hxxp://costamarine[.]com[.]br/rs-plugin/assets/loader[.]gif

Resubmissions

10/08/2026, 23:28

260810-3f66es1dng3

10/08/2026, 23:06

10/08/2026, 16:02

30/07/2026, 05:35

30/07/2026, 05:17

Analysis

max time kernel
899s
max time network
834s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
10/08/2026, 23:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://costamarine.com.br/rs-plugin/assets/loader.gif
Sample260810-23ffjs1brc

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3560	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308767982641295"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-101591186-421676486-4137282292-1000\{1DBC0CEF-E9B1-4557-8FB1-FB5D90518091}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4272	msedge.exe
4272	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 4240 wrote to memory of 3856	4240	msedge.exe	82
PID 4240 wrote to memory of 3560	4240	msedge.exe	84
PID 4240 wrote to memory of 2208	4240	msedge.exe	86
PID 4240 wrote to memory of 2208	4240	msedge.exe	86
PID 4240 wrote to memory of 6140	4240	msedge.exe	85
PID 4240 wrote to memory of 6140	4240	msedge.exe	85
PID 4240 wrote to memory of 6140	4240	msedge.exe	85
PID 4240 wrote to memory of 640	4240	msedge.exe	87
PID 4240 wrote to memory of 4944	4240	msedge.exe	88
PID 4240 wrote to memory of 640	4240	msedge.exe	87
PID 4240 wrote to memory of 640	4240	msedge.exe	87
PID 4240 wrote to memory of 4944	4240	msedge.exe	88
PID 4240 wrote to memory of 4944	4240	msedge.exe	88
PID 4240 wrote to memory of 4704	4240	msedge.exe	89
PID 4240 wrote to memory of 4704	4240	msedge.exe	89
PID 4240 wrote to memory of 4704	4240	msedge.exe	89
PID 4240 wrote to memory of 2448	4240	msedge.exe	98
PID 4240 wrote to memory of 2804	4240	msedge.exe	99
PID 4240 wrote to memory of 2448	4240	msedge.exe	98
PID 4240 wrote to memory of 2804	4240	msedge.exe	99
PID 4240 wrote to memory of 5220	4240	msedge.exe	101
PID 4240 wrote to memory of 2020	4240	msedge.exe	106
PID 4240 wrote to memory of 3440	4240	msedge.exe	107
PID 4240 wrote to memory of 4416	4240	msedge.exe	108
PID 4240 wrote to memory of 4284	4240	msedge.exe	109
PID 4240 wrote to memory of 4284	4240	msedge.exe	109
PID 4240 wrote to memory of 3864	4240	msedge.exe	110
PID 4240 wrote to memory of 3864	4240	msedge.exe	110
PID 4240 wrote to memory of 4272	4240	msedge.exe	111
PID 4240 wrote to memory of 1760	4240	msedge.exe	112
PID 4240 wrote to memory of 1760	4240	msedge.exe	112
PID 4240 wrote to memory of 1068	4240	msedge.exe	113
PID 4240 wrote to memory of 1068	4240	msedge.exe	113
PID 4240 wrote to memory of 2200	4240	msedge.exe	114
PID 4240 wrote to memory of 2200	4240	msedge.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://costamarine.com.br/rs-plugin/assets/loader.gif
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2b4,0x7ff9119cc188,0x7ff9119cc194,0x7ff9119cc1a0
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,9944371840228931127,16792884298348491905,524288 --field-trial-handle=2696,i,11549857103268183856,11251963410600258951,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1760,i,17474468625734373730,9673879113909543335,262144 --field-trial-handle=2696,i,11549857103268183856,11251963410600258951,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:2
  2⤵
  PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,6486050182258434907,17873425509173251056,524288 --field-trial-handle=2696,i,11549857103268183856,11251963410600258951,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3404,i,17452236228463491756,14794506227989000311,2097152 --field-trial-handle=2696,i,11549857103268183856,11251963410600258951,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3408,i,2707080120327582505,13794814283616932862,2097152 --field-trial-handle=2696,i,11549857103268183856,11251963410600258951,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4932,i,18044140856727576170,7202885934702116717,2097152 --field-trial-handle=2696,i,11549857103268183856,11251963410600258951,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,3748732955746623968,12031077315337568963,524288 --field-trial-handle=2696,i,11549857103268183856,11251963410600258951,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:8
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3516,i,17628087543107564021,12863941151577184296,524288 --field-trial-handle=2696,i,11549857103268183856,11251963410600258951,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:8
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,9934890761716454518,6544682761620547411,524288 --field-trial-handle=2696,i,11549857103268183856,11251963410600258951,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  PID:5656
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,9934890761716454518,6544682761620547411,524288 --field-trial-handle=2696,i,11549857103268183856,11251963410600258951,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,11976870285587291456,18030153884176940049,524288 --field-trial-handle=2696,i,11549857103268183856,11251963410600258951,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,6700637492960563734,16390823422343363364,524288 --field-trial-handle=2696,i,11549857103268183856,11251963410600258951,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,13345470966146856886,16924108202813508940,524288 --field-trial-handle=2696,i,11549857103268183856,11251963410600258951,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:8
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,12666513075969359873,5670532210898859749,524288 --field-trial-handle=2696,i,11549857103268183856,11251963410600258951,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,13647675932452648827,8237897221897512,524288 --field-trial-handle=2696,i,11549857103268183856,11251963410600258951,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3652,i,14515666898102308654,4907356187335388385,262144 --field-trial-handle=2696,i,11549857103268183856,11251963410600258951,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4032,i,16949572156222472658,3714014319739915743,524288 --field-trial-handle=2696,i,11549857103268183856,11251963410600258951,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2952,i,10549303352801418314,12795462469340065515,524288 --field-trial-handle=2696,i,11549857103268183856,11251963410600258951,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,8875842302946850361,3572765766018615633,524288 --field-trial-handle=2696,i,11549857103268183856,11251963410600258951,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  PID:2200

