hxxp://app[.]onairupdate[.]com

Analysis

user interaction
yes
max time kernel
209s
max time network
218s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/06/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://app.onairupdate.com
Sample260625-sdnaesc16p

Score

5^/10

discovery

Malware Config

Signatures

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	34	https://app.onairupdate.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a114d8cb5b696433	1

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4688	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134268732824281462"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{C7075793-628B-4A49-8DA0-9E6878AA2E53}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4664	msedge.exe
4664	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 3112	1660	msedge.exe	86
PID 1660 wrote to memory of 4688	1660	msedge.exe	87
PID 1660 wrote to memory of 1760	1660	msedge.exe	88
PID 1660 wrote to memory of 1760	1660	msedge.exe	88
PID 1660 wrote to memory of 1760	1660	msedge.exe	88
PID 1660 wrote to memory of 4236	1660	msedge.exe	90
PID 1660 wrote to memory of 4236	1660	msedge.exe	90
PID 1660 wrote to memory of 2700	1660	msedge.exe	91
PID 1660 wrote to memory of 2700	1660	msedge.exe	91
PID 1660 wrote to memory of 3492	1660	msedge.exe	92
PID 1660 wrote to memory of 2700	1660	msedge.exe	91
PID 1660 wrote to memory of 3492	1660	msedge.exe	92
PID 1660 wrote to memory of 3492	1660	msedge.exe	92
PID 1660 wrote to memory of 544	1660	msedge.exe	93
PID 1660 wrote to memory of 4204	1660	msedge.exe	94
PID 1660 wrote to memory of 544	1660	msedge.exe	93
PID 1660 wrote to memory of 544	1660	msedge.exe	93
PID 1660 wrote to memory of 4204	1660	msedge.exe	94
PID 1660 wrote to memory of 4204	1660	msedge.exe	94
PID 1660 wrote to memory of 4388	1660	msedge.exe	96
PID 1660 wrote to memory of 4388	1660	msedge.exe	96
PID 1660 wrote to memory of 4388	1660	msedge.exe	96
PID 1660 wrote to memory of 1976	1660	msedge.exe	98
PID 1660 wrote to memory of 1976	1660	msedge.exe	98
PID 1660 wrote to memory of 1976	1660	msedge.exe	98
PID 1660 wrote to memory of 4940	1660	msedge.exe	99
PID 1660 wrote to memory of 4940	1660	msedge.exe	99
PID 1660 wrote to memory of 4940	1660	msedge.exe	99
PID 1660 wrote to memory of 1720	1660	msedge.exe	100
PID 1660 wrote to memory of 4896	1660	msedge.exe	101
PID 1660 wrote to memory of 1720	1660	msedge.exe	100
PID 1660 wrote to memory of 4896	1660	msedge.exe	101
PID 1660 wrote to memory of 4440	1660	msedge.exe	103
PID 1660 wrote to memory of 2980	1660	msedge.exe	109
PID 1660 wrote to memory of 2980	1660	msedge.exe	109
PID 1660 wrote to memory of 2980	1660	msedge.exe	109
PID 1660 wrote to memory of 3096	1660	msedge.exe	114
PID 1660 wrote to memory of 4272	1660	msedge.exe	115
PID 1660 wrote to memory of 4536	1660	msedge.exe	116
PID 1660 wrote to memory of 3788	1660	msedge.exe	118
PID 1660 wrote to memory of 3788	1660	msedge.exe	118
PID 1660 wrote to memory of 4664	1660	msedge.exe	120
PID 1660 wrote to memory of 3688	1660	msedge.exe	121
PID 1660 wrote to memory of 3688	1660	msedge.exe	121
PID 1660 wrote to memory of 1552	1660	msedge.exe	122
PID 1660 wrote to memory of 1552	1660	msedge.exe	122
PID 1660 wrote to memory of 544	1660	msedge.exe	123
PID 1660 wrote to memory of 544	1660	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://app.onairupdate.com
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffab253c188,0x7ffab253c194,0x7ffab253c1a0
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,17145602893764931214,12854175548899399498,524288 --field-trial-handle=2252,i,5788719370042689089,631081638781490754,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,9882883255262944438,13365969182964337903,262144 --field-trial-handle=2252,i,5788719370042689089,631081638781490754,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1724,i,1961893993455661836,10085456635515025530,524288 --field-trial-handle=2252,i,5788719370042689089,631081638781490754,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:8
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,12515527298659477790,16974536913972510037,2097152 --field-trial-handle=2252,i,5788719370042689089,631081638781490754,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,14406781439427594265,6074173999893558311,2097152 --field-trial-handle=2252,i,5788719370042689089,631081638781490754,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,3773754054433671376,1972724394053144809,2097152 --field-trial-handle=2252,i,5788719370042689089,631081638781490754,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,6943308468012639865,7194098688063114704,2097152 --field-trial-handle=2252,i,5788719370042689089,631081638781490754,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:2
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5032,i,7227338428996019750,13744138151462805800,2097152 --field-trial-handle=2252,i,5788719370042689089,631081638781490754,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3608,i,14136416329012185806,15076916138095679796,2097152 --field-trial-handle=2252,i,5788719370042689089,631081638781490754,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5116,i,898606561887242373,1657037618718427547,2097152 --field-trial-handle=2252,i,5788719370042689089,631081638781490754,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,9858914986071695867,1046647441522643384,524288 --field-trial-handle=2252,i,5788719370042689089,631081638781490754,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:8
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3580,i,4410105677440273951,6601054646723815084,524288 --field-trial-handle=2252,i,5788719370042689089,631081638781490754,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:8
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,14137479884315651288,15979876737859120910,524288 --field-trial-handle=2252,i,5788719370042689089,631081638781490754,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:8
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,14137479884315651288,15979876737859120910,524288 --field-trial-handle=2252,i,5788719370042689089,631081638781490754,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5384,i,1803073252218819385,10156761387433288398,2097152 --field-trial-handle=2252,i,5788719370042689089,631081638781490754,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,7267307117385416255,9940269316903702300,524288 --field-trial-handle=2252,i,5788719370042689089,631081638781490754,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:8
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,2958344907044306496,17043145725459176001,524288 --field-trial-handle=2252,i,5788719370042689089,631081638781490754,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:8
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4472,i,17954669058566332129,16562364382940472653,524288 --field-trial-handle=2252,i,5788719370042689089,631081638781490754,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,6945183115309730896,18150728839139874176,524288 --field-trial-handle=2252,i,5788719370042689089,631081638781490754,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:8
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5728,i,5496243337987516376,2037161598979964550,262144 --field-trial-handle=2252,i,5788719370042689089,631081638781490754,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1016,i,4818875457520511009,1767510880829131012,524288 --field-trial-handle=2252,i,5788719370042689089,631081638781490754,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7124,i,7216085627993873412,14238647119419354188,524288 --field-trial-handle=2252,i,5788719370042689089,631081638781490754,262144 --variations-seed-version --mojo-platform-channel-handle=1292 /prefetch:8
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7132,i,14476660144990069292,16003342162924201064,524288 --field-trial-handle=2252,i,5788719370042689089,631081638781490754,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:544

