hxxps://weao[.]xyz/

Analysis

user interaction
yes
max time kernel
160s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 23:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://weao.xyz/
Sample260805-3b14lstthy

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
556	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304456819249369"	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{CF8FB2B8-2D4B-4E11-9064-C2FB57D2507E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3508	msedge.exe
3508	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
652	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
652	OpenWith.exe
652	OpenWith.exe
652	OpenWith.exe
652	OpenWith.exe
652	OpenWith.exe
652	OpenWith.exe
652	OpenWith.exe
652	OpenWith.exe
652	OpenWith.exe
652	OpenWith.exe
652	OpenWith.exe
652	OpenWith.exe
652	OpenWith.exe
652	OpenWith.exe
652	OpenWith.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 1832	4912	msedge.exe	85
PID 4912 wrote to memory of 556	4912	msedge.exe	86
PID 4912 wrote to memory of 540	4912	msedge.exe	87
PID 4912 wrote to memory of 540	4912	msedge.exe	87
PID 4912 wrote to memory of 540	4912	msedge.exe	87
PID 4912 wrote to memory of 1876	4912	msedge.exe	88
PID 4912 wrote to memory of 1876	4912	msedge.exe	88
PID 4912 wrote to memory of 3468	4912	msedge.exe	89
PID 4912 wrote to memory of 3468	4912	msedge.exe	89
PID 4912 wrote to memory of 3468	4912	msedge.exe	89
PID 4912 wrote to memory of 2028	4912	msedge.exe	90
PID 4912 wrote to memory of 2028	4912	msedge.exe	90
PID 4912 wrote to memory of 2028	4912	msedge.exe	90
PID 4912 wrote to memory of 3704	4912	msedge.exe	91
PID 4912 wrote to memory of 1784	4912	msedge.exe	92
PID 4912 wrote to memory of 3704	4912	msedge.exe	91
PID 4912 wrote to memory of 3704	4912	msedge.exe	91
PID 4912 wrote to memory of 1784	4912	msedge.exe	92
PID 4912 wrote to memory of 1784	4912	msedge.exe	92
PID 4912 wrote to memory of 1208	4912	msedge.exe	97
PID 4912 wrote to memory of 3368	4912	msedge.exe	98
PID 4912 wrote to memory of 1208	4912	msedge.exe	97
PID 4912 wrote to memory of 3368	4912	msedge.exe	98
PID 4912 wrote to memory of 5040	4912	msedge.exe	100
PID 4912 wrote to memory of 2324	4912	msedge.exe	103
PID 4912 wrote to memory of 2324	4912	msedge.exe	103
PID 4912 wrote to memory of 2324	4912	msedge.exe	103
PID 4912 wrote to memory of 2524	4912	msedge.exe	106
PID 4912 wrote to memory of 2524	4912	msedge.exe	106
PID 4912 wrote to memory of 2524	4912	msedge.exe	106
PID 4912 wrote to memory of 636	4912	msedge.exe	107
PID 4912 wrote to memory of 636	4912	msedge.exe	107
PID 4912 wrote to memory of 636	4912	msedge.exe	107
PID 4912 wrote to memory of 1924	4912	msedge.exe	111
PID 4912 wrote to memory of 4176	4912	msedge.exe	112
PID 4912 wrote to memory of 1720	4912	msedge.exe	113
PID 4912 wrote to memory of 1652	4912	msedge.exe	114
PID 4912 wrote to memory of 4428	4912	msedge.exe	115
PID 4912 wrote to memory of 1652	4912	msedge.exe	114
PID 4912 wrote to memory of 4428	4912	msedge.exe	115
PID 4912 wrote to memory of 4428	4912	msedge.exe	115
PID 4912 wrote to memory of 5068	4912	msedge.exe	120
PID 4912 wrote to memory of 4260	4912	msedge.exe	123
PID 4912 wrote to memory of 4260	4912	msedge.exe	123
PID 4912 wrote to memory of 3508	4912	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://weao.xyz/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x28c,0x7ffad220c188,0x7ffad220c194,0x7ffad220c1a0