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 35cc5409a0e92c7b1f173401d1114c9d5fdc977752a8e45ce9068d8101c9a651
MD5 4177a98ec95c7b8511089a1be66e9e7b
SHA1 523d632928047252508b7d45169327ef4523179e
SHA512 d9e67625f1cfcaf9b90149a3ed0ce8899f43e93e14c729f7cf114adedf8a6a345c93240cebfa58351038924578a437d9d7144c7dcd826b1b8892dc523920e947
TLSH
T17AD08077670FF411E36D5131D503C75117AE547179625723F118C40D99741D693C51C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9e9b606cfbfc7b0fcbfab1ff9a90d94ddcf0c4033903cc47f13cbcd8bcac95cc
MD5 66bd1dbef8b4df50e7a09a2d2848fb79
SHA1 69983a576369225e69f3c4e38eef011e7e436249
SHA512 7f8546014287d3ced2b59766b273c8d8981aee3ef643630332615e594a89f92a95f1ce112c2fa889b0e249a10643792bfc57043bfc523d6ada97b8bc7d6e7d6c
TLSH
T17CD080776B0BF411E35D5131D503C75127BE507179625723F158C41D99B41D697C51C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 aa4e0e59f2547f59a3725a1313acccbf93e5310df255f0a108118a337dab769e
MD5 9da3be6d96d44337edf8303787442946
SHA1 a705b3680c3b996df7c590d07dc93759b42a23f6
SHA512 7326e8cbffafaf19576e0a4d7e3d1778e417377a7ab36c6efc673b0cbbecbac7e4fbea6b86b5a0dad3e939b386f01ac0078b922815bfb7f42f0f9f25dd96ec4b
TLSH
T10CE0688C03DDF7A7AD808247E26883E58884321391CDFE5932466094188104ACA530F8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 f608f581fcee5107d955ee0042dcec8fde1b9e0cec97979253d47e824f67b550
MD5 d475806dd37f53e16cd322f056911041
SHA1 7614711e200cbb18c64df034106a15d9f76aa9ed
SHA512 0450c0850deb04772f55df3550b0e335a6fd64bfc41d835f674f28bd988587aefb25db881520046517bb6109c980d04974d32f74666a8046c39be461ef54d1a7
TLSH
T1AEE026C444DCC31EFA81664B527C478C8380370BA6CCFD8A270689843082284AA8BAB0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 081c06d9aa2555d821eba0e0327b5009907899c5fa3d171c9dbedbf25593b13d
MD5 79cc17973e08860712fb6dcff0c969c1
SHA1 01ad800fe49ec4505557be6c2b934c5d3dd6d1e2
SHA512 a4a5ebda2462570f557e681fa87167f154aeaafd995c87245846e25697a3ebf2b4eccb9f8a2c60f8ced939f3f118d9d74ae32f9b2e9809dfd0651cc048fded83
TLSH
T198E0268406CDC35EEA407647757C434C8AA0B60A9BCCFD4B27448A843141190BA83EF0
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 268B
SHA256 ae99fdfc3fbac7deff206af98556f3993f1c3f40fe1176939f3effc93833bc8d
MD5 9683ee0effa2bfca240118d3a9a92e68
SHA1 7f5846f3cd2adc8fd0788f67733e1a66a9a4502d
SHA512 063dd8a1a4838b395fcd50939ca3e5b24ac72a8407ffd4463838b0b2ee5bb8d41938609e4216ead91f6f1a45a694113987c815ba88fb7d83f6eb6cc2fa33d737
TLSH
T194D02B9AFDEC9E5ED7E41ABD5BA5B4000A4802A2840B9B1300747EC03495AF01E25030
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 cc490bc88570ca3882f588adac0ec772a0ae77a6f2b2a3f221479ac405c5aea3
MD5 e8a62d2812edfa4cdcdd3e54f393814d
SHA1 b456ef571067918b44821f1970c99d37d5cb3f0c
SHA512 568a468f4b7be0ee5041418c835b2559372474018d8429e9cc67cd9effe98791692158c4c663f0cbc5fb8201b94c522a335857bb18466ba21a766773bb65301f
TLSH
T175E02BEDC922AC3745FD1B1C64150746D704031B2E40AA6F3A3D511C8FB173B1686C5C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 7e1aa88cefa654f5f7539acfed183f0f2349f28be9f3866153c585919da8450c
