hxxp://costamarine[.]com[.]br/rs-plugin/assets/loader[.]gif

Resubmissions

10/08/2026, 23:28

260810-3f66es1dng3

10/08/2026, 23:06

10/08/2026, 16:02

30/07/2026, 05:35

30/07/2026, 05:17

Analysis

max time kernel
898s
max time network
606s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 23:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://costamarine.com.br/rs-plugin/assets/loader.gif
Sample260810-23ffjs1brc

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1476	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308767948127592"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{79FF6A22-5686-4C5A-A6E5-3A6EA1C68667}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2636	msedge.exe
2636	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 2268	836	msedge.exe	84
PID 836 wrote to memory of 1476	836	msedge.exe	85
PID 836 wrote to memory of 4960	836	msedge.exe	86
PID 836 wrote to memory of 4960	836	msedge.exe	86
PID 836 wrote to memory of 4960	836	msedge.exe	86
PID 836 wrote to memory of 5084	836	msedge.exe	87
PID 836 wrote to memory of 5084	836	msedge.exe	87
PID 836 wrote to memory of 4228	836	msedge.exe	89
PID 836 wrote to memory of 3192	836	msedge.exe	90
PID 836 wrote to memory of 4228	836	msedge.exe	89
PID 836 wrote to memory of 4228	836	msedge.exe	89
PID 836 wrote to memory of 3192	836	msedge.exe	90
PID 836 wrote to memory of 3192	836	msedge.exe	90
PID 836 wrote to memory of 4516	836	msedge.exe	91
PID 836 wrote to memory of 4516	836	msedge.exe	91
PID 836 wrote to memory of 4516	836	msedge.exe	91
PID 836 wrote to memory of 3768	836	msedge.exe	92
PID 836 wrote to memory of 3768	836	msedge.exe	92
PID 836 wrote to memory of 3768	836	msedge.exe	92
PID 836 wrote to memory of 3804	836	msedge.exe	93
PID 836 wrote to memory of 3804	836	msedge.exe	93
PID 836 wrote to memory of 3804	836	msedge.exe	93
PID 836 wrote to memory of 536	836	msedge.exe	101
PID 836 wrote to memory of 536	836	msedge.exe	101
PID 836 wrote to memory of 3888	836	msedge.exe	102
PID 836 wrote to memory of 3888	836	msedge.exe	102
PID 836 wrote to memory of 2924	836	msedge.exe	104
PID 836 wrote to memory of 3460	836	msedge.exe	107
PID 836 wrote to memory of 3484	836	msedge.exe	108
PID 836 wrote to memory of 2112	836	msedge.exe	109
PID 836 wrote to memory of 1468	836	msedge.exe	111
PID 836 wrote to memory of 1468	836	msedge.exe	111
PID 836 wrote to memory of 2636	836	msedge.exe	113
PID 836 wrote to memory of 3980	836	msedge.exe	114
PID 836 wrote to memory of 4148	836	msedge.exe	115
PID 836 wrote to memory of 3980	836	msedge.exe	114
PID 836 wrote to memory of 4148	836	msedge.exe	115
PID 836 wrote to memory of 2548	836	msedge.exe	116
PID 836 wrote to memory of 2548	836	msedge.exe	116
PID 836 wrote to memory of 1932	836	msedge.exe	120
PID 836 wrote to memory of 1932	836	msedge.exe	120
PID 836 wrote to memory of 740	836	msedge.exe	121
PID 836 wrote to memory of 740	836	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://costamarine.com.br/rs-plugin/assets/loader.gif
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x290,0x7ffe0041c188,0x7ffe0041c194,0x7ffe0041c1a0
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,10429126802078467202,1650171297053267191,524288 --field-trial-handle=2244,i,9437889217615508257,11173555576614718702,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,6697311706962706432,16491787598240135819,262144 --field-trial-handle=2244,i,9437889217615508257,11173555576614718702,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2616,i,16431304482442556217,2477085815222267534,524288 --field-trial-handle=2244,i,9437889217615508257,11173555576614718702,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,16688505316102039791,8025588391868131072,2097152 --field-trial-handle=2244,i,9437889217615508257,11173555576614718702,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,6432111634505837803,16312094615490463174,2097152 --field-trial-handle=2244,i,9437889217615508257,11173555576614718702,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,12633076898354878921,15722981053668308419,2097152 --field-trial-handle=2244,i,9437889217615508257,11173555576614718702,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,8303640313861527637,15917679808090654096,2097152 --field-trial-handle=2244,i,9437889217615508257,11173555576614718702,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:2
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3464,i,6228722739945217302,1982638980873910180,2097152 --field-trial-handle=2244,i,9437889217615508257,11173555576614718702,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,15122557772300775605,13373039714187107876,524288 --field-trial-handle=2244,i,9437889217615508257,11173555576614718702,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3736,i,2722551554205067966,669453725046253013,524288 --field-trial-handle=2244,i,9437889217615508257,11173555576614718702,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,10468945542454171625,12638333070179609017,524288 --field-trial-handle=2244,i,9437889217615508257,11173555576614718702,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,10468945542454171625,12638333070179609017,524288 --field-trial-handle=2244,i,9437889217615508257,11173555576614718702,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,8969018562593380893,12315140076769835340,524288 --field-trial-handle=2244,i,9437889217615508257,11173555576614718702,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:8
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,14468310997263511084,18202284681078396843,524288 --field-trial-handle=2244,i,9437889217615508257,11173555576614718702,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:8
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,18370981993609964545,15729858494331968901,524288 --field-trial-handle=2244,i,9437889217615508257,11173555576614718702,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:8
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,17787941303564372766,13925370648782545438,524288 --field-trial-handle=2244,i,9437889217615508257,11173555576614718702,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5924,i,9910797902135647861,6264392602006066632,262144 --field-trial-handle=2244,i,9437889217615508257,11173555576614718702,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,10009366578298049082,2321992511210127033,524288 --field-trial-handle=2244,i,9437889217615508257,11173555576614718702,262144 --variations-seed-version --mojo-platform-channel-handle=4000 /prefetch:8
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3364,i,16977128197091261574,3045651635376848868,524288 --field-trial-handle=2244,i,9437889217615508257,11173555576614718702,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:8
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,9900962488539597916,17939540657677174699,524288 --field-trial-handle=2244,i,9437889217615508257,11173555576614718702,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3472,i,15788425611588463288,16182912375689911771,524288 --field-trial-handle=2244,i,9437889217615508257,11173555576614718702,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,8406185505455576129,8919804537734044909,524288 --field-trial-handle=2244,i,9437889217615508257,11173555576614718702,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:8
  2⤵
  PID:740

