hxxps://github[.]com/ObM2/ObM2Pro/releases/tag/v4[.]0[.]4

Analysis

max time kernel
899s
max time network
877s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 16:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/ObM2/ObM2Pro/releases/tag/v4.0.4
Sample260820-vf7g7aef35

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4796	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317186421789208"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{9DBE0786-EA59-4DF3-A55E-684A1E09B3FD}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1716	msedge.exe
1716	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 5164 wrote to memory of 2352	5164	msedge.exe	89
PID 5164 wrote to memory of 4640	5164	msedge.exe	90
PID 5164 wrote to memory of 4796	5164	msedge.exe	91
PID 5164 wrote to memory of 4640	5164	msedge.exe	90
PID 5164 wrote to memory of 4640	5164	msedge.exe	90
PID 5164 wrote to memory of 2176	5164	msedge.exe	92
PID 5164 wrote to memory of 2176	5164	msedge.exe	92
PID 5164 wrote to memory of 1460	5164	msedge.exe	94
PID 5164 wrote to memory of 1460	5164	msedge.exe	94
PID 5164 wrote to memory of 1460	5164	msedge.exe	94
PID 5164 wrote to memory of 4904	5164	msedge.exe	95
PID 5164 wrote to memory of 4904	5164	msedge.exe	95
PID 5164 wrote to memory of 4904	5164	msedge.exe	95
PID 5164 wrote to memory of 120	5164	msedge.exe	96
PID 5164 wrote to memory of 360	5164	msedge.exe	97
PID 5164 wrote to memory of 120	5164	msedge.exe	96
PID 5164 wrote to memory of 120	5164	msedge.exe	96
PID 5164 wrote to memory of 360	5164	msedge.exe	97
PID 5164 wrote to memory of 360	5164	msedge.exe	97
PID 5164 wrote to memory of 4232	5164	msedge.exe	99
PID 5164 wrote to memory of 4232	5164	msedge.exe	99
PID 5164 wrote to memory of 4296	5164	msedge.exe	100
PID 5164 wrote to memory of 4296	5164	msedge.exe	100
PID 5164 wrote to memory of 2140	5164	msedge.exe	102
PID 5164 wrote to memory of 4188	5164	msedge.exe	106
PID 5164 wrote to memory of 4600	5164	msedge.exe	107
PID 5164 wrote to memory of 4676	5164	msedge.exe	108
PID 5164 wrote to memory of 1824	5164	msedge.exe	109
PID 5164 wrote to memory of 1824	5164	msedge.exe	109
PID 5164 wrote to memory of 1716	5164	msedge.exe	111
PID 5164 wrote to memory of 4964	5164	msedge.exe	113
PID 5164 wrote to memory of 472	5164	msedge.exe	112
PID 5164 wrote to memory of 4964	5164	msedge.exe	113
PID 5164 wrote to memory of 472	5164	msedge.exe	112
PID 5164 wrote to memory of 3120	5164	msedge.exe	114
PID 5164 wrote to memory of 3120	5164	msedge.exe	114
PID 5164 wrote to memory of 3452	5164	msedge.exe	115
PID 5164 wrote to memory of 3452	5164	msedge.exe	115
PID 5164 wrote to memory of 2692	5164	msedge.exe	116
PID 5164 wrote to memory of 2692	5164	msedge.exe	116
PID 5164 wrote to memory of 4056	5164	msedge.exe	118
PID 5164 wrote to memory of 4056	5164	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/ObM2/ObM2Pro/releases/tag/v4.0.4
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c8,0x7ff84538c188,0x7ff84538c194,0x7ff84538c1a0
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,7425115787862700329,1735957992384853209,262144 --field-trial-handle=2344,i,10235459318314374022,7121405092095802402,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,5448635477720951828,7064531134204005323,524288 --field-trial-handle=2344,i,10235459318314374022,7121405092095802402,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,13004751683753889181,15334440788025548431,524288 --field-trial-handle=2344,i,10235459318314374022,7121405092095802402,262144 --variations-seed-version --mojo-platform-channel-handle=3220 /prefetch:13
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3648,i,1558491724976806581,18414095486258482501,2097152 --field-trial-handle=2344,i,10235459318314374022,7121405092095802402,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3652,i,662075182948031422,8412784661351593833,2097152 --field-trial-handle=2344,i,10235459318314374022,7121405092095802402,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4324,i,10189519015611516734,9138190836612802028,2097152 --field-trial-handle=2344,i,10235459318314374022,7121405092095802402,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4360,i,13113108010140294871,15414439478896336207,2097152 --field-trial-handle=2344,i,10235459318314374022,7121405092095802402,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:9
  2⤵
  PID:360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3820,i,9929988388262410772,11036902263746245410,524288 --field-trial-handle=2344,i,10235459318314374022,7121405092095802402,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:14
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3844,i,3072996627369070938,1080068257765917038,524288 --field-trial-handle=2344,i,10235459318314374022,7121405092095802402,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,11017227228727569917,2231498542715064638,524288 --field-trial-handle=2344,i,10235459318314374022,7121405092095802402,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,11017227228727569917,2231498542715064638,524288 --field-trial-handle=2344,i,10235459318314374022,7121405092095802402,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,10929738703442419325,4495091085545565712,524288 --field-trial-handle=2344,i,10235459318314374022,7121405092095802402,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:14
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,1204812311680906648,17054567105157827368,524288 --field-trial-handle=2344,i,10235459318314374022,7121405092095802402,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:14
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,4994618832649760298,1243546149018021502,524288 --field-trial-handle=2344,i,10235459318314374022,7121405092095802402,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:14
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,7606995108711315746,3791623156139087347,524288 --field-trial-handle=2344,i,10235459318314374022,7121405092095802402,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:14
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6196,i,13851064481947499920,9438991586852728608,262144 --field-trial-handle=2344,i,10235459318314374022,7121405092095802402,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,6327486329430946930,15217685827721540338,524288 --field-trial-handle=2344,i,10235459318314374022,7121405092095802402,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:14
  2⤵
  PID:472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,306634959151637478,14299923886697922376,524288 --field-trial-handle=2344,i,10235459318314374022,7121405092095802402,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,15468506667346070599,6365487551381392515,524288 --field-trial-handle=2344,i,10235459318314374022,7121405092095802402,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,12916415832448391337,17858883537171738873,524288 --field-trial-handle=2344,i,10235459318314374022,7121405092095802402,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:14
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,2733305234999148845,18287692092580605492,524288 --field-trial-handle=2344,i,10235459318314374022,7121405092095802402,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,5744363843449675999,4971534863393265374,524288 --field-trial-handle=2344,i,10235459318314374022,7121405092095802402,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
  2⤵
  PID:4056

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1304

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:2576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

6af8ffd2-03be-4518-bb49-27c67536f0aa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6af8ffd2-03be-4518-bb49-27c67536f0aa.tmp
Size 23KB
SHA256 f8b4d0593fa7b3503d72fd8bcdc2e139b8c4e8c71fad72df14374d3a29ab9571
MD5 2dfd6e7a238116a49f22882208106e20
SHA1 52d1011f660b75f6ab509cb10dcf6f36d381c500
SHA512 d98a5448f37f9a0291749ef52c9268a8c5e1429b3631d5a5040cd508970c174e7d5165b30e166ad702b0fdd0dfa9d2bdc56c0ee1b78a48e9c40bfca1f65be34a
SSDEEP 384:jjm+vhKfCtgQCFf4+KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVmC9qyRvZroZSS:jC+vhQWgQ+f4+8F1+UoAYDCx9Tuqh0Vv
TLSH
T18DB2DA2B600DCB7F4F800AADEC196FD76DA802CB96589D4047FED94C02C77EA92194DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 9beeb379dcdcd89de1121327a8b379ab342925f7e835912a5d393c57fbc7a750
MD5 84b7e35f1024d8e7685d335b44c19216
SHA1 cea0f910a630aada664c08df9a04237d3df9f3c8
SHA512 b138e8747082b9cc05769cd4a582458bb03808f5ac032d59c707b2e3cf1ab6723edcbe38b61f5b30c7e8fdfe79afa3e39b10f7b2bcc3e20c2dcc8b9447e0d234
TLSH
T173E07DC906CCC22EE708644B536C678CC380360BD3CAED2E27008D847009945F3E67D4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 511d5cedb8ce6a65c2eec41689c61e6f87cd15ca1917bfc905f9f504fbc05d0c
MD5 3b4930b29ee1cbd0abd44ded8db7ce19
SHA1 688f8b4cc12666c1417d4433ff870b06cd78bf03
SHA512 e7a2fb7a7311fcdab3d47701cd255ca42d3a5f5214b6829cb56efb777453fa98124811c19dfff8505db9a07f26d302fae3fc13e07959e94a626c624457e86134
TLSH
T107E026A509DCC36EFA006887937C6B8FD280361A96C8ED4A5B0084887482844E6EA691
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 5d727399db11cb5c96b669defb840cb7dc56abc5d6dec49f26e820fa5f5947f6
MD5 45aa40829ffed6d3129bb8e3a9d98f19
SHA1 958b6cc9a42edfed6d6653af8194d04cfbfa7cc0
SHA512 fbb9ba1a71cdb1d22fe56a4cbeb2e7001341f116433e599a8a29c9903f3604502a726e415792e080289f2f3de4876ce824422bf68614bd67ec853778978301cf
TLSH
T10EE0268405CCC22FEA10B44752AC630DD2C0360AA2C8EE0AAB98888C7402840AAC6A98
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0ccda824aeb1af9528836203a404f5f4f263b4208f909203a585df5656075b46
MD5 f174aa40efbc15eef4f937a3d26aa983
SHA1 a68dee63c170c53a282484cf23780e9c20bc3116
SHA512 68257e8eb8558ca808a0359d4cb8015856033c0aafe6b305b08c26d160770c48a9e918626cadb041d1c1c53159962a6492592a706e80dc17ced253fcbb2d39ef
TLSH
T10F71E882232C16D1DF613EB256D13D4832FDD07B9D836E8A7A006E386E05F795AC14D3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595e62.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595e62.TMP
Size 2KB
SHA256 3a658f551c6e51bfbc1e60cbda26932dd2c4a88e2e9c3ef6a71db3ca55a33e08
MD5 7abb79f53507bfbf814667626f0a559a
SHA1 556456d7b0a2e34e9a1ae01229833e7287f5deb2
SHA512 c35c7724a6ac0b4000d78c95baac6124db10a65a3385d5af68f51caf77a3edad6530bc75e8f16eaf82f066c0a1137752a6e9891bdc5d86724fd407734690f63e
TLSH
T14C41A482532417D1D7A14EB365E1B65832FCD0BD8607AECA7A002D7CAF05F389BD1463
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 9f227f3a5b3978ddea49b29e1ac862fdc695787f2c8a3d28fdf0c57ac8cdbed1
MD5 fb228bf9f29dc07a54257f3b1b057935
SHA1 38faa90a7b70db59053e00956b7daedb0893acf1
SHA512 1ac5ff8f1eaf53ae6b685bf31638378db368002e8e7d818a9642a9c98cc8796c19125451152ea59f199f3eafc149597b6346b5e3878af83a40cb4c6a55dbb524
TLSH
T158515AF747B1956D9B1196F0AA08EE1FCE6C0121831C78B985E06E27D3E3872E041B6F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c1e0d885a134cb9bccc8319f15636205e0191f0f104e601d0b7a2ed4878d3227
MD5 80ad0b9adb286c7eae7ab3d5032d6f61
SHA1 39319af859e5a203507f8170d740a0f7ff70bd00
SHA512 23b2f35fbf4ee84e1ed69422f6d0b8e8c8ee881a5c07ac3687ebc50e27e51ef5a9a0731a701c094084d59b9225c06e7cf2f77f6907f56a64745010c1540cdf47
TLSH
T134516AF787B5956E9B0295F0AA08EE1FCE2C0521831C786A89E06E57D3E3871E041B5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2475fbe170578ac574ff77f4441a6bb338c2ad1d146dfe0c0ee597d251bfabe7
MD5 aa790116dbff43d4b40ec5d2b6cc195c
SHA1 6c4d8d44972a16054996e36ec8622d6ee056ac97
SHA512 ca909b4277461c4b13533801de80fdfc47bfb5444bfe252fde81a692483f234790ded42fad06643578edab21dee7f76d09747f4f62ba9933458a3cc2a1750c78
SSDEEP 192:sxRbRObT/fgs6nGDde5lSWqzoD8pyVM/g6+WNSAx/YCFnuOFGEkIgDzJ:sxRbuT/fgs6nGc5llWn/5f/xrIh
TLSH
T1DE42B4166928A93B8DC7E219BB56BF53D3F91033A1D05E49EAFC8A1C01E77DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 48fd0f78c1998574536f1c671cb88057db9a65d13474840f1c7ac8d16777a50d
MD5 2ae3556c261d413950fb1a60649d12d2
SHA1 b7dd7396251e8ce101e58a88b2272f6d90029996
SHA512 05a58ad0d0df1b5a0784f6e262ef3c42ae99f88f612db73e940df047c1bc6836586f5d2aebe77f7283ea5d63e53617f7ebccc22499fc3fb9b8845d3ae27faf38
SSDEEP 192:sxRsRObT/fgsgnGDde5lSWqzoD8pyVM/g6+WNSAx/YCFnuOFGEkIgEJ:sxRsuT/fgsgnGc5llWn/5f/xrII
TLSH
T19842A5166928A93B8DC7E21DFB56BF53D2F91033A1D05E49EAFC8A1C01E76DD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 292f0c7906a245cd68c843a5e70a18d3f582d18d7f2145c41e020204552ed498
MD5 815aa28fc3b8493b167869fb5979b075
SHA1 6e361ae18e69cdabbf140944b8d0fb753b46bb23
SHA512 8d50d9bacb608659f66e255b77bbca19c7230548d3505ecb36c05482ab2cc1eb0ec6c179a1d508b6eecd7057728f1145aa7303d39b87fa3fc828704cc8e00a41
SSDEEP 192:sxRbRObT/fgs6nepDde5lSWqzoD8pyVM/g6+WNSAx/YCDNuOFGEkIgDJJ:sxRbuT/fgs6nepc5llWn/5f/trIf
TLSH
T18042B5125928693B9DC7E219BB56BF53E3F91033A1D05E49EAFC8A1C01E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8429f823-d194-4616-845e-b2b1be05f88d\index-dir\the-real-index
Size 264B
SHA256 e8865454080db442beb87f51650cbc47cab842c6bd94eebf0c81b2a5e157e08f
MD5 7766887f8f4b472f137d6e5ea6c1aa3e
SHA1 97247cddb80228413724450fd7b48851478924da
SHA512 81ccc8e036585248f85243f943664d961739ee1277f60b72dbaed8421caefa1ec628c67a2cd920ca37bb0cfa0ee05ac4e60f3e3838196044dae9767fa3b175e6
TLSH
T1EFD0A7994C629583CA2A543505733515373A06FC30026A2910AD141D995566C6046909
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d96b5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8429f823-d194-4616-845e-b2b1be05f88d\index-dir\the-real-index~RFe5d96b5.TMP
Size 264B
SHA256 1f44fc2232bed3cf79201048dd5c935231f6bcbf5df87dc5e88ec11da9885703
MD5 500380fbd5fb8cccfe3b4a51388f0669
SHA1 f8cd46edd0effa191e294f3b5396d4d425c0c00e
SHA512 22ce887c9ad9ef448458e7a4c20b40ce298740b65b0a13411277f82f1ad9c76e81f7445ab7aa2a3340a7bddea5e1740181392fbef1f2c93a41b03d34eb56822c
TLSH
T19FD022CA44A0AAE2DE2B2C382003291A33BB08243412AA2510AD142F4C206AC448320A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 ca246262a95f3bc47aa3ae83dfd8aa1e459630c8fbc2093acadbfd2d9d4cfc88
MD5 df5a0b16757f819148af670b48ecf15c
SHA1 54784613f4557b0f59de8bb87708e36eac489c2a
SHA512 59f25998ba2cfa42757d54961997f0b91ee92fb0d07eefd3aa8923bdcf369320c4fde620afe75d7e81edc58b017a4307dcaf6bcb183e8155c8812874d03dbc74
TLSH
T150E0C0BB2DD72814FC5FC3D5143254F0010E3459DD07BC8F0115E6C324B2381344AC62
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 32b97fb1417fed3328ccbafd8e2851ce0c0ccd2d1aa6b50b6dd23d13a7415f16
MD5 198f3326f407b611d8798528bbc9096d
SHA1 22bfa50bf2b263de5ae719230e28c6785a21780d
SHA512 050f7a576980bc10344a4bb7cb346857ba426cc1e70aec7a0c9ac4c7920fb4dddeda78a4e44e74b5533b321674ec56632bdcd5d05fde3b115eaadf7de596cde6
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHyX+SkE0SWcJhgCSK4Xg4ScCqRwSbHYp8o:CbEBVj5JAdSp9/EgTK7j6dJOHyX+SkEV
TLSH
T1F3914600313B02C0383DB95CC1B99C6E86C174727416E66B3FA945AA4F67E479EFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

0f2e8769-7f54-417b-a46a-e5d50db28f19.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\0f2e8769-7f54-417b-a46a-e5d50db28f19.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 695fac67fe77b420b04d4996a17880e4ca5621e139ff161f89e7002867802bef
MD5 202ce5d9addaf1a4dce513a173beba01
SHA1 9ef17f289c90becd6c71c09403314b0dbe076c2b
SHA512 6269f177144438289680d0d4127fd87631498a5b384eebeb0c2e1d266febf8f646221def5f1c624ee615b02c1244a694705aba7ac41e136a063e06430721026d
SSDEEP 768:Ep3qT2+4IFp8+p3bd66j+4BRv86aLIWx3fU7:Ep3qTnT8+p3Z6n4yrfU7
TLSH
T1E5F2BFB2E8A89C374CE5C744B2463B436FF4512396C41ED498DDAB1D059B1AE130BC3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 6de8bfa353ef5169966943238aacf64f551a2effeb64ae31ebe312cff820812a
MD5 a5a6c66ca9dec037ab83b04756393b78
SHA1 685672f6273653f8c7e466fcab9a2ee91d16ea32
SHA512 7439a7b8869400894acfb8e3e76421ba1dc05b16ae378068493342704728700cde37c65fb5b3996de78d9a0c55dd4a8ed4acaaed84e1f645a903b6f1c15ec47a
SSDEEP 768:krv+4UNbdD3dpM4INp8+p3bd66j+4BRv86aLITx32bwCl1:kbsbp3dcL8+p3Z6n4yg0ww
TLSH
T15703BF73E8A899339DF2CA44B1467A437FF8525396C10AD0D8DD2B4E419B1AE630BD37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 b3c347246f222bcb64014d8c3475c9d34c9aeb27cdbca6936e86dbbb8cc79148
MD5 ff298ae99180abf588db7493f1bdef73
SHA1 517cbe422bf53dcd829b5c37b20029873260e2b9
SHA512 d3cad3e37f274282ccd5f18f6dcbb1a9c35607349fa5640b2eb1e7222d7fd09b8e4c86c06fe0aff49fc3352c6084ec361fc45d711a13cccefb60a0c458c8b7f3
SSDEEP 768:Wp3qk2+4IFp8+p3bd66j+4BRv86aLIWx3fU7:Wp3qknT8+p3Z6n4yrfU7
TLSH
T1E4F2BEB2E8A89C778CE5C744B2463B436FF4512396C41ED498DDAB1D059B2AE130BC3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 370b34ee4364976dcf66ab2e7e388331fe1b979bbec51d6f7131175f52c254bf
MD5 3250220816eab51b60845eba79813728
SHA1 5ddc3cd6751898d4020e84fea2b35144a6db83cc
SHA512 8cd9ec32000c792c6c5b3b8d6015c38eab7b0b24cf23933a5d5eb6e8e757bcdbb846ea6cec40b30bc9b0b6e8c2acb13a0248ea4f3918156291b42a9e74be383f
SSDEEP 768:yrv+4UNbdm3qkb+4I3p8+p3bd66j+4BRv86aLIWx31h:ybsbo3qkg58+p3Z6n4yr1h
TLSH
T1D003AE72E8A899779CF2C644B14B3B437FF8515396C01EE4D8CD6B4D459B1AE230B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 45df2c929e6d61605a50df5df244ae3eabe58cd30d9c618ad844139fa2a97bb3
MD5 cded7ddd00100e838d2c1c516199552b
SHA1 10213c36424d620ad6f75b528cf1059e75188348
SHA512 084ef2579607b44517408b1f1b9ef4f2c550cce5bde6293312776707117911b7714d71c68ae54df44a6c1c72f7ff7bf1233967343ea077d99646d0c88d56b1a5
SSDEEP 768:XFQ13qrwgPb+4Rp8+p3bd66j+4BRv86aLIWx3fU7:q13qxn8+p3Z6n4yrfU7
TLSH
T15F136AF298D78836CCADC747A37E2E025EBCC163B5845990B7C95A1CCD561BFD30A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2b0b48a4f4d4e0209f49ad556514dd7d0e6dd7d873cf9e6d0eeda659e1ec158d
MD5 065d4c9d2a41bba67a326933e4790429
SHA1 5aac5cac50b04ab166009f3ab03834b6daa4599f
SHA512 65032283094347e0c759628e9604e34a5c355652602173bd1d56fdc7367ce069edc1ac568fd6baa31db5d51f62cb2f55ae30f2560d1f823f9eea45a6d51008ae
SSDEEP 768:Irv+4UNbdD3xcONp8+p3bd66j+4BRv86aLIiJ2bwCl1:Ibsbp3pL8+p3Z6n4yn0ww
TLSH
T17A03BE73F9A899339CF6C644B24A7A437FF851A396C10AC4D4DD2B4E419B19E630BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

93be8de9-435b-49f4-a98a-c4aac9c10b7e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\93be8de9-435b-49f4-a98a-c4aac9c10b7e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download