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,15759313125061457405,6799089489938795997,524288 --field-trial-handle=2296,i,2943290301845543872,10606917972748810421,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - System Time Discovery
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1728,i,1952448685340935490,5886815121449992213,262144 --field-trial-handle=2296,i,2943290301845543872,10606917972748810421,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,11927359754801127046,5036480880240671,524288 --field-trial-handle=2296,i,2943290301845543872,10606917972748810421,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,577257414201691064,2406140094186926066,2097152 --field-trial-handle=2296,i,2943290301845543872,10606917972748810421,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,15884094115494846781,9021037348046959935,2097152 --field-trial-handle=2296,i,2943290301845543872,10606917972748810421,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,8569917454157747635,8016296590460870671,2097152 --field-trial-handle=2296,i,2943290301845543872,10606917972748810421,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,4261310693441356698,7084295407850034146,2097152 --field-trial-handle=2296,i,2943290301845543872,10606917972748810421,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:2
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,3666109646215199910,9896234219136009697,524288 --field-trial-handle=2296,i,2943290301845543872,10606917972748810421,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,1860200708185411666,18107046797572543041,524288 --field-trial-handle=2296,i,2943290301845543872,10606917972748810421,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,15944709461261658992,13623221762925420221,524288 --field-trial-handle=2296,i,2943290301845543872,10606917972748810421,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,15944709461261658992,13623221762925420221,524288 --field-trial-handle=2296,i,2943290301845543872,10606917972748810421,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4320,i,11607212324628360603,3849364571192577574,2097152 --field-trial-handle=2296,i,2943290301845543872,10606917972748810421,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4184,i,5684601169786219256,6106593079934059806,2097152 --field-trial-handle=2296,i,2943290301845543872,10606917972748810421,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6404,i,4912367802776507858,14252073630546177022,2097152 --field-trial-handle=2296,i,2943290301845543872,10606917972748810421,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:1
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,4979800018795464876,13953524630583493830,524288 --field-trial-handle=2296,i,2943290301845543872,10606917972748810421,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:8
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,2074813634895241685,5540249824167184498,524288 --field-trial-handle=2296,i,2943290301845543872,10606917972748810421,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:8
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,6205458988485632530,18395966873630171442,524288 --field-trial-handle=2296,i,2943290301845543872,10606917972748810421,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6780,i,5835544440204278401,5618005891917011636,524288 --field-trial-handle=2296,i,2943290301845543872,10606917972748810421,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:8
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6792,i,12791190142976376688,15568694952872404502,2097152 --field-trial-handle=2296,i,2943290301845543872,10606917972748810421,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,17993137898101834553,1802748695831589569,524288 --field-trial-handle=2296,i,2943290301845543872,10606917972748810421,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:8
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,16642593981119709238,5194977364850253080,524288 --field-trial-handle=2296,i,2943290301845543872,10606917972748810421,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3588,i,8246025952134096405,17317033552184770633,262144 --field-trial-handle=2296,i,2943290301845543872,10606917972748810421,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3508

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3252

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7d64d2777f444a09968d6c155732e22d743fcf7c319c222bc06f6bb97808e489
MD5 89bc5edb6bd922f1cf8ec5536b066fa6
SHA1 c50aaf0fe1444780bb68ee7ab6e1c7468c2f303e
SHA512 77a1265c1484940562f1514202a0072e343efb323e1dcdb979fc9b7a2c69d85b814c076828b260c0b86a19e482ebb0a2df850f9b7c130a327861a7c56e26cde8
TLSH
T15CD02B20BF04E402D1072172540047100E0848902093C241E030441CCCED844D395307
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 17a1d50b3fec27616ca9768d191fec90af7c5697e52efe2193ed4b3f3dbcffd7
MD5 cf5c187eac0ba57b33a6d228736b1acf
SHA1 0936396230860d3f44e6e612fde6d96c598beeec
SHA512 ffb6c300c641543dd388a251daed850cbe00f8e1846d0c8c146f28e0674b954752ceb11cea43108c41184acd05a0806178d7348e154ff28b35c2bf050e4ee880
SSDEEP 48:YzW7RcSlLQkRPxWkCgtbBuaBSqv+tbqq37HX9sT5rtM7J21gFnOgaTlkFi:YzWtjkgtbBuxqvQ37HNslS7f92x
TLSH
T1CE91F83A25D36274EF16867388DD090C36BBC6F3FA175E97984061737A0B36EB2145AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58f17f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f17f.TMP
Size 3KB
SHA256 0fabffdd184829c1005efbedef04695a19534194c6beb86d27dca8dbe586ec22
MD5 6dbdb7f73127cadded2a1defbe75a9de
SHA1 55e24ea2901528c64e22c7cef133e4e0eae382f5
SHA512 32dff626e0cb9d35d2d9d6219c3d1032aa32e89123543e3becdf70d997b77e486dfce8c7403d4d42347af6ef53478e4fe47c325714285ab4695cc5fde86c6b11
TLSH
T1A961C5750A9312B1EF14C63294DD025D3773C6F7FA1B6E8990805A37761231EF3259AC
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 57b4253dc35ddc4ceea44e07125d7d98d27c7b4ede497b285b4388705da34d0b
MD5 c92f5d8d3f2c2837a540687cfb8010d1
SHA1 58a99917a16a24e00429c2287372fe85c55d6ead
SHA512 bb439731be5191052c50e4cd1654c07a4e469ac22be72a8610d0b07020bbb4cb03bf3cef6ce464a370f632e35091b1904cdd2b83d7738d09e08da95dfb146fab
SSDEEP 96:DnOU/dNQ+uNquyzBizimBlfEGqBClyxBGmTuiuIduFuVKwjC9x:DOU/dNJQqF1izi+ZEGqBClkBGmT5BauM
TLSH
T168C19CF3C3E4866ED91156F4AB147E2BCE1D0929432C3C29C5E4EF4793E2870E241A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 216e7b4dc09f604b886b658ff933fec2cc53a0da480ec11ffc2eb19167245d0b
MD5 398ff23f7ba0d1da310af938deeea05e
SHA1 2d063b5dd33e7829e4d581ab5e46039b56523966
SHA512 33e774077682d5b6e7637f7c19872a3e4e49bedd69b1fce44a9363e7b7f8b830e557ac63408651af57d0a4dc11285fde996b12d48c5481a129b95bc0152e810c
SSDEEP 192:sxZD7TRG2yM/jK1Ml8UQWS59WO/f2wsWRdSNDjVGkIdp5olDFDaDGD7HW6+WN0DD:sxZTLq1X/f3s0iE56HbKmXV3m
TLSH
T14962E612A6345977CCDBD20DFA41BF93E6F8056296901E54AAFCDA1C01E7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 9e98ab60b24ceae3b5cc8c07779261e8acb65f6160884525647e385b0076ad02
MD5 18b6565439bf59259259ed044881a4db
SHA1 a1b60197b1eedab32dcf109ab6edba766b14c5c8
SHA512 4b058a6d46fd8ee89abd5a44b9f25f4b41f7dfd84b190bad9a263e4f211896d33c30aa1861b453e724e99759425c9578b236f862a10bcf3789f11edbe63e5f94