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 66e144094efd80bffe84d3364cb59db5607508bb71d622ac7b152f87aa33c568
MD5 ba7c573a910bcf4813296e1ca72de81e
SHA1 0d66f46e2a30b7fcbb07ca74e1eb0916a389342f
SHA512 07e1c2586033d8afeab20572141c308ff65740bb02c17c9888a01307ca0e9043fcbee667280762e55c0fb710e8d2e772f2c76d4b1d6694ea133443e89a314f36
TLSH
T113E0269808DDC36EFA48A58B527C438C83803B0BD2CCFDCA6B00C4943242048E6C79B0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 aa383a648fe320a42a69592381930c0b1b3de05bf9248a5f23bc599330aa27f1
MD5 dd324dfc243817eb8f435924927a7b6f
SHA1 898937efaeb9bc523c9ca04e376520db3c3d3ce4
SHA512 f63189559d71c5eeb02a6557ec3ba79503bf99382265f51e83cd2cec10561c08aa6316a5c9959252b3f9aebf25ec3da3e20194965313dc9cedd9d774a042d2d2
TLSH
T132E0D85812A8FB64ADD1A787E17CD2D74D94B30795CCFC6D2244B45D54028429B424F4
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 249358b1eab901f0b034023569e7f01b1f94c9179591789d99d6f279761d6e1c
MD5 e3fe72c0f542fbb29d9eb8933eefb382
SHA1 fce9a5a6bf89b76d58b4c0f0c691531330ab3b3e
SHA512 f71315278d44c74df19833e56e16d62705ddd45cc9bbabd13be55f51927a3d7464736846a1c4bcda6770c5b8c0720e1defbfbddb5206de648079efb1a9250340
TLSH
T17EC080D9BD4D845FD385187E5716F00007906511942796171650FDC032419A01E29220
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 dea263db5fd8bf8f226cc21271d1d9b02364cf1b60087cfe09585eb962af613b
MD5 715a72aaa4285f4956b9090b00f3fb59
SHA1 19552f03f7feadddb1ee8b7cbd872e76e546a175
SHA512 a94729e5865c43be4621492b4bcef3a4651fa5165631862b17b5ca2aaaa2de352c793af024f676c35461ede78a417a3db3a842e81717de6891da25d2ac72c4ac
TLSH
T129714CBB07F1A8B8E3D04872A0D25541743DC2F9F807EE9AF7D085B91E1172582F8174
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b1f6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b1f6.TMP
Size 3KB
SHA256 0ebb7dc8c9d265819cd1b6664b4d34c7c186c9a1c587393243b9b34dfd8deebd
MD5 92b65b713cf080bb3ee17afc6afc8d66
SHA1 f77eaf005ad00e238a28c79bcac6f18b5f52cce2
SHA512 eb698b50d88eb89a77dea0351a3a00a161da742e1ce33d161528b52a7330426ed5a7c2e1bf06f89decc7bcfc78c26d8d731934679d81b59eab87d9f0b4587925
TLSH
T15B714CBB07F1A8B8E3D04872A0D25545743DC2F9F807EE9AF6D085792E1172586F8174
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 758c2494a294110775c10f72bfccba3b1bdc94bb32bf36b4700b9b313fd96d03
MD5 2cf580f7497ee411ab3297a324d6ca69
SHA1 484b7f114cbd5f95a3ddfdda9a827b34133aa462
SHA512 d9e22c007ce36c48ef11d78e9954ddcde0b712a1ab138b0e8ffd5a1536314fdd2cd222cf6bf4f4b6ea22f3efad6d975fe8314bc3d158e3c6312168ff88ca956a
SSDEEP 192:sxZsRnyM/jK1Ml8MWS/fzspTVYIdpCeHW6+WNxIu/YvVLSInP6IgrJ:sxZsZuS/fzsp39Hb5/AjnS9