MD5 01ded61f2c262a0843635f3215fb3dde
SHA1 673beae697f1e051c3b1015e02f472d9556fc56c
SHA512 f7f4b6f3d1e339ca44162e4b762b6d079df5d9976ef6cf683764d4285f4acaae498be6c749b2aaebfff2347fe9e7c74ca0924b8190c24e37e853c44c4bc19450
SSDEEP 192:sxZlRCyMqZjK1Ml8UQ2ku/fwsOTuo4tgUzodpQ9HW6+WNxML/YXDHyl7EIg5eV8J:sxZlnqdu/fwsOCGgHbu/yW0Sg
TLSH
T17862F8156A38997BCCDBD60AF9417B93D7F94533E1905E44A9FC9A0C04E7AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 33a391965bb825fae1d2497f21874e02decd5b8ff9cdf8aebc5e72f48bfeb07a
MD5 f507ff5bd5c06654fcd9e4a6ca28d6b2
SHA1 a6187c5652047c7037e91a584b1ca96d7dade399
SHA512 3e724b626826c7c781641fa2a424bc9a18388d5a8173091a2139547486c15caa5137487bd38922f981006881decfd8ac7a5b0db4c5c85de6a406a6263478b5dd
SSDEEP 768:/Zk4PXDWvXt4h8F1+UoAYDCx9Tuqh0VfUC9xbog/OViiLl42vJ4roWpN1Z4STU:/Zk4PXDWvXt4hu1jaHiL+QJDWpah
TLSH
T1D0D21B3F680CCB7E4F844E5CEC26AF966ED801CB66988D4447FA494C03C77EB521A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\99755d9e-864c-41e7-ab4d-7cb31e17682c\index-dir\temp-index
Size 2KB
SHA256 5f4eb64591bda09d1eb7c0c4fa889d8412066220df96bbc6566b5b051875e6fe
MD5 7b4704a40b2f24bc9542bc65b22a6966
SHA1 13895ad0a1bf99e87a6172e73ca46ee81bdf4c7f
SHA512 0940303fcd884af95e1f9433c164e5133a5e03d0bfad2d75e965bdb4f9eab6bd86b0ef2fdf4def5df5d8828be31d908868e0d885da1804a3e29453072cce0cca
TLSH
T1F351B78E0D16666BE8F842B310B3109037F088CC2711D5175CFC6235B8836AE2C1B7A9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ca1a6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\99755d9e-864c-41e7-ab4d-7cb31e17682c\index-dir\the-real-index~RFe5ca1a6.TMP
Size 2KB
SHA256 8c04fc817fc679ecc88ae28ccac49796822e6b5eeab2ecf806c5e7b87e464894
MD5 ee87c3ae649e0257ae3b1ad0a1a94308
SHA1 2a6f957b449b00335bb0b199aebe90bc10f8a0a7
SHA512 ddf5910a2187ed223b643db517268c21d00b509675053b27584b7475edc4657f395e39cd4972b1f3da9c2525bd9c6cc82b9bb5921e2edefb175e3532cfd3e2b5
TLSH
T13D51C68E4D42463AD8D441B309D3A4A4373959008719BF5774FC9636BCD23AE3D0E3C5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 0946e93311c1149c6f72d0cdc0e7ef40a9b4db9122dc4acd40228d5c3c1869c0
MD5 fe27e3af06d60259517873e1a9b52cba
SHA1 802c379127a367b36a7e3ecd754dd9ae30730076
SHA512 7d27434d06f189e8858f46ff1d6d8d94075884fdc58f6252b402c6b40f429f32e039d51b3f057c533ce28c98c838f7a946cc4f1f0900c5bd8c0683e7dacb0313
TLSH
T16BE0C0F72CD31D00AD7FC3C1347264510E1135988904BC4F102E92C7B0A16142812C73
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 b186cb4fe24b7d2369d58d266d3140816a6bfd2a3cae7192407a5d5a2d94bfc4
MD5 0b655b3207760a938455035839feb4c4
SHA1 f7429cdec85277202869883e8df25a9638663356
SHA512 a651ee0b5247a92600314f78f8847e1b47c4f7902e06b34ed2a815971425ac61ebb74547ae1f1070ca891761af422a22c82ab8076d8060b8fb50e35e3e30b976
SSDEEP 192:EtjGz7Y1/St59NZp1ZVzDqHgnmz3th9AZkzPr1PVIfPU1UH9R/:EJGnYNSv9PpHV/qj+dR/
TLSH
T1ADB25E13313A03423CBE2518A2A686779E4231B33019EA7F77A944764E67E224DFDDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

b2bea1a1-766d-4162-a9c8-09d7dc2328c1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b2bea1a1-766d-4162-a9c8-09d7dc2328c1.tmp
Size 15KB
SHA256 d3da47b84b66779ac8bc60272c9dbafc99dcbb83a55a0d300924109dce0e9edb
MD5 e104479dfaf69bfb2e699350f0ed2787
SHA1 4c1de321b8b6d531880edaa4c1fab4bf0b12295b
SHA512 13f67d5e74bcf2cb405ae039d5ccde8ac9ab15a4d98ec74e9c6a94c4fc403e3e13d3c1816e776f889c46bef36fc2d35589581be773a6ccdef4673413e1eb5227
SSDEEP 192:sxZlRCyMqZjK1Ml8Mku/fwsmEuo4tgUzodpQ9HW6+WNxML/YXDrynEIgj8J:sxZlnMu/fwsmTGgHbu/ydjg
TLSH
T16062E9156A38997BCCDBD609F9457B93D7F94533D2905E48A9FC8A0C04E7AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 8cc130e794a210f0faa1f2ea8081af950c48c45856d51dc8aa73b1eacdc9ddff
MD5 3ecd72c44a655f3ede228936bddd3ba1
SHA1 8d842daaf9c3de65a391404af2645711ad52bd62
SHA512 bbbcfcc0e154e8c1bcec89efb611c76d6cd147dd01758de2b6d8b0e1bd5efbe539bdb1e0b47bd92e5e35c79a01625a969e8d39a64c0f364efbdf6faf2f55e0a7
SSDEEP 768:OFccpWs3GwgX/wzVVIsOJE2XhkoFYS/v3:qWs3o/c4Jphkoaq
TLSH
T10BE2C3F298D79977E89E4B87A73E2D4299FCC153B5885990B7C81D1CCC861BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 c1f967b524e2cc8dc5a16c8abc1dc29238419c147a277e7a8e0bd1f6cb0921d6
MD5 3c590a34340f40fd14569e8b97fac4d3
SHA1 d8fea69d1f559efc68f48eee98c0aa7e64a1a290
SHA512 47e47f8ed71d5cbf18ab014d40d4bd34183f41c6d5bbcc009cc91b5fcdfdbc7c38cb0815d53aed06dce40caaec2e2e61606e4b7d44771288c203d047cde2dfbd
SSDEEP 768:0Fccpe3GwgX4zVVIsOJEvQDXhkoFYS/v3:ke3oE4JAQ7hkoaq
TLSH
T1ADC25C32E898DABBECE64B9AA64E3643EEE04267C58859E4D6DD1D1C00DB1DD034BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 2fa0e0c4cd6edcfca5f09c69e0fc9b0c721d73f3d8996a795aeb548a930c4734
MD5 8123350ecd4602c7ef05aa2151d00dc1
SHA1 00b59ff189ea3d32230f9348b599f5eee047f307
SHA512 a5f42e53a6e58e3c7a8074d1b459f27901e00f4574416a4bee8eec96423c8d31ce933983018a0bc23f7804058b4d5c726d08048c0c8ebb50898e6eec0a2bf752
SSDEEP 384:nmgiF9CcmyWCs3sNr8TUNTUlImkrzoNmftvwBfgVPtIsOMQPisEhkP+lFYS/71lQ:m7Fccps3kwglzNVVIsOMQP4hkoFYS/vQ
TLSH
T133B25C32EC98DABBECE64F8AE74E7A47EEE001A7C59859D4DAD81D1D00D719D130BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 3edb7a1625f6323e4648e360da7d974c0010451e8ad2db4a5020327c3a2a72c7
MD5 f0ed629370be555a03296ce64f7277d6
SHA1 9142d2771059ca463d203184bc5f93a370efd311
SHA512 aece3da5e39189020bf5f9c01420744b9c6fb3e732be7c8fb01ed05e9e883ab66d3d9caefe24dcbd02f8ed878c62a6a5d8b093e40439023cacfe658d2f5edda4
SSDEEP 768:IFccpe3GwgX/zVVIsOJEvQDXhkoFYS/v3:ge3o74JAQ7hkoaq
TLSH
T153C25C32E898DEBBECE64B9AA64E3643EEE04267C58859E4D6DD1D1C00DB1DD034BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 378b5fd7ff90d1d60a72fdaeb85bda20ac7f362d4d64176e054199aaf97ec229
MD5 4fcafd1b739316e5229dc75e0e41b9fe
SHA1 41d9b219caf39aa9942a3de25f0eeec95453e102
SHA512 d7c4155b6a4878d0adf1189112067f2a47cba6e7607196664a97f36b6ad585b859c867cd377ef1137222513a3c984aed566e5e1beba21f79182d4311419c979b
SSDEEP 768:dFccps3WwglRKVVIsOJEvQUXhkoFYS/vQ:Js3WE4JAQUhkoaZ
TLSH
T157C25C32D898DABBECE64B99E74E3A43EEE04267C58C99D4D6D91D1C00DB0DD134BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4419049233a1e418f32a063ca96ed7a9ba40b3425c276de417ac4a3135d8343e
MD5 5393ec4afa73773a96a518401623e0bb
SHA1 d3cd575aceb0b665eed7ffba3e8fdc80a9e3718c
SHA512 c70e9fefe5d3972bfc8b93e2e29267cab00a751737e63ada8b5c1668ea77aa81522f837d26c6689ab79357fd9a7a3681187cc52eb354696405b8dec51ec42d89
TLSH
T113411C58BAFA1148B3B36E55ABF668AD447F7C372F06C45D00110D4F0663B41C961B37
MD5 SHA1 SHA512 TLSH

Submit Download