hxxps://github[.]com/PulseKn/OniXPerf/releases/tag/update

Analysis

user interaction
yes
max time kernel
34s
max time network
34s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 23:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/PulseKn/OniXPerf/releases/tag/update
Sample260529-3ebccsdx3r

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5176	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134245707519440729"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{AAAC8E5D-0325-43ED-A1EC-444AF4529989}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\OniXPerf.zip:Zone.Identifier	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 2424	5020	msedge.exe	80
PID 5020 wrote to memory of 5176	5020	msedge.exe	81
PID 5020 wrote to memory of 2356	5020	msedge.exe	82
PID 5020 wrote to memory of 2356	5020	msedge.exe	82
PID 5020 wrote to memory of 2356	5020	msedge.exe	82
PID 5020 wrote to memory of 5096	5020	msedge.exe	84
PID 5020 wrote to memory of 5096	5020	msedge.exe	84
PID 5020 wrote to memory of 1204	5020	msedge.exe	86
PID 5020 wrote to memory of 4604	5020	msedge.exe	85
PID 5020 wrote to memory of 4604	5020	msedge.exe	85
PID 5020 wrote to memory of 4604	5020	msedge.exe	85
PID 5020 wrote to memory of 1204	5020	msedge.exe	86
PID 5020 wrote to memory of 1204	5020	msedge.exe	86
PID 5020 wrote to memory of 2528	5020	msedge.exe	88
PID 5020 wrote to memory of 2520	5020	msedge.exe	89
PID 5020 wrote to memory of 2528	5020	msedge.exe	88
PID 5020 wrote to memory of 2520	5020	msedge.exe	89
PID 5020 wrote to memory of 2520	5020	msedge.exe	89
PID 5020 wrote to memory of 2512	5020	msedge.exe	90
PID 5020 wrote to memory of 1644	5020	msedge.exe	91
PID 5020 wrote to memory of 3852	5020	msedge.exe	92
PID 5020 wrote to memory of 1644	5020	msedge.exe	91
PID 5020 wrote to memory of 3852	5020	msedge.exe	92
PID 5020 wrote to memory of 5480	5020	msedge.exe	93
PID 5020 wrote to memory of 3368	5020	msedge.exe	95
PID 5480 wrote to memory of 3544	5480	msedge.exe	96
PID 5020 wrote to memory of 1684	5020	msedge.exe	100
PID 5020 wrote to memory of 1200	5020	msedge.exe	101
PID 5020 wrote to memory of 580	5020	msedge.exe	102

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/PulseKn/OniXPerf/releases/tag/update
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7fff3be0c188,0x7fff3be0c194,0x7fff3be0c1a0
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1716,i,8445437491856978450,9558127412752484087,524288 --field-trial-handle=1920,i,14162680367199319706,7350356176034402515,262144 --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,5435241138680208570,14334521022318534178,262144 --field-trial-handle=1920,i,14162680367199319706,7350356176034402515,262144 --variations-seed-version --mojo-platform-channel-handle=1856 /prefetch:2
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,14855503619089939977,10132617136665361386,524288 --field-trial-handle=1920,i,14162680367199319706,7350356176034402515,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:13
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,6355717126387147812,14378076573475058513,2097152 --field-trial-handle=1920,i,14162680367199319706,7350356176034402515,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,12555993260637324199,17446387239188998865,2097152 --field-trial-handle=1920,i,14162680367199319706,7350356176034402515,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,14839064068431158488,166397002797688750,524288 --field-trial-handle=1920,i,14162680367199319706,7350356176034402515,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5220,i,14209321702994453212,1953529989749458372,2097152 --field-trial-handle=1920,i,14162680367199319706,7350356176034402515,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,16564565572822482692,12637335277272642266,524288 --field-trial-handle=1920,i,14162680367199319706,7350356176034402515,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:14
  2⤵
  - NTFS ADS
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,15072866916837364877,14712223261907368128,524288 --field-trial-handle=1920,i,14162680367199319706,7350356176034402515,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:14
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,7517740543205908875,15354462995842914175,524288 --field-trial-handle=1920,i,14162680367199319706,7350356176034402515,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:14
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,16848895201065490516,4939596014979275477,524288 --field-trial-handle=1920,i,14162680367199319706,7350356176034402515,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5480
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,77301751279351916,15818092879136821013,524288 --field-trial-handle=1920,i,14162680367199319706,7350356176034402515,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:14
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,77301751279351916,15818092879136821013,524288 --field-trial-handle=1920,i,14162680367199319706,7350356176034402515,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:14
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,11652276636554352902,17422743864715086444,524288 --field-trial-handle=1920,i,14162680367199319706,7350356176034402515,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:14
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6940,i,10317484520530561718,14093774958459298596,524288 --field-trial-handle=1920,i,14162680367199319706,7350356176034402515,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:14
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6944,i,11000666371692234682,6683644911049240392,524288 --field-trial-handle=1920,i,14162680367199319706,7350356176034402515,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:14
  2⤵
  PID:580