TLSH
T11842F712AA34697BCCDFD20DB951BB53D6F91572D2900E54A9FCDA1C04E6AEC230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 242b8fdf8a1505f998c158c864ad1fa2c7a709d9c644b91d17ebc0be8900bb1c
MD5 c0818e2631ac164087ac7d606f00fca1
SHA1 4424062a010ebc69da129b7e139bf1629d6b0830
SHA512 e79b504e43bca9c71e95fcc5f093c3df948e3fd5767dad0b72fec6e2f614c3977ea3150ca06eaad827e1d10840da5f0eadb60d9a9945c7c40b431a3862d9d8d6
SSDEEP 192:sxZsRnyM/jK1Ml8UQx9WS/fzsXTVYIdpQeHW6+WNxIu/YvyL9I1P6Ig5xJ:sxZsZqxES/fzsX3LHb5/3G1Sd
TLSH
T1A452E612AA3469BBCCDFD20DB941BB53D6F90572D2900E54A9FCDA1C04E6AED230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 72b61c7c694a97694b871ac220f00adc8c10624283ef17846ebc9cde313227d9
MD5 3caed7eb752712293f7e6e159a5ef971
SHA1 d3693ea0b3a992bbdcf097ad9aef1d22916b2cbb
SHA512 c007b6217238a73024d53838892e631fa68e6017d3fdd3884d31b03da7809afb82f4a7065693962ecad0172c26ad7b39544aba76ef16e1382186cda634a45d98
SSDEEP 768:wuseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppzro5N:wuseJ3xWvhfynu1jaVcL88pAH
TLSH
T19FD20B2B280CCB7E4F844E5DEC266F966EE801CB57984D5487EA884C02C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index
Size 2KB
SHA256 f9d50e75bebeaaa199ff9e51c5d94942c7d7d8c5ab8088fa8dbb32e0a35deece
MD5 d0f58cc10be5e51bc71fc582dcdd6502
SHA1 7d32efe9ce3aea78a9a7685f7ef9c0eb27d1aba7
SHA512 e445ed2d83662da51eb5bce7c2c9ce2426cf287a2d6aa033c467f186c36d8c7b909f951cee985819308f28b88c52da38d217e8301f33271e4e4dd837dfefa4a8
TLSH
T15741E60E4E60856FD8A884B215B224E837F0D8DC1B51A2274CFC163D7C173AA1C4B2A8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cf8de.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index~RFe5cf8de.TMP
Size 2KB
SHA256 025d8fac4f675d51ab5ae7aa3370d5105d4d334162c2f35c52d161b25f61a1ac
MD5 f672969c0f846c31b32dc05548448c42
SHA1 95c09828864681fbb8a5ecaefc97856a34fd53ad
SHA512 a2d5f41071933feec18b43e8f2ddff892019fd535ea66703467ab6b65d76811fd2056124f1202f55207b5ae1f0e13ae15ac7af4b45071b1dd8388802694a90e3
TLSH
T18A41B68A4E41861FD89040730A93B4A83338D90093127B47A8BC523AB8B13BD2D4E1D8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 754386eba168bc4318c2cc0e4dda46646df0aae6acd9f9fbc8ab2b5e0674bada
MD5 5d6309f01744b17a0885af89f02057e7
SHA1 f6440941ddce31dc1d7ebaa41af0a338bc780eb6
SHA512 301fb873b7c8e749f459ff31dcb0ef1f1b2adab6e6c424067a63c0478604c1bac2bd30df9fcbcdce98e243cccbaf4116f343208f223623068828f040ec35e7ef
TLSH
T120E0C6BA2DD72850BEAFC3D224308090060A78ADE945FC0EA42BF6C310B231530DBC36
