge.exe	114
PID 904 wrote to memory of 4540	904	msedge.exe	115
PID 904 wrote to memory of 3500	904	msedge.exe	116
PID 904 wrote to memory of 3500	904	msedge.exe	116
PID 904 wrote to memory of 4796	904	msedge.exe	117
PID 904 wrote to memory of 4796	904	msedge.exe	117
PID 904 wrote to memory of 212	904	msedge.exe	118
PID 904 wrote to memory of 212	904	msedge.exe	118
PID 904 wrote to memory of 1320	904	msedge.exe	119
PID 904 wrote to memory of 1320	904	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://costamarine.com.br
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ff816b5c188,0x7ff816b5c194,0x7ff816b5c1a0
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1772,i,201775903982532363,5674426880486462834,262144 --field-trial-handle=2284,i,7795473961259231966,5897530597684408670,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2032,i,2879327785628665755,4681525275159127152,524288 --field-trial-handle=2284,i,7795473961259231966,5897530597684408670,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,17548070606292614737,14212523970877946416,524288 --field-trial-handle=2284,i,7795473961259231966,5897530597684408670,262144 --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:8
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,3563379486736132030,16431052129937340320,2097152 --field-trial-handle=2284,i,7795473961259231966,5897530597684408670,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,10249700996083783551,3808268461687066413,2097152 --field-trial-handle=2284,i,7795473961259231966,5897530597684408670,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,3585045665587820388,10533384524015225053,2097152 --field-trial-handle=2284,i,7795473961259231966,5897530597684408670,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,10054835730668192379,9121967168081688027,2097152 --field-trial-handle=2284,i,7795473961259231966,5897530597684408670,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:2
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,2038148701461217570,3452084071910666390,524288 --field-trial-handle=2284,i,7795473961259231966,5897530597684408670,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,625443791074101152,12720160313645221893,524288 --field-trial-handle=2284,i,7795473961259231966,5897530597684408670,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,3551910877558275869,10476209014732404055,524288 --field-trial-handle=2284,i,7795473961259231966,5897530597684408670,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,3551910877558275869,10476209014732404055,524288 --field-trial-handle=2284,i,7795473961259231966,5897530597684408670,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4248,i,16726589638295723943,12995683056604611453,524288 --field-trial-handle=2284,i,7795473961259231966,5897530597684408670,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:8
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4608,i,12524803601093290579,615067515472423294,524288 --field-trial-handle=2284,i,7795473961259231966,5897530597684408670,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:8
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4648,i,13270279751892202095,11752816374128996941,524288 --field-trial-handle=2284,i,7795473961259231966,5897530597684408670,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,7551040615158433729,1592707840718231254,524288 --field-trial-handle=2284,i,7795473961259231966,5897530597684408670,262144 --variations-seed-version --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3252,i,3368785073529412251,17644739051410293923,262144 --field-trial-handle=2284,i,7795473961259231966,5897530597684408670,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,15012440745692619341,4432130744192939874,524288 --field-trial-handle=2284,i,7795473961259231966,5897530597684408670,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,2550008636724282874,11261054565903840840,524288 --field-trial-handle=2284,i,7795473961259231966,5897530597684408670,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4000,i,13915911985603960902,12208205962162092036,524288 --field-trial-handle=2284,i,7795473961259231966,5897530597684408670,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:8
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,14756161812881780416,2726927881323736182,524288 --field-trial-handle=2284,i,7795473961259231966,5897530597684408670,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,4621041018431289050,12533480774631224119,524288 --field-trial-handle=2284,i,7795473961259231966,5897530597684408670,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:8
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1556,i,13050231943956045523,6336466496431838672,524288 --field-trial-handle=2284,i,7795473961259231966,5897530597684408670,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:1320

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67c3d537374abf4a4065bd49eb5e79e4d5afe358a5731186278c6aee60766d9d
MD5 4e493aa418041fca5fa30fcbfdf660dd
SHA1 ea939d51c02b7420c2eb0e8a20246e28cd7e7c4b
SHA512 25c896cd04f1a8a5daf896cad6530f5a015265fc30399b7facf3a6fc2016b03aaf4a88ce889166d73a86b0b17a17d7512d0edca0d80e9707d3e081708a5000ce
TLSH
T18CD09B20768D5043C59133B398455F45165D596815569141A434514CDAA5044E36654A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5ff05a621df8df05426fbba3639de62cbb6d573187a90f20bc797fdbe4b71bf
MD5 c23168c2b4dd096d77fb57bb53393a90
SHA1 0038662e136abcde2c29c9d3d3c3bf2dbb11d164
SHA512 7ee97c45aa94467885b8aa2145e0879de4ec2397c36198ceede5ec06664080ad500e1a9d62566de09c10902658158cd7d9f529ec85a76fea0c32eb7ae7182b5f
TLSH
T1E0D09B2036CD5443C59133B398455F45165D59681556D242A434514CDAA6044E36654A
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 ea16ef605f4131e12d9ff7f8405e165f88231635923dc3fc6fbb88d9518abed7
MD5 84c0e00693717175911a535fa4ab3650
SHA1 397eba9fc698d3b511f4f3c416478e27639609dd
SHA512 ba27325a209f48f8bec2d1c7df019f4c1c2ed22a66064531331302759b673eb5236ae92f4f7b6544d9313a797a0f422d610048c40cee17943281fb7bfba9f12e
TLSH
T1ACE07DEDC8CAC32EE318648B4178A38C82B1360ADAC86E6E1725DD8C7401744FFD27D4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 39eb226e293156bb066719b1d5b18251fb9215bab27114b12b9823e487401c8d
MD5 b9ed3923ae72c2c60208a4150755a87a
SHA1 3f278f52e3dcdc75e338261ae5f1a2b87cc86d0d