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4036

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 fa1e9dd1fe9fa699ac57bc9c62ac9b0a360bec28d127e504d4110b11bbff6aec
MD5 704c8ccce5eed5792ed587b6357f6097
SHA1 8fcc9a93a83321e68b3969c661139526f6ae68c3
SHA512 47443a7a836ab442de3580639feb9fdfe78687e7e6f4a62c043e08937dd05f7fd4fefa79fd36efc495988f8d995bc93330a7b57030599feeb2ed380fdaf930a9
TLSH
T11CF0F9AAC920AC2718FD0B1970A90B4AEB50135B2780945F3B3D560C4FF6A3B468985C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 5c3f5d366ec72d390edbbfc3cf603848d421f19a22fa71cf2187b3d573eb463c
MD5 76068bb47fb4d2be00dbbfb3073d946d
SHA1 89ae3ec8914f1e774382d36b2f8f3f9d6033e299
SHA512 163d752ebd75ea49569f012bfd50783dec0554dea0b8e5c0049da744de73edc2afedf323c59201dfd1d54c5517ba38f38319ba9cd9adf0194c1a5ad433e061f1
SSDEEP 48:k7Ka4pEM3c9WLUF9MICDkrDMrVYJVZO4ryDSpaYpCNlwdQobLNkxXtnGlmdYy8gV:k7SLJEMICDksGqpkbpC6bLNk/nGlloaW
TLSH
T186B1734C8DB23B23EB102735D1D00AC5BCB168981A4FBE6BB3808A779657FE1C21BC05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58993d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58993d.TMP
Size 3KB
SHA256 a7a01d1edb8fe0938f98ea3bfa7a1d1e4f3f73475ed19699cf44c673a612c3b5
MD5 6d905c92bc6f37cec5d96ea2807f4647
SHA1 611ea635e3961d480261504f63132ed1d6c08dc8
SHA512 563ef1c25373ac3f7c8a2052b57c1ebc108145d503dac5e70affe2486fb80a36bed22c76e4e9b1090b7f4d8fa0e1898caecd2b528fd4b4932366d2e369261f43
TLSH
T16171091D86723363E3202331E2D102C57CF66C941697BEBAB1805B7B5718F72D21F908
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 82c85d0878e0d024211f24e71683a61c7d6153ddbc6d651bb81df24dec0c8835
MD5 62c69cde16222d729974055124258851
SHA1 68b16b99402fd2ad9b9a0483f22aebb7860033fb
SHA512 e89f2846b0771eb3bcfa01aa42e159fb59f0ca500b210815e53245d99bb2a97bc5fe97de8338d47c4e09375d03c05d551a8ef154ae9918701d77774d00f99451
TLSH
T1FB3180F783F4856ECA0195F0B618AE2BCF2D0515436C3D9A85E4AF1B93E2471E141A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 73a11ceeddd22e47b416fa983410d47ce38357bc896de4b8e341e9bc427fbe29
MD5 78d5327e5f80d1596767a4a1a8e9acdc
SHA1 61fcfaa2517ca5f91858fb0e7a5eb9009a99be22
SHA512 4bfbcd03a2365e7c2321903c08b2944e59fba6f208d89e03b381d473e1ab87c430dc9d453aab4738e64da19358ce9fd56fde82085f48e77125e62b51e17528c0
SSDEEP 192:sxZZRQyMqZjK1Ml8MoE/fes38TxE0CXUyynDjzodpm0zR/W6+WNYCI/Y0dwGsf8G:sxZZxQE/fessT60Ly84B/be/5ZsoDa
TLSH
T1F472F906AA34597B8DDBD319FA457F53D7F9142692805E489AFC8B0C04E6AED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 ec4a9ea347b4cfb176da9e5a4f9ae350f3722c25466e37fff0259c7c44ecea78
MD5 6c2e11a5f1297d3409c2f3228ab0717e
SHA1 719f11fa960458a6094a7d5300eb905e82e90f56
SHA512 ed35d14c146c26c97361210189bb438322feebddc53dac4c51f6d6eabd5272a128710b8ecc3a49e7e9c9740f8e79d18c48b3c9c963db00e130c33f4ac740e81b
SSDEEP 768:ciWKy8Eq2A17pLuLn5dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3d3pQLlW:ciWKy8Eq2ADEn5dWRm5rQW7u1jaKd3pN
TLSH
T12C030B3B680CCB7E4F805E9CEC266F9A6EE8018B6698895447FA444C03C76EF551B4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 5c5cda539c9f2d98040b8ddc9cace734ca31301ebd3bc492f8eac91c1c15056f
MD5 48f7223384e9f15b705453b081ef0be2
SHA1 beaabbebff0a147891e7bf5cf3f4b369638a7180
SHA512 ac8021eee0554d45c1d2daf76911d471f1fcd8d9a70c9301fbb6d06b52ac802bab31af5e274671a67f8ee31fed9923f0847d68bcc457812a232dae7930c8307b