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 039f805c1542112a780fa8ff13b83c0ded1552ddd496de616f0dd872f5b35412
MD5 0142a59244a77ff728b15173b67395b6
SHA1 e4df52fde49ca6e2e6717c0a935972ef3201404b
SHA512 775b0fff461dc9f5ef80e002db670ad74b05663708dca8399ae9b2124e7f6e80ceb6fa7e613543e1cd6a533e099f343bcf2abb136423dd65d6f9316a5fcd629d
SSDEEP 48:KYHIhKggkXyi0InKxmUTyNrIlKksw4xC9xzt:KYH+Kggmh0wKxmyurKKks/xC9xzt
TLSH
T1B4A19F0A34390A123CBD29CCB29596361F4631AB3468646F7FBC00520D6FD566EFD9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 f0f86d625d95165b4f3da9bee6f5d0cc83a7b1502ccb6c17b749e7f1de0191f7
MD5 da3044d9ba2a997f08839faa83161b1d
SHA1 901ae5c66e66a08bb2e7a3e44f2a76a161386c81
SHA512 29efe1fa42a88b688fbc6647232102ea9c648cfbee1a7e0c82b4030a7f262ec1d9dd8964a91ebc0cc42e300042bd185f339fc7a1ead70f8d8f1c76fa9c6e5bd3
SSDEEP 192:wsvzsNVYmv/QTVM72rJQmiU1lij4MTQv+FdLYxTkFd3Ee8U1ODqI2U4Z:5zsNVzvoT27QneMQdExMdUaON2U4Z
TLSH
T10B82C8F158E75836D99E6347A37D3E035EBCC11BB9842A50B7D81A0CCC9627FD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 33c68ee88c9563e3a6b37bd1a541030efe054287421749849c6beb450ff67a69
MD5 154944a88dc8e78a9b33dc7044673ab4
SHA1 9047a81a0a6790b0c526263a7fffc435407b94fb
SHA512 404a895c03c33eb904251a8a974eba50d2f462f2c5732ae2a8d1492b4805c4a0acfb0ba45585b37fb6e5dcd6e204be1419b522bf6b67d65fa7888d3c9b37aecd
SSDEEP 192:wsvzsN+PvQQTVM72rJQmiU1lij4MTQv+FdLYxTkFd3Ee8U1ODqI2UA/Z:5zsN+PvZT27QneMQdExMdUaON2UA/Z
TLSH
T13472D8F158E75836D99E6343A37D2E035EBCC15BB5842A50B7D81B0CCC9A27FD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 1fb8f0e36bf8242a365b052b8537925f7b17c592289f03f5284d782b6b74556a
MD5 332fcd8fafdfcb0564b1eaa2a71febdb
SHA1 c0e4248ac2c77233b75e0b94cc5fcd834f452785
SHA512 ec35771c4460ad3a88d912e2109015de7efb9535e91e7adb923faab1f17a565f60b7c49c6769a3f9059b3fb6e2d948988d94e1b68130ad491c8a95f4d513ba90
SSDEEP 192:wsvzsNVPv/QTVM72rJQmiU1lij4MTQv+FdLYxTkFd3Ee8U1ODqI2UA/Z:5zsNVPvoT27QneMQdExMdUaON2UA/Z
TLSH
T19782C8F158E75836D99E6347A37D3E035EBCC12BB5842A50B7D81A0CCC9A27FD30A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6ff1c575b4c40542a18ca1ac3753f957115a6227aa19068fac3ff97c18e69d0a
MD5 6319f2959e979e531dcb921ddd6a4da4
SHA1 7eb53a2b69117bf69557a19438b9ae0def85680f
SHA512 e83b29c33f6501628cf4e03dab6e735a08293ca9ce7b9998584bd45d3236c6bb54feb50b3b57173b46b5433ecaf8bcf66d20afbe0371ac966ba5ffd599f5e961
SSDEEP 192:lONw6vMtPQmiUymTThTQv+FdLYx5847i7U/u:lONw6UtRVT3dExBMU/u
TLSH
T149020735AC686C6BAAA7AD46F08A37271FB4616FA5D05B54EAE82F1C00D764C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 38a27e5c1251b1c21695c37fa2b3fdb26a108b1ce64b8bd085d0657e39913322
MD5 d1084ddccb3565d0f675b120c24e3af9
SHA1 a15406179326c8832186181875f1c501b87599cd
SHA512 a5212b5b72f0282f0a62d0608cef9f618f3834ee8de7757da3fcf00881ce5874f192f52f0b28f3f6bae297c210d7125cf583b5a1904c36c14d4ca52646e27db8
SSDEEP 192:gLsNPGvQQTVM72rJQmiU15ij4MTQv+FdLYxTkFd3El8z1ODqI2UA/Z:2sNPGvZT27QnSMQdExMdUSON2UA/Z
TLSH
T1BE322B316C64AC775DA7B546F08A37139FB4816BDAC52FA0E6EC2F1C01DE69C130AD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 3f3146d25d3fab452a1566970f634b9476daa28a002e70e42591e228da5a25f6
MD5 00213682d07439b9f39efee4baaa1e6f
SHA1 5fc10e8603588058b065e398fcabd2da76593f0b
SHA512 ac720d697f6f196139b00f9f0f34791fa973bfc9d33ebc142a1e75228c558560ec160695839b01e0166368df5e9ad6c0564a6f264a2b56fcaaf7e7bab4f9c82e
SSDEEP 192:wsvzsNPPvQQTVM72rJQmiU1lij4MTQv+FdLYxTkFd3EB8v1ODqI2UA/Z:5zsNPPvZT27QneMQdExMdUqON2UA/Z
TLSH
T16E72D8F158E75836D99E6347A37D2E035EBCC16BB9842A50B7D81B0CCC9A27FD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 6ab77ad96500b24c869bb334b44644a8dd2552ab9e9ee08d9f9ffed1712ce431
MD5 2d433ebc56f2a34cb1b8bc077fece629
SHA1 e195bdb258b1c6bb8feaae40df896e5da9d11e8b
SHA512 b26dffe72c4abde486646edd6aebea3f8c6e422b14ab52713f5eb3644771a235a9d1c8e7fde1610f30f3bc92c9143a247ede5f11102e0f76eada047bed20e343
SSDEEP 192:kONq6vMdPQmiUy0TchTQv+FdLYxTkFd3Ev80IODqI2U/u:kONq6UdRRc3dExMdUAON2U/u
TLSH
T1B8122B31A864AC676D93B546F08A36135EF4826BEAC56B50F6EC3F1C01DF65C130AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 d1c148350f5eb8a760a7665c8a0fc5dcf37edf166601f6b7e03a42b53b181e3c
MD5 6be40e9fb6c904f5e5ba7ac8ad6c1ab7
SHA1 5349a0d36fb407d3addee23dc52c60cec9e920ab
SHA512 0280f583fc92d7bfb72a336b49552e8d0c84db220d76de639a221957acbe72c67d042a51edb935b43f07c93bbd7ec6c987d5abd8d3e77d6d7d0cbe080cff883b
SSDEEP 192:WLsNPPvQQTVM72rJQmiU15ij4MTQv+FdLYxTkFd3El8z1ODqI2UA/Z:8sNPPvZT27QnSMQdExMdUSON2UA/Z
TLSH
T165422B316C64AC775DA7B546F08A37139FB4816BDAC52FA0E6EC2F1C01DA69C230AD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1a4002aa-c7f7-488e-926f-6776f5425b2b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1a4002aa-c7f7-488e-926f-6776f5425b2b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7d9b2978ddd28e989ccc396612b1f4009afdfe629f8b38c7845c7f047b579d5a
MD5 bdaaf7b4144ddd9ea331a26183cab508
SHA1 465dd3270326af9a80e6c57243fca6cd2d65be2a
SHA512 0b41b115d6838e1cc4f520b71ed26b8c19606697c9fb7cbe0c978723359dbfa71cc0fb0cea2252ddbe15ebaf137e008ddf052ccd03ce143921c545a3b1c28975
TLSH
T1C9413768B6FD1118B3B36E56ABFBA46D487BB8732E17D15E00010D4E0A23A00DCB1733
MD5 SHA1 SHA512 TLSH

Submit Download