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 67f9026b6c7a0f35c27b075ea70a08cdc2e8b371b33b4d8c6cd7630a644ca2a7
MD5 080ad634c92c4eba6ea84d6acb63aafa
SHA1 4cecf966ab8638de924508acd943fb0019f1df92
SHA512 36105578acf34d660217119df100ce0c7e9b8cbccf0ccd8484ef0906f9133096b859a0378472302e005a5530370ec0fb2a1738b3328c485439817b0c872e40c8
TLSH
T125E02649928FE3B4070296C7926D731EC310B20FD79EDC5E3B0C748DE440A20E269584
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 54dce9616db1d36b9cc132289d8cbf2bd94f2c593d6fc291acdc6ef235b672ee
MD5 5f20dfbf1d7575c5b18ec2d4c1668ca3
SHA1 8c48296474b6a950b04bcd52034c3b1782bbdde5
SHA512 76663ebb5ae18d206ccec5ecf51803fda3c5925903919833eee2f88b64b4e4d3a555a7dafe99e1acbf363b019831ac68634f434d893f77a91bf5c2bec088d7ff
TLSH
T1BD715EE405028993EF2D9CB0D0F51132B970BA768AC70FCD02500BBFE99B7264D43718
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1ae49ceb3b7a0fef62217a2974caa02286038590ff770d314591e32a4fc25260
MD5 d4481ae2f613cd49c45697c9b02aef89
SHA1 3f34dcb2413eb0c319d845e51d40138ab06bdff5
SHA512 ab1ff326abdf45928ce7a5d5f8cdb41b34f97058077ffead5dc8ac2ea3a8b9a483c7f35220c0936534958263c8958e8468175f7981e8513df29d1957e5f8f683
TLSH
T1B8714DE405028997EF2D9DB0D0B51272B5707AB68AC70FCC02541BBFE99B7264D53718
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f9ad.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f9ad.TMP
Size 3KB
SHA256 a3703c4cbab821be8e558fb19abec3b08927bdcafb71f5cc31d04adfae8770ba
MD5 13685c9f8a780bc0df2033ff013b73c5
SHA1 68cecbd8c9d2ed4a4d6b25c79d63c6dd8790839e
SHA512 6b6b16d880bf8e3679984591b92dbf5592879bae9e8f404cc9db8571cad76ee84fb41a25cf1aeb2030346f9b6ad28c7e30d64e3979ae61805d3442d54530d83d
TLSH
T1E0613BE405028993EF2D8DB0D0B11272B870B7B78AC70FCD01541BBFE69A7264D57718
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1714697b-b936-498c-8904-c0f48f679f6a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1714697b-b936-498c-8904-c0f48f679f6a.tmp
Size 4KB
SHA256 0d7adf3d03e340a3f8090f5cb86c4d5f3e5c4fd70a144bf56abe4d8e16ebf60d
MD5 77ee99f78ec4760af40713cb719512da
SHA1 cfc749de456aa08807d619cae5340945bb88633c
SHA512 17f9375ebbe05e806f61175ddce3ebd97a75115edb6f5c7fbc4f7dd12f8ad68587052909026d98547f6bf61188746881c6f23db9e07ae3b36313b60e5cf4e8b5
SSDEEP 48:YALlN/ODRS7Uz3DRaDR2DCvDRVDRECslzEsgD/sbDBscCKsVDysMDssrDgMbgyLS:DNOpz3MsiTGzE+D2qDEMMCYLgqvZzf
TLSH
T1D8913EF7C2E58A5D981152F1BA187F6ECE2E0914931C7C1BC9D59F8BA3E24B1D101A8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5918c2f9ebb447bb05e1f70ba618f649253c953b98350c9cf72f6c3eacc84473
MD5 7848e52200ecf2a68aee4e8995c204fd
SHA1 7b113a111c3e98dac5a7044ea2ef3c9378c490c5
SHA512 3ffdf281aeb9b07410ccdd75e46f70f1c3459e94e2956b7033b45bf61d17861d7264f1a50c27e5fd66acd51307dff453e2fb36dc1cca6c725ff08f33f86ed699
SSDEEP 192:sxZyRKyM/jK1Ml8Mko/fbswEqSIdpXc4HW6+WNYCE/YLbP6ycIIgrJ:sxZyAMo/fbswEqbpHbW/uhr9
TLSH
T1EE52D8166A349A77CCDBD209F945BB53D6F90472A3905D48AAFCCA0C04E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c8640ee59d05a9df3978a29a263f921d6e9345eb2b5b4b2fb10a2a44971a71b5
MD5 3905dcfe34d7e67aa715bf038aa095ea
SHA1 ca4d7589f0fa405b9ddaf7aae29facca73901c11
SHA512 f501627db6a443f96f6f512d5d364ac993de426cd932edd61f97ac1742892a1d9b720b59c3865b3ac5cfbbfdea13c9b92f3c24fcb185f64873656a4973b302a3
SSDEEP 192:sxZlRKyMojK1Ml8UQPko/fbsEcqqkIdpZc0HW6+WNYUixYL/PJFcIIg5AJ:sxZlHq8o/fbsEcqgzHb6xGXrW
TLSH
T1E462C6166A349977CCDBD21DF945BB53D6F50472A3901E48AAFCCA0C00E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 83c62d474b8d246393728bca87c6112b37b9bf7bc90beb5289674e6f48495054
MD5 11b71f150d1aeb10f60f0e73fcb7c19f
SHA1 214825d0472eceafb21d0fcdd353994b932a92be
SHA512 3d609ca360410658a9815cb328868e35227adf83a4b0590cc08adc4f092ee99694f6381ec026755d0a71e9b5d522a41b175a26236e6170307374587dc7b252d7
SSDEEP 192:sxZTRKyMojK1Ml8Mko/fbsEcq0VIdpZcLHW6+WNYiZdYLZPJycIIg5AJ:sxZTHMo/fbsEcqVkHbDdAIrW
TLSH
T14852D8166A345977CCDBD209F945BF53D6F50472A3901D48AAFCCA0C04E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b4bf7746ca668723e022d327d1fdc660b3ad2f51e805a24b22bfe71be4a027f3
MD5 e0191a696da8cfe0a619ec2a10b840a2
SHA1 39073fe876efeb5e60ce537881720caaa8bf8521
SHA512 23e0092e395182caac5d97fc8057857c4bbc841c845ac353d8af34929e04bc4abd237543bbbec420d69289f417a70b49dba3a61bcb037f6fcf931212118f4ed2
SSDEEP 192:sxZlRKyMojK1Ml8Mko/fbsEcqqkIdpZc0HW6+WNYUixYL/PJFcIIg5AJ:sxZlHMo/fbsEcqgzHb6xGXrW
TLSH
T11E52D7166A345977CCDBD20DF945BB53D6F50472A3911E88AAFCCA0C04E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 bf697debc19e6404a5fdd4dda0198e06c036524ff77aca2df5824dc0d92453b3
MD5 9058fc1f3f7e12cd325f5da530b2bf88
SHA1 a606f9c61ab9897368b8b05cfe572c17e492e3b4
SHA512 37b189db773b28fe3658758dee40d736d602ae2824f4afe66b8f7debdf388a2c7044c37bf824f18a1b4a7243875e9c625f4423dbfc6aceefbb86462d84569a09
SSDEEP 192:sxZyRKyMojK1Ml8Mko/fbsEcqOIdpXcOHW6+WNYiZdYLqPOycIIg5AJ:sxZyHMo/fbsEcqfHHbDdjtrW
TLSH
T1FD52D8166A345977CCDBD209FA45BF53D6F50472A3911D48AAFCCA0C04E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 7d6cdb7b33fc3bfde3d9ea0eee745196038e12d6bad8ac9e1d9a55fd8573df86
MD5 ffb588b07a36103465b21ac3070c69e6
SHA1 fd8815658d9a075294175f8bca0ca6832b3f9b4b
SHA512 96918f7411a2b9643a90918138e32eecf83a6650c17c8015205e9c6a9ffb88379e681bd739d8287781c8cd1d29e83f741bc4213b5d788f15b530c5717bcfef9a
SSDEEP 768:bjs6pD1WvxzUj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJN8roQnC:bjs6pD1WvxzUju1jahILIsNnQnC
TLSH
T195E20A3B680CCB7E4F841E5CEC2AAF967DD801CBAB94895447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 7KB
SHA256 c4af1b10dbe0af54da4577e884c105577f5c996e296a3c62de381853943a1563
MD5 29d2863b073c19a5bf9bf675c26cf468
SHA1 e24f251aeb0b218ee988bc14e2f03ab9cf0a5a5f
SHA512 3159d28777f8ccf0f422b227c2caa736a2a048ae6f6299e76a00c185537fbdc0fe58c454d0e0c64892b4f4c501b5dbada9c382d6d4f7a25fdacb256e34ec6ac1
SSDEEP 96:KUAAKtePW7iKEM+qCZ67g86wQx5cpszExKL4zaxviqREQSKkwKZimmMK7iug:iihRJ67g86wQvcpgE24zaBiqREQSnqjg
TLSH
T106F1161732BA13023D7E1A4883D497678AC271537054A42B3BAD04B6DE67E21DEFC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