SSDEEP 384:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv7Mev:AFBHhTofhno2mB21q3Llbfe3sLDdeEpr
TLSH
T156B28F56717B12023C3E291CA6A29B370E4272A3345CA56F77B900BA4E67E215DFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ced56930-9f73-49cd-aba3-d2c6ab062aad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ced56930-9f73-49cd-aba3-d2c6ab062aad.tmp
Size 15KB
SHA256 f8fe1a03f20449b33c8c94abc121e70ddda0eb6401f4e0d7912d934ebecc28d6
MD5 2237b2c201ca7b1dc7bcb5d7bc9a69b6
SHA1 4259a722018f39ac3b1126a91ae2fa26f448c9c0
SHA512 9c51b27e6255f6536a8d5acb89e590de19aebe2f9a060f34a5caff7f033103c3b020a411224e7caf98aeeaa4feb41446985803d8d087607d382bfb9513de31b2
SSDEEP 192:sxZURQyMqZjK1Ml8MFE/fes8O8TxE0CXUyynDvzodp4R/W6+WNYCI/Y0dOWf8Igt:sxZUndE/fes8hT60Ly8kI/be/5lojJ
TLSH
T17562E816AA38597BCCDBD309F9457F53D7F9152292805E44A9FCCB0C04E6ADD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 0034abd198f7d396c16ea147a8dde508c87c62548a8146b846717a14f711b47e
MD5 eaf0ec48a8f6715fda681fc728885776
SHA1 88ac687d2bb000b000bf2c0b59e020c6a24d401f
SHA512 82833d18e226205f3c1acfd0dcfb1d63353f401c6fea4ccf607e83a1e9f9222fd155164d96544a78e7729e145a5d7bf05ed2a031d4f4e232e479b7ca8130cc43
SSDEEP 384:n5siF9CcmyWCs38N98TUNTUlIRzyyf5jkpfb7oSFsvyvAXXiHy/7IgN:BFccps3CwgbOJoysvPXXp
TLSH
T18AB24A32EC64DAF7E9EB4F89A74A7603DEE01163868C8AD4DAD84D5D00CB29D1707C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 a4d0c252c2e8a0b274e6055da30a641bac22a2204f81c77b3b4791dc922e7d6f
MD5 390f54e4556a340ffc9450871baf2992
SHA1 2704d51e55cc4e89be168ab0f201c8b8c4fa93bb
SHA512 ce03b0af23971a186d9bce39e6a5fe96fecb3b36f420d5ccf07c8815411bf41ebd8bfe10721c675ab7a5f771ad88ae7d252a3ee8f66164074b551b6c14bf82a3
SSDEEP 384:y5siF/tNnNnb9138N98TUNTUlIR0y7f5jkpfb7oSFsvyvAXXB872+sRDczxuZJHz:wF/jZbP3CwgLOJoysvPXXygRDEWf1
TLSH
T19FD25A32E864DAE7FDEB4F96B34A7602AFE00157858C5ED4EAC85D1D01CB29D130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 34c53a1f80e243f4b6ea3beaedb788d29546d48e6001b3c2b2e452079e199025
MD5 a1ea207a3dec5874b61bf53251e31a17
SHA1 56bbd7d2c70fbbc2e61df8d797d8e29b17bc6e3f
SHA512 b49f2dd5d2830f75c23e7c9dd34a54b23512e5eaa1f097a157a683fb16387e8c8270f68d12f4d026b32b86022ec9958e16d83443b085380bd22eed9e1b4c2a7e
SSDEEP 384:n5siF1tNnNnb9a38N98TUNTUlIRoy3f5jkpfb7oSFsvyvAXXB872+sRDczxuZJHz:BF1jZb03CwgXOJoysvPXXygRDEWf1
TLSH
T133D25B32E864DEE7FDEB4F96B34A7602AFE00157858C5AD4EAC84D5D01C729D130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 30b5d672cf52c36baba1399ca3d2067c71d2790bc2254daa4410c66ec651eb42
MD5 36de5a04715a07f2e5d4a3dba43a81ea
SHA1 8feb38a16a8297afe3044b947a30e2493172b60f
SHA512 2c940dfe8c8bc6d09b3dd6ad4eae5292b40b4e61af98f68bdae2917c918c6a079b6ac53ab59c368b70990fe383c4f22980eb50a48760053d10ceac51417fc62f
SSDEEP 384:n5qiF9CcmyWCs38NY8TUNTUlIxBydvfoSajkpfb7oSFsvyijhkP+lFYS/60Hy/7F:nFccps3rwgeZ7JoysvBjhkoFYS/8
TLSH
T1A7C24B36EC58DAF7ECEA4F99E74E7A02EEE01163818C5AD4DAC81D5D00DB29D1707C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OniXPerf.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\OniXPerf.zip:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

memory/3368-380-0x00000238DA710000-0x00000238DB710000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads