hxxp://costamarine[.]com[.]br

Resubmissions

30/07/2026, 03:11

260730-dp5lhsah998

27/07/2026, 09:38

260727-ll7wgazdlg3

27/07/2026, 07:23

260727-h77k2sbj5w8

Analysis

max time kernel
899s
max time network
899s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 03:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://costamarine.com.br
Sample260730-dp5lhsah99

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3484	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298547652616126"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{3883DE1E-3FD9-4516-81D0-43B32F73A6C0}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5944	msedge.exe
5944	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 5676 wrote to memory of 4848	5676	msedge.exe	89
PID 5676 wrote to memory of 3268	5676	msedge.exe	91
PID 5676 wrote to memory of 3484	5676	msedge.exe	92
PID 5676 wrote to memory of 3268	5676	msedge.exe	91
PID 5676 wrote to memory of 3268	5676	msedge.exe	91
PID 5676 wrote to memory of 2288	5676	msedge.exe	93
PID 5676 wrote to memory of 2288	5676	msedge.exe	93
PID 5676 wrote to memory of 5840	5676	msedge.exe	94
PID 5676 wrote to memory of 5840	5676	msedge.exe	94
PID 5676 wrote to memory of 5840	5676	msedge.exe	94
PID 5676 wrote to memory of 4952	5676	msedge.exe	95
PID 5676 wrote to memory of 4952	5676	msedge.exe	95
PID 5676 wrote to memory of 4952	5676	msedge.exe	95
PID 5676 wrote to memory of 5016	5676	msedge.exe	96
PID 5676 wrote to memory of 5724	5676	msedge.exe	97
PID 5676 wrote to memory of 5016	5676	msedge.exe	96
PID 5676 wrote to memory of 5016	5676	msedge.exe	96
PID 5676 wrote to memory of 5724	5676	msedge.exe	97
PID 5676 wrote to memory of 5724	5676	msedge.exe	97
PID 5676 wrote to memory of 3108	5676	msedge.exe	99
PID 5676 wrote to memory of 4540	5676	msedge.exe	100
PID 5676 wrote to memory of 3108	5676	msedge.exe	99
PID 5676 wrote to memory of 4540	5676	msedge.exe	100
PID 5676 wrote to memory of 6088	5676	msedge.exe	102
PID 5676 wrote to memory of 5528	5676	msedge.exe	106
PID 5676 wrote to memory of 1656	5676	msedge.exe	107
PID 5676 wrote to memory of 5996	5676	msedge.exe	108
PID 5676 wrote to memory of 5628	5676	msedge.exe	109
PID 5676 wrote to memory of 5628	5676	msedge.exe	109
PID 5676 wrote to memory of 5944	5676	msedge.exe	111
PID 5676 wrote to memory of 1776	5676	msedge.exe	112
PID 5676 wrote to memory of 1776	5676	msedge.exe	112
PID 5676 wrote to memory of 2352	5676	msedge.exe	113
PID 5676 wrote to memory of 2352	5676	msedge.exe	113
PID 5676 wrote to memory of 1612	5676	msedge.exe	114
PID 5676 wrote to memory of 1612	5676	msedge.exe	114
PID 5676 wrote to memory of 4968	5676	msedge.exe	115
PID 5676 wrote to memory of 4968	5676	msedge.exe	115
PID 5676 wrote to memory of 4860	5676	msedge.exe	116
PID 5676 wrote to memory of 4860	5676	msedge.exe	116
PID 5676 wrote to memory of 3752	5676	msedge.exe	124
PID 5676 wrote to memory of 3752	5676	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://costamarine.com.br
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffec25dc188,0x7ffec25dc194,0x7ffec25dc1a0
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,4393480587911903788,17369582944230489588,262144 --field-trial-handle=2292,i,6753391179721415134,5306724760950680844,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,9298557535130917861,4414605669878271641,524288 --field-trial-handle=2292,i,6753391179721415134,5306724760950680844,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2296,i,5288632395120290505,12840305433807583565,524288 --field-trial-handle=2292,i,6753391179721415134,5306724760950680844,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:13
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3352,i,899532157384329212,1696632166966679760,2097152 --field-trial-handle=2292,i,6753391179721415134,5306724760950680844,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:1