SSDEEP 192:sxZD7TRG2yM/jK1Ml8M9WO/f2wsWRdSNDjVGkIdpjolDFDaDGD7HW6+WN0DS6PDU:sxZTL1X/f3s0iEj6HbKmX63m
TLSH
T1BF52E612A6345A77CCDBD209FA41BF93D6F8052296901E54AAFCDA1C01E7BED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 59dc2c9c80b9d5f36c0e2dc6ff2626a499fd3eac7595c49997a7bf9d738d8289
MD5 c25cad1659cfa982ccc147a835890661
SHA1 f60c2aa080c30ec11b5a5234c70097e6a1ace28c
SHA512 0e77cbf35d1ce49387db54ce4485fcbd0ebc58f235c7a9a86f84f3e999e1348968e94186df3146ec2fab1f340afc468fe68652c8c1e30844c71c791ce787d74a
SSDEEP 192:sxZD7TRG2yM/jK1Ml8MkWO/f2wsStDiVGkIdpOD7HW6+WNdDG3q/Yv8GPDPjGt69:sxZTLMX/f3sStbMHbV/G339
TLSH
T1A442F8126A34A977CCCBD20DFA41BF53D6F9056296940E44AAFCDA1C05E7AED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 315bbbf912d4ca904bd36e85f68e53b201f4bfe79620daf70dcc1ee8b75386c0
MD5 5926f6e9632fd0e195036190bb95aeb2
SHA1 63205fcb6730268adee7c585e48db4e61e3c5a3c
SHA512 61180c28985c49daa6597f8ebe1dacee734c092ce29bb03d45ba4b212e62af2004b7c4c298d2a13891b26ea0671f72810d9268ebb722ace8abca27b7a98546fe
SSDEEP 768:9BseJ3xWvhfwn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppirohb:9BseJ3xWvhfwnu1jaVcL88p55
TLSH
T1D8E20B2B280CCB7E4F844E6DEC266F966EE801CB5B984D5487EA884C03C77EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 9128da37a12da8d6b81f24330dfb8510e82cb8aabc24f3c7ed2fc2fbcb99e636
MD5 d2776e0c30da88d0ccb1670f32f85374
SHA1 fab75c98885b146fff9740178d4297219b48b55a
SHA512 b9b55fcca1865fa3abcab3672ef59b0fccbd3559200e89806109d25a0016c373982ea42e1a2268c71e749c1d486b8874903b9aa40025212d36ff111550ce7ef0
TLSH
T171A0022902960841E251A37594439A8C221049310101371247F410B4D852141825654C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587990.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587990.TMP
Size 48B
SHA256 9379a066b319ce9cfac21b333bf9f91971ef3975e48f88114d0e9be822a5fad7
MD5 ea599accb715abff4d26bfe2c9412d7c
SHA1 dea47aee065699e66bebc90c52c0e879128d7a62
SHA512 9bb83f7f37a547c6c9852d81b0c3ffc3daeefdd54d8a4848b9bd43632deb55ee4b457477c28b7808f64d98e9583da8aefded3b59c9921ebc4185ac9f6c999b45
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3a3c688b4becd88c7e4a88fc8dfa8b5072b20d718466867d3e59f7984ec7d247
MD5 61890d8bfbb9c120d056212af5641861
SHA1 78ff1333576056bf7c975c53eceb02f9321782b6
SHA512 62546f636bc9bde4c4a1344d89ed14c17e2b7ef9c9f819254f20af41a6cd363ecd5a857e2be32c07fc7d13f6a45fb90542e13d154cd2ade3ba8cbb0237898190
SSDEEP 48:KYHIhKggkXySdIxK+cMjytng7X1Btk9B2PI2PkKDBbNk/30wW135yj:KYH+KggmBd+K+ciS4AK92S8
TLSH
T16C91640630BE02023C7E294CA691D93B5E4135A37468A4EFBFB861611F66E611EFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe590c5a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe590c5a.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 79a11d87eeecc1350d62100dca6c77f82349a6208ef4da12f930ee4de652f669
MD5 aad9c57335ba87e03ae751c394cbcebf
SHA1 3bb25bc84d303f7206580803398c36d8118b1fb9
SHA512 bbe7c33f6013bfdf64249a4fd7e755844e21b0fcff3672a8647a8f52ab5301014bab408aea520e849cc31f5c4e4d9020235c2f521c3904784c6782c6fce3b0c4
SSDEEP 384:3iFiZcIEzsNy8TUNTUlIlb0Y7ukXczFIKPlJmKE:yFQ4/wgOY3+FxlJmKE
TLSH
T135B23BF248D7883ADDAEA743E77D2D024EBCC167B5849950B3C86A1CCC9A1BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e0e3856936c99a6821399a86e095f1243c0aeaf7296b5f6d62241afd3860949a
MD5 9991f15d0ac7c5645bf24048767f6108
SHA1 b29d2bd9cfa9c1ef050132784888200b4eabc7ec
SHA512 15ee86c4536e9e6b975abe0a5adfe825333db1018c735cf4f14f69a3bd4d41e1939ff9971e1fdf125ce9810b436d59c837d569e70c36bec0ecec46adc6100210
SSDEEP 192:lONG6vMtPQmiUyDbDwThTobWCIKp847IcLU/u:lONG6UtRLTiFIKRbU/u
TLSH
T1E2020775BC686C7BAEA7BE45F48E23171FE4117BA6905B50EAE82F1C00D765C2303936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 6e047f21b82e1bd24ae36031538335127505cd7a70a9e0cf9358264a4cb0448e
MD5 541b88adb8bba2161f901f33422c0494
SHA1 b59c1e597af0afda5249b3c9a3f68c6686f15543
SHA512 665f96d9755dcfa60072bd9f651dc831ff45f57730f448fcac34276fe4015ede77e71882923b3ae0f59d5964fa329ddd80770751844697a06a2af34f534f642b
SSDEEP 192:uWSMyGm+xasuheOwQxMGsNts3rQ/RBTM7pugEUQmiU1DwDPu9XOMTobWCIK++Wyq:6ZcIhsNqb0Y7ukBczFIKPlnmKE
TLSH
T1C8627C71AC645C3B9DA7F141F48A32034EB8826797C85F54E5ED7F2D01DE1AC130B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 4946809ecd84d0f9043a1d2d40d611dfd45ec3bc99ea3f22781932504128af31
MD5 d6f9e40bcaab8829b3684c03090a0bdd
SHA1 d3fe8c1c0987b2ee06f2c3b1a3f37804bf9f599e
SHA512 2ef74cd74ec97cb849dbea89a93d7ac2f4cfd3d9800a5fd7f6371b223f28d23ff90eeaac10c7f56cf9dbb1004d06a5ab14acea754d70303352a6544db3418b73
SSDEEP 192:90ONJJ6vMSEPQmiUyDnDw9GhTobWCIK++WyiR80IIhqGU/u:CONr6UdR1wiFIKPlLmU/u
TLSH
T117121A72BC649C6B5D93B551F48E32135EB4826BDA84AB50EADC3F2C01EF56C2307526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 6ebb9d9452884119fd7f6f0375774bd2b4d70fa6b54ec700020333768f609aa2
MD5 49d9bffe981cc679e1eb1c6070cf2f51
SHA1 6e686784b437e9d704206d473c6be6b1bf5a074a
SHA512 79918de0671fb867cab882028ced8ebf4821d0e2cfff91c0e4142ddfe234557561276c1bf8c0305701bbcfb2dfa17ceda383e21c2179536275de068f7f17b71e
SSDEEP 192:3Gm+xasuheOwQxMGsNtsArQ/RBTM7pugEUQmiU1DIDPu9F4MTobWCIK++Wyil8zs:FZcIhsNq40Y7ukFwzFIKPlnmKE
TLSH
T1A5627D71AC745C3B9DA7F141F48E32034EB8826797C86B54E5EC7F2D01EA1AC130792A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 d8267309f32f596b28a3c023b789f2a28b5286a0d35b0118d738bf130d78e3a3
MD5 ce1d05bbcf1c724355b6fea544b72c88
SHA1 a086ea257b5e686d972dac70bdfd2b7f1e7d2a4c
SHA512 57a6134a66754707834babf62aa86f746387ef826c6d5c2e886e339b0c40ce0c0cd44e8ba3bf56ce7549e8560bfaebe41f20ad5b2f675208e91fa1dfd6df694e
SSDEEP 384:3iFPZcIELsNp8TUNTUlIlv0Y7uqXczFIKPlxmKE:yFHkKwg+YN+FxlxmKE
TLSH
T178B23BF258D7883ADDAEA743E77D2D024EBCC167B5849A50B3C8691CCC9A1BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 e8b728bb252336ce5869638030155f4903123c05c365317efe46ad1c07c3ad84
MD5 5cfcf2943eb2f341b669ad5e4edf5cb0
SHA1 86c3cfee242a71fc106e509464377dc3adbca511
SHA512 dd4f15da15b47b95cd1310dd2aa65b44af6a9674a53ab5f7016b906aca93e82a6680a5e54899b2f8f411814aef1d6e02148b07bd3c1a08a84f8c95d93343bd4a
TLSH
T10AE00203D20401BEC1384330C0836F301DF2412002B105584F35025C7D737003B20BC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe588d66.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe588d66.TMP
Size 392B
SHA256 fa9c54b27dfac33e5e58f238099cae0930a184813df2d565ebe653ad843c6782
MD5 addc20271186065047ace0245159130e
SHA1 5c3d6ef6e3ac1907ffa69b5cbf0a57a311fb2712
SHA512 3f8f7c9b834a7725980ab9a7f866b16bb69971e1a9505db38eb7bc7556bec73d760fe055a87ec859e6104df3f52a15b0e6a9696bc64c066f334e827d25160d0e
MD5 SHA1 SHA512

Submit Download

619743f6-2129-4f55-b107-9823e3c334c5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\619743f6-2129-4f55-b107-9823e3c334c5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5d67e304123d4a6fe573705b97d21b67239622d2ba394c55c9111955017c4aae
MD5 72a9e06e6fc9a2895b13e801a9da7a5b
SHA1 0e02191b6a573b76d4a9f2561cef4a80275620bd
SHA512 48cfccd4a46c2b9145d6cf4109937bb7516c045bead775ee392dcc25ac41bbd941dc0c7e41e51133ab190b2dc296fd2733d3940b95a3b03486f51d874de0a63a
TLSH
T1E441166CA6FA1144B3B7AE5A9BF2A8AD487E79372F06D45D10110D4E0963A01D8A2737
MD5 SHA1 SHA512 TLSH

Submit Download