SHA512 fc397efd1dcd7c97287d009e8539130865199644b2654dbbf1879b608de0da0ddf4b73ce8ae186fee77997bd0dcdcb21d67e22c4d5c8d18a6223ef0b583db6cc
TLSH
T1B3E086E985C9C27FE345B48B4268578C83B03A0FA7C8695B6708CD9C7142685F3966D0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f9fa136261e42093f4eda798c596810ab7f5a9121830c8f5183abff19adc0341
MD5 4cec3c0bfad0db54d1279cd277094f04
SHA1 293600e66de30b811fed13b66877c1bf04415d93
SHA512 f38b55085abef5ca2a84dc56a722fd6ff07d967732e42df5f479e3beaaab06a6efe7f8d999f69f6ca0db1a339318b3f33949ad80e8533d71694fc0351e7f9b17
TLSH
T175818386001F09E8EBE0C23050C64591377BC2B59E672EA95EF61F747A1776AF1433B6
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5922a1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5922a1.TMP
Size 3KB
SHA256 2cd3f83822525ded7a09761f7b4b976e4df2d1053c95a8a90c75560d63e8fa21
MD5 1de227680f445974879f6925102585e5
SHA1 1dd1b405b59f0cc628473d91cc382dc59d6ff609
SHA512 73c7ed62fec5450c3a95c4f42b8dda8467e29b38851a00b5dc1dbc7612b6fa4bf98aba64074cf60c57eb99329d6fdbb96ad9d506b45fa61ed7308e9d7ddcc30a
TLSH
T1E9719F86041F04E8E7D1C23040D24291377BC2BA8EA72E695EF61F347A0776AF1833B6
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 615397ffac7dcfd7abfcee602caf6d6bb18f68db29bbd9e20217994cccc55cc1
MD5 abab83a5ea19bbbe40ba8228054d8697
SHA1 bbff0b0443c31cc8459fa4714a3767b84099e415
SHA512 92c8b2164715cbb229d77011cf9167b85e7164f394e35234185469d6f78d99115034d2d32a29ec5693a85cd7060c65c20faecfc9897d72565cc048cb73f988d1
TLSH
T15F21CBF783E182AED90156F0AA18AE2BDE1C0415832C3C69C5D4FF9B93E3071E142A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 6d7d72c66dcd33c49e43ada7822c0003e55e036c4ee119051133737b426d3ab2
MD5 0e17cf2900023d2b630afa52e8c5bd84
SHA1 f068f1c80394eefd1ae2870d30770c2f27fe5d1b
SHA512 90ab381eb786b6f15ab1d1bcdeec65dd8b79c293bee8d43ee4aa7706e488fcf5e6617cd5053f8dba3aea428174ed62532cbcd092f2d48f5061d26719cf022d56
TLSH
T11021CBF3C7C4866E880617F0A628BE26DE1D091583283D59C5D4EF9B93E30B5E20195B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 6db620eb1adcc3d3272aa9f682b97d25d646b687860c29c62c27db86cdb94bce
MD5 95490b740818d8f2c13f2a61daaf5c61
SHA1 e1f5a865315675f1926efeb0be58d446a5bcc353
SHA512 193fd93d1c8388b84b588c9c4baddf8ccf4c8d2ba044a9866ffadf8531c41a825946f33872a5d3b42a6eeb0279f4b7aefed71bf801772db25041e947f8a532c8
TLSH
T1FD21CBF783E182AED90156F0A918AE27DE1C0415832C3C69C5D4FF9B93E3071E142A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e8895da93377d1ada6a4dc90dcf8edde4f34e10cc504b3495ae7a5922af10d86
MD5 6b5f2eabb6305c414fe733ebf4231699
SHA1 51a538657f60823d667d13785366b7560916b96c
SHA512 85cee4b39e4c6a3bceb355e612efb16ef9163d39ee75b8d3da1ba9fa074bd892d693fd5e7e28a5636499b88f5504ac970800f8682946fbd2c2a17dc3a7da6a7d
SSDEEP 192:sxZhR9yM/jK1Ml8UQlkf/frXsF6CnONLIdphSHlD76+WN9pP/Y4OsAaIg5yJ:sxZhjquf/fzsFZnONUkHOD/HE
TLSH
T14C52D7166A34997BCCDBD209BA81BF53D6F44472D2941E44AAFCDB0C05E6AED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f041115578771fbf7225d491dc31d4aea298ec1e9cb18a5c30a33687575e01d7
MD5 25b3445cd156328b7c5a5afbfc603a76
SHA1 b26180e010b1c696a36d0fc2fce326f4fb806644
SHA512 c52ffac46bd8983336c45c8455d4257e30c70e25d01bba0897900dba750ce704a695b9241d2a2bdf181fa3399a8b29af5980797d8178bae1ed8664252c49d508
SSDEEP 192:sxZhR9yM/jK1Ml8Mkf/frXs/BC+LIdpJHlD76+WNGY4L9AaIgrJ:sxZhRMf/fzs/0+UJHOG39
TLSH
T18C42D6166B34997BCCDBD209BA41BF53D6F44462E2901E48A9FCDA0C04E6AEC220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 f3670cec4e7190c7c3f75b5ac682c05abe07daadc584eac3d4d70fdd467bc062
MD5 b7f50c91621887f96eefcbb3a3203f4c
SHA1 d7e8689f950e7cbc4e83714027801e922ba54f94
SHA512 fd9c7141f3a6d92415b663fd0c7770c2cb57ce7f044644d0e36390da6572e880721e7964494c7aedf517aa527ec91c85e0bf275b304a96a344ac131818795376
SSDEEP 192:sxZhR9yM/jK1Ml8Mkf/frXsF6CnONLIdprSHlD76+WN9pP/Y4BbAaIg5yJ:sxZhjMf/fzsFZnONUmHOD/HE
TLSH
T1DD52E7166A349D7BCDDBD209BA81BF53D6F44462D2941E44AAFCDB0C05E6AED230381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 6cb0f488e2a47b3376c981a32ca033747bcdf021994520311ed2e770b1735246
MD5 dc732c2bf13d8395dac428429f45c3d0
SHA1 7b45c9508d95de8f72897976ad3786e21d926e32
SHA512 823c37a41dc53e3903e6e020aebbafdde793ed8797d6b9d0bbb0019b0af1ddf06ce4830362f9b5960ed6053dd6a5745cc6e976c1c7e87f0fa6b960a1c9ea9edd
SSDEEP 768:9SEPO/KWvWeI58F1+UoAYDCx9Tuqh0VfUC9xbog/OVKqLlBHu16roASGSI:9SEPO/KWvWeI5u1jafqLXO1xwSI
TLSH
T192D21B2B680CCB7E4F840E9DEC2AAF966ED801CB67984D5447FA884C03C77EB51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\67e80507-316b-45f9-8f16-d70efa58e597\index-dir\the-real-index
Size 912B
SHA256 224cb384962f6c10cd51fd36469aa562c5dac4bbaa79e5abc3f75799f3bfea61
MD5 d1244ae254b40ff834a0ad2143030dfe
SHA1 8f21230183139ff410a6d0c7742bd5c7e520307c
SHA512 7929f976d6b88d6bd720ea0d27968598f1eaca3443bf278f98b83e49dda3ca77d7613a999ab7166b672854c89549cd379a32111d820224480ddcfa5f477cd794
TLSH
T13711234A8EA6892FE85446B310B920F47370CFDC6722E273443C263B2C2730E69871C4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d66cb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\67e80507-316b-45f9-8f16-d70efa58e597\index-dir\the-real-index~RFe5d66cb.TMP
Size 912B
SHA256 eeaca83744b8ef7909e077d0fea5e8b212a910fb5512892ee538af19264a7faf
MD5 ecd3c9699e0fb0d9495405a2ae2f16c7
SHA1 bf08df640f83ecc7c5ca8df0e0477024a9695bff
SHA512 0eb711ed66caf848d1111db2b9f6851673f41f2f9ea205eecde7443f53e8a23560b6befc71f85b9cfd9afb4b3d25eccdba8b6f969ec3aef559bd29688269ee3d
TLSH
T1171162868BA24C5FE95441B7008A60F87330CD003372F7A3903E263E1C3A39D5E470C8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 75c8f3d4026945379632b894d359140bf5b348d279934faaa3953e7658961d52
MD5 452cad55bf1f6aa316dd56d9c207f900
SHA1 b54cea7d07eebfd66882742803127c4d3e4566e7
SHA512 a4660a0da94b9e6bb21ceb687fbb22a5bfe561d29397edc70aae50890a849218cf0352e7ce41619215ea0f6c34c26f7f7cddd3f8ecd773630b2a6192ef0b3543
TLSH
T1F7E068B63DB71C10FC6BC3C2A47094A4015679688A00AC8F141AA2CB70F1324344FD61
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 bd4c0abc828c6eca35c49f9baedbea84eaceee3989a96f01b2313fad06bb84e2
MD5 3770d8a84dd9489afaedcf5798c05660
SHA1 5cc81a1dfda7a856b936f8e1655b0b07b2ca37e0
SHA512 a25ea09dab4935c4264fd1cb8782a4ad8fbb581b92dbaa2b0eecef1042326cbd7a3885894918ff3cfee55c5155b003588d79cadd610f8b33caae1a922ebbcc74
SSDEEP 48:KoNIdKuYAPyFhIdKigwFo/8YqGikyGBPIBQkKEBcCkA40Phq45yRP:KoNOKuY62h+KigtRiKSsiCP
TLSH
T136918213703B1641387D78489691862B9AC370B33428E96F3BAD91A10F67E168FFC9CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5979e9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5979e9.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 998289553cc1beedaf3b13ec5a2c623e33c24fb06bcfc51d080cae143b62b290
MD5 cde72a7f32c9cfad15293bbdc7f82419
SHA1 315e4f43968c238fa518a1596ce12934dbc2fbba
SHA512 e59cabdb6f6891f191efdeba6d6731a470de85bc885e7b5aa076d193795e982bfdf9c3f9403689205e23a3705abd6bd11ca75fbcdb0bab2450a7c34f0f90e248
SSDEEP 384:CZcIhsN6kCPN29vsRVXq6sumPXEYoyaOObjI9G6w7cO3Z1:whVdTsEqa29MX3Z1
TLSH
T1C1929E3398789D3B5DE7A165B48A35035EF8912BD7CC6F84DAEDBB0C00DA56C030A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 73bae6c523f8b1f241e85dc9cc65f30d6ce94a7d65963ed77de8ec259af97f72
MD5 1cb2e928aa653635c39674376560fe90
SHA1 dc118e092d0561738e1b5ff6d95e244d3a727547
SHA512 1cb5bbfaae6a1cdc5b95092d2d4648148675163346c3ede1218b0e433dfce5db3ba4bdb4344d8f7817419d7e4cbc462ba91e1889cd71f97ee9b1a030bcef6f64
SSDEEP 384:5iFiZcIQzsNC8TUNTUlIlkzPN29vYRVXq6sumPXEYovaOObjI9G6w7cO3Z1:QFQMTwg0dTsEHa29MX3Z1
TLSH
T1BCD22AF248D7893AD9AE5757B77D2D025EBCD027F684AA40B7D89A0CCC961BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 6684b99e9d8805cb84326ab2c68c24142dc4ce79e703a7149f79baf66aa8109b
MD5 1e7afc30a98d21bfa12fa30ad1f851d9
SHA1 ebd6f89986a7d3f6d45862ec26b9ff4906610a91
SHA512 b7eb32fa91b9a1a47ddb89f56c0d224a2ad4ed015c50f321425ca1cf7b57d28bb527e9b0f2b02c3507c259d4e8631e1a3bdb2c5ae56d50968c9ebda584432736
SSDEEP 384:LZcIhsN6kzPN29vsRVXq6sumPXEYoyaOObjI9G6w7cO3Z1:ThwdTsEqa29MX3Z1
TLSH
T1CF929E3298789D3B5DE7A165B48A35135EF4912BD7CC6F84DAEDFB0C00DA56C430A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 10fe17206d07775cb462c9cd40c947a3765d1b394cd22dad3b386b4e4652611f
MD5 7d9c847d8fcbffdde25dce86e49d4cc5
SHA1 da0e29dd9153a6c820338e25bd5f8b36f450602a
SHA512 9a818cae5396b95d8d168f7d131c790bbf99c593a781ff8494e042a15f236adab821b76c4dee8e29a9087c39f058d591c2e45e5109b6b84045196d4e5b6083f8
SSDEEP 192:mON26rvoQmiUypKLDrKhD4XqMB/1jejzoofOM/SExL3U6:mON26cF+6Xq6sumjzU6
TLSH
T12602E83568786C7B9EE7AE49B4863B135FE4202BDA946F84EAE81B1C00D765C1306D37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0ef365c17e9bd64d91044ec7834290a8134ba4c7e4d31e4d3c388c2570ccb271
MD5 23c4a63803acdf579148ae69eaeebd0b
SHA1 ace04c07db274c3fdc22359656047f9e5367199f
SHA512 8e258fa3461e4a6e604325be8ec85a9f90b38975835caa977ed68902e5cd03a547b602b98b4b77174e7d6ea70d6649056328d44e0939dda58635273c7073a741
SSDEEP 192:oONL6rvXQmiUy/LDjhD4XqMB/1jejzoofOM/PX4egPwogIC7qsYU6:oONL69Ej6Xq6sumPXEYoeaU6
TLSH
T147120A36A478AC2B5EE3A595B08735035EA4511BDB897F90DAEC2B1C01EF25C534AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4b1817f8-2eec-486e-b603-03148792e97b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4b1817f8-2eec-486e-b603-03148792e97b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7ea2be0927952df3ea051006d34adc2fc9734db71fccedab7b44d0f2a9a422a1
MD5 45c8be869c3b78b1a854f91fd8ca9e54
SHA1 e36a835ee76c5a9468824e9f26cc22c429d1b1df
SHA512 34bc3d22a2b8bb466652d36913620e469f5f99f6ddfbbd7c9d29625ab107beb739e6ce3691f8bbca31242cd73ee8111932384bacfba332aeccfe748804e7de8a
TLSH
T1E9415B48B6E91148B3776E5A9BF7B86E487FB9732E0AD49D00100E4F4A62B40CCA1737
MD5 SHA1 SHA512 TLSH

Submit Download