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3356,i,4868170607725063209,2230694881613350057,2097152 --field-trial-handle=2292,i,6753391179721415134,5306724760950680844,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4328,i,16333502268943990770,3297895557372936530,2097152 --field-trial-handle=2292,i,6753391179721415134,5306724760950680844,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4352,i,5670847809858464087,577061687493197312,2097152 --field-trial-handle=2292,i,6753391179721415134,5306724760950680844,262144 --variations-seed-version --mojo-platform-channel-handle=3332 /prefetch:9
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,7076558500624406722,9028761755190789243,524288 --field-trial-handle=2292,i,6753391179721415134,5306724760950680844,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,15832798955466773862,18046201006202008375,524288 --field-trial-handle=2292,i,6753391179721415134,5306724760950680844,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,14700224069348933265,8144181632064336023,524288 --field-trial-handle=2292,i,6753391179721415134,5306724760950680844,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,14700224069348933265,8144181632064336023,524288 --field-trial-handle=2292,i,6753391179721415134,5306724760950680844,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
  2⤵
  PID:6088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,596168541202114208,4533832389686093575,524288 --field-trial-handle=2292,i,6753391179721415134,5306724760950680844,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:14
  2⤵
  PID:5528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,16700618710711432945,17199353450749717786,524288 --field-trial-handle=2292,i,6753391179721415134,5306724760950680844,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:14
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,4031185050787711309,16577410497571338668,524288 --field-trial-handle=2292,i,6753391179721415134,5306724760950680844,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:14
  2⤵
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,15267492372770024458,4561846381758034463,524288 --field-trial-handle=2292,i,6753391179721415134,5306724760950680844,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:14
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6392,i,12705188247859732467,13533178055412363248,262144 --field-trial-handle=2292,i,6753391179721415134,5306724760950680844,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,13476268028688388643,13790946991561809755,524288 --field-trial-handle=2292,i,6753391179721415134,5306724760950680844,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,637999304067551146,17151061958486307726,524288 --field-trial-handle=2292,i,6753391179721415134,5306724760950680844,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:14
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6860,i,2624660844727780414,5596662407971226958,524288 --field-trial-handle=2292,i,6753391179721415134,5306724760950680844,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:14
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3460,i,1367432421990144522,1434172622365230127,524288 --field-trial-handle=2292,i,6753391179721415134,5306724760950680844,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:14
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=816,i,13036241447382186804,9469120488598513962,524288 --field-trial-handle=2292,i,6753391179721415134,5306724760950680844,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,11974977978156688158,15448984782654061262,524288 --field-trial-handle=2292,i,6753391179721415134,5306724760950680844,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:14
  2⤵
  PID:3752

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2320

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:2564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 17aa4d228ca8cad73e3349cf9206a483a978d7ac5e446edb89638db93b7a7a42
MD5 023dde857f02a1dbe0ccb7c8f6c699aa
SHA1 2f511eac8d87a28d0725b0c927f145be661f1e5c
SHA512 ab07261a40c51773ddf098851fa46a4735f98b9a103c2395a38a1afe4140e4e897ac8d88a45d930403f35582824addd0d9ab7988e9d7dc2f2f20516a71c4e2f5
TLSH
T162E026E554CCC2EEE755A44F5268578C82B1360F93C8A95F6B0AC88C7041044F3D26D0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 acdb4cabce24faa0b4ebba7274fa191f9514ff4e87d7af60988b8fe93df7073c
MD5 efe3c02498ad3eda52c5f524b0fe1c09
SHA1 7eeb1c33ca6d3c3056b4b9f1ba8b67b73b366a27
SHA512 5859b321b4043ff2245d3a777680f5cbbd39b2400764061b06b91bc88e29021253aed728f96d52e983cfe87760d589e9d930f4e345b3d89f125f216f0e2b387b
TLSH
T1C9E026E584C8C3BEE300654B416CD3CC82F13B0E92C8A91A7B09C8CC7441480E3926D0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 6f92810c2dfca6e91877873878719f8f6948d3e96ce42f473abdd38ac7a03417
MD5 7d6ac1436a7e8a78c74a63acff1419e9
SHA1 b3ebf8785f93c96e9c0d4f74540f58614f5918af
SHA512 2fbb4b0d75cd4f2ccad7ef63ef697fd18ccb1882fbe10c5abd4e2e172659515d7184e9b43d5d7faab4cce902435474d1a06761644fc8c016cbc69d85e9bb4287
TLSH
T142E026E489C8C27EE344B8874178978CC2B0360B9AC8695E1708C99D7041140E783BD4
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 009213ec9b761af2f78e0c426433d53905b3847e019d237eb13feb16bddd3af1
MD5 ab166078afd2fe9d94c3aeadab25d0c5
SHA1 7319c77de197db029504aba3d21d99b7b8a4d1f4
SHA512 63191c4fc5d3a161ddf73733e476b44e01a983c96fc3a79cb85aa0274d7e0f9ff342988c1fb5c9f544a251401004de29df4e5653c2cd84f6abeef503476c95dd
TLSH
T12C61ED5493611EF2CBE94AB3F2F06C9833E88446668B2A0DC05EAFF51506F5D93E1637
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1525cbf70cafa011cd62a6f16d06e6e95c035d88c6db98e7fdd56a29bb253c7f
MD5 2c68d5d9cc81f4c3da975ccbcbd8e39b
SHA1 7f55082be517884ddbf2e65f832806f2f1d0cc0c
SHA512 c6ee51ee375d8ec37aef8861215525b17e02ed8b07d1df0c5f3d2cd48def6cc45e219b98e57a1b8c59da9c7174082effcfce52e5940470ec9445358d5d0921f5
TLSH
T1F8610F5593611AF2CBE94A73F2F15C5833E8844266872A0DC05EAEF5140AF5DA3E1633
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5978ef.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5978ef.TMP
Size 3KB
SHA256 ea3a0cdf7b47d3fa6226f2272fc1b5c8cfb8f182ca723fadf55dff7ba3911a5a
MD5 04e68157d882ffafa6fa8566b5c83870
SHA1 a1dc5a65574847f6acdc2be488cd98fe99e5f874
SHA512 e1d7ddc06e74b6465d3c6f9c7bba18d403d672ecfc289ed386104a2e707a9f3355ebc4088377a235afb70b1ae5e7b02e63101c55dc88cade23a758f1de8c9cad
TLSH
T11261EC5493611EF2CBE94AB3F2F06C9833E88446668B2A0DC05EAFF55406F5D93E1633
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 4fd68044a8e75dc4f62e0f99f56651c519cac240dd61514ab108ca4e104d149e
MD5 ebeeab56a320f227f6942fb80d62bec6
SHA1 01a616ee2e597632b161473390e9cbb5d823a968
SHA512 097c1386a669c6551821e3c35a150f89b60dad070a37966fded47528ca10552bfc560649c0aea886a5f440f7f4c9c4d43efb38fb77bcef38db23ebf140976170
TLSH
T11F819CF3C3E8826D894296F0E6143E26DE1D0954836C3D5AC4D8EF5F63E29B1E28154E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 9debecb3a200eb1b3a56d6d82623202aaf3143aa6d86b120ac5e8fd67c488333
MD5 609fd95ccc21226633fe944e30b8d46f
SHA1 0c245eeb689fc548ab1fe82aad750a921d1b050f
SHA512 f74579c3186fd26c3e5bc74ce39b4f8da36d9525c9d07576b5596a0e14cfcd2d2f52d34043e77494aeeed79f17ec010c5524afbb8e85e23e044d3b3a697db5fe
TLSH
T1BD71BBF383E4826DD90195F0E6147E27DE1D0954836C3DAAC5D4EF5FA3E34B1E18164A
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b04f5ad4ca28168fe592c0b8bf2b12af55a9c9bff45251719842826d73b0a89c
MD5 50849c7c7ae05d5e26147af172d38eb6
SHA1 7d94faacdf364f111674eb653c5b0def82eec8db
SHA512 fc92100c2985b4902a62c819b870247ede48fc7b66bc3d6e3b8d772206d254dacb30ee01b45eb3c53cab5bf49ee38f4374bf59e2f60a2f7558f03902397703d3
SSDEEP 192:sxR0PR7yM/jK1Ml8wbB/fIsBgprQ5RO3zoA8puk/j/6+WNPe0/YnwEhKG8IgDpJ:sxR0PhlB/fIsBg8OeH/YB/JCaf
TLSH
T1C162D91666349D7B9CDBD219FA51BB93D6F81063E2945E44AAFCDB0C00E6ADD220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a7043d113ebd4a7043572cb25267efe5a4a35d1e4b39b0ef96fbd630c49a0e9c
MD5 3d1372596356fa1f14ba2e2c2d585d3b
SHA1 cd11a79798a3825315af489e9c6b4889604a35b7
SHA512 91a226bd08bd4af49e7255dbf9d45d17a77c020a6af2359882a6ebb2603a1eaabaf4ea03c9fc98aa174b7419e4817abc809733531ac85bd200770c78fc98328c
SSDEEP 192:sxR0DR7yM/jK1Ml8wbB/fIsBwprQ5jzoA8pi/j/6+WNIYnY3hKG8IgDXJ:sxR0D3lB/fIsBwPi/YI5Ral
TLSH
T1AF52D8166A249D7B8CCBD21DFA457F93D6F81473A2945E44AAFCDB0C00E66DD220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 55806058fda101e60cd599967d06dd91f958420d76d600e4cc293115c56d6660
MD5 c131d62b7110b718738c2b47a618b921
SHA1 4618a27febe5de52aacba77b85592088724df18e
SHA512 0988d81fe0c8c5c36b59c30859cf077bc2fc64bff2ac19c2455335ade604cc707b09b1b7a4c5c097ac19e059a1c7311cf735a0848d91ab4f660e7bf499edbcb6
SSDEEP 192:sxR0gR7yM/jK1Ml8wbB/fIsEwprQ5jzoA8pi/j/6+WNIYnY3hKG8IgIJ:sxR0g3lB/fIsEwPi/YI5Ras
TLSH
T1AF52D9166A249D7B8CCBD21DFA557F53D6F81473A2905E44AAFCDB0C00E6AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 7eef8b9ef05af1fea2dd7aad46de2c076b2ec37ad6f9e918232cfe0786df0467
MD5 d899e0b8f518cc3e5227cf04b16489e7
SHA1 b51b76a8a59c2f260c3459901cf00456ff3ae076
SHA512 2d4552eefd8b2cee1ef15b2d9341d89e5ee063e97ebc2bb442b597bcb0006a96e614b5fb2ce19435d2c33753273bcfe2370fc0af0b4aa17d3a4eba385944ea80
SSDEEP 192:sxR0PR7yM/jK1Ml8UQrgbB/fIsBgprQ5RO3zoA8pwk/j/6+WNPe0/YnwEhKG8Igf:sxR0PhqrOB/fIsBg8Oel/YB/JCaf
TLSH
T16A62D816A6349D778CDBD219FA51BB93D6F81473E2945E44AAFCDB0C00E6ADD220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 a53ae7d4897ccc2c323fb0e6bfc3e1c928107d0167de179238d6b4f3ac443cb9
MD5 46b45e9872a66b58d2b62eab70e5dceb
SHA1 e5d85aa2d436db1ceb255ec52e06443267fb5072
SHA512 6b5d73f3ebcb9c4b35c1924d10a7c92b2ea50c638b19536ae97f87c3a2feb4e65295329013143a715f01241a71bce87efe5e5bac1cfb642bcfe96ec9cbdb0722
SSDEEP 768:wGedp6WgoufDM8F1+UoAYDCx9Tuqh0VfUC9xbog/OVIu4YfroSh8f5d:wGedp6WgoufDMu1jatVYMJP
TLSH
T1A0C20C2B640CC77E4F844EADEC29EEDB6DD801CB9B984D5447EA890C03C67EB511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8ee8ad58-4f1c-459c-bc95-4ac98d1cfc38\index-dir\the-real-index
Size 792B
SHA256 77d905d2351a77a440da29012fc7c065feed7c76c48919a17ac4c03f6dbc778c
MD5 eadc73b4f6c1e1a7e5395f585ae2af38
SHA1 a122140b87316e864aba11f16b84b8090754e2fc
SHA512 ea7e4073c9d9f7188bcf53616e29b0c61e2255cd2769f6b32ba9c4172c491ea3cce71f79f1651432c908d7c248995dde22136613765bcbfd8b59b94fe562821d
TLSH
T147014143CCE66983CC2378BB317E240A333905FC2104DE57002DB93D8D62638814035C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5dbb25.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8ee8ad58-4f1c-459c-bc95-4ac98d1cfc38\index-dir\the-real-index~RFe5dbb25.TMP
Size 792B
SHA256 81baa678bd01bb37d50ac2a67b2b9cf74ad337378b713884bae1c5fb257d1672
MD5 f657e03c5a32043b254744ad82ff24b4
SHA1 ada195b0fac3372e30bb21a899026f0a7d941d70
SHA512 3f77f3d23ac152beefc39a2e8f467f78497c3b831e7df6eed6d9d5834d5a12a67a71eb5fe7f1d65b887bff6baf56895f7abee70d8f00ac7a06ce008ba9c9e649
TLSH
T1650120E780E1FC12CD16A4F5714F601AB33E48202129D64B20AE7C7D5D626388681AA9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 0d9031c8b9ba24481a0c676ef596ef961bcfe9ce96fe847dcd1941e77999d576
MD5 17a7588ee75406121e58e184075d09eb
SHA1 7e8885439672ee7e6104c5da5230f6a5d7c71219
SHA512 b1e570abe9ec06496249c732c4d18206ebff619ccf0251087a59a7fc5ab54672ce66a695d15b04726a43e53c7da6a983cdbb37abfe72bb2e4a54ca2cd26ba19e
TLSH
T17BE020773EF72804FCEFD7DF1831645105107554844DBD4F6816E2D714B276434A9C65
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 8c1fbc91a7586d48b4875e03a2462cf44029e0cc320537025943f203f92d6dcd
MD5 3fce44760916f02b960479234951dde2
SHA1 578e4dbdd514fd5a9240c6b2482266ef2451ab6d
SHA512 bf4c1b10a306d4a3cb9848bf127968c9a3d3c44b7a9218aed50b5dbd3460f552b2b8b2408a751cc24127030e42254ad7d6d279df439772f63b3696f5a0a6839a
SSDEEP 96:KReTieYgQGWAltgeGK4DgcGcW+9M+XHklQUuSW0Wyf/gc0K4xgW0cUUfO45yXzB7:CeTieYgQxAl+eODgc1W+9M+XHklQUuSD
TLSH
T194912E12753A475038BEB98C84769C5F92C774A23528F46B37A945E10F26E428FFE4CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

1e52a818-8176-4c2a-829f-2f45ee6f6ed5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1e52a818-8176-4c2a-829f-2f45ee6f6ed5.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 f2e1229c7abaf88f24ffc3be217a64ebd6fd265e1020ceedb714b45d90d530c0
MD5 89512e67215c632f5b98dd6828b56a20
SHA1 999554b9eef5c8579fd8a557c147580c19bee454
SHA512 69826ef81b5e9ee53411282067c7047876c8e142efc7e4aeb64aed115204b55ded9173e2c2397306614bcb1c550934b09030d780e0771d56a8d2f77ab4ec5f79
SSDEEP 768:1rv+4UNbdW3sMXaDZIO0CEl8svNzc4ReyIsPDgTDzzf:1bsbY3Lgivtc44bsLgTDf
TLSH
T12513CF36ED289877ADF68252B4073A437EF4125BC2C82A94E9DE2F4C468B1DD135F913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 209286945d31f418df60439f01fc1b9ce43f2537abdd3a7d9bb44d48e2323a85
MD5 24b75d920eaeb6bf51834264efe3226e
SHA1 909b2ba2a6752c443e2b50af7d834dda17f8b2db
SHA512 b8c8fceff1b747e2f92062bdafb189374207364359183e6dd489d7c49ea86c8363d780dcba0c5f959de5100712ea02262a35f95bb551a6147a43938070cedb48
SSDEEP 768:/V3sMraDZIO0CEl8swNzc4ReyIsPDgTDzzs:/V3L0iwtc44bsLgTDs
TLSH
T116F2CF36AD608C77ACFA9352B90736437DF45227C2CC6E84A6DE6F0D168729D035B413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 e5aeb0661ee590042eb1d7bcb15aa54c56af1b6cad1d8c4e4560a30be75eecbd
MD5 4149bc5481e432fc75b1c3cd3a4ac6ab
SHA1 061aa933c3ba46573d35d2ccb45d999cc65b71c9
SHA512 7fc946acb2f377711f8e5baeb25a8a4c7b4491fbf17a32c2641a0155b3ef003f2b002178e3b45e7877c0e14de21fdd054851ac91aac2d4584d89c0a9014aac39
SSDEEP 768:MV3bMraDZIO0CEl8swNzc4ReyIsPDgTDzzs:MV3o0iwtc44bsLgTDs
TLSH
T16AF2CF36AD608C77ACFA9352B9073643BDF45227C2CC6E90A6DD6F0D168729D035B423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 18fb4b82f7c2aeb1ef1ddf11c0fc469c5a82bf6baaea3eb505539287fe1b0587
MD5 46aaad7060c28f9290bb50df2263abd9
SHA1 8ba45ac27f91719502fe2b927b9c8c9e33afa7a2
SHA512 98b43f67f477f7fc55f148df4a5cd49b3aa54a4024f683435ab951f9dc520c49d84872fbd5f2f98e37b50a6de65b82bccf45552201485c5caadf8b2d1591d9e1
SSDEEP 768:3FQh3QwgyMFaDZIO0CEl8swNzc4ReyIsPDgTDzzs:Kh3Suiwtc44bsLgTDs
TLSH
T1161349F698D38876ECAD4743B73E2D026DBCC167B188A950B7D95A0CDD461BFC34A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 e3c29c5e50fe095c887b5250014fb15cdd605f6ff6b8196eb358fb8d815993be
MD5 27d94da8e5774e703453347d1379362c
SHA1 e5256c606183b0704f171fee9095a6cc3615ce69
SHA512 e525484129f453bf10f237cc9971908722cd727a44a5c6640a96a7c415d43dc8b212f6147ce8f8303e62bb5cddf0e26f86953d5a6621660e4f2cefc095be1fb5
SSDEEP 768:6rv+4UNbds3BiDZIO0CEl8dNzc4ReyIsXreVH1S5D:6bsbS3eDtc44bs7EH1Y
TLSH
T1C303CF36A8688977ACF69685B44B76133EF8612B82C81ED4C5DE2F0C464B1DD134F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cde47e82-6315-47e1-9a4d-13c8e50b1901.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\cde47e82-6315-47e1-9a4d-13c8e50b1901.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download