acad481b-5923-440c-ae84-f67be4d5c0a5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\acad481b-5923-440c-ae84-f67be4d5c0a5.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 7c422040448c97e1feac90b37a8dbdd07f19334c469a328934433011d6e6f3b7
MD5 2814a5ed26877e3e98adaf9da2c631f5
SHA1 fe1d0d4e7ad357e5e342a496c8328c448d20d606
SHA512 7f680aedd346126571324122ae143d4e7285ef7a2d5b39930b282724dff892673be8b79ede86d470482374f7f36a507e25ed45b310ded726385a1cda51d50628
SSDEEP 384:4tNn/s3n9SfsN0diCOfza3a9xO7glzJrPWmn15wbAjE1Z:4j+9U+GKDO7g9hPWmn12bf1Z
TLSH
T173926C3668385C331DE39189F94B26179EBD40B7A7862E94D5EC8F0D01EB7D8231AD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 12b2f78efda3fa9d6ac37c8d6f998d639c868b0d8d343bc585e709660cf331f8
MD5 b3889e58fb173d60929dbcd775bc5487
SHA1 3e8b996cdbe1d201992dbf299071e614e99c4a12
SHA512 76623b5def1af6e51d58bf27ebd42266effd4ac027b7749673094998c158e7792a385081117ab65e18cca5149bb7293eaeff3a6443d637f91ac738d282b57c3e
SSDEEP 384:ytNn/s3n9SfsN0d7COfzo3a9xO7glzJrPWmn15wbAjE1Z:yj+9UVsKDO7g9hPWmn12bf1Z
TLSH
T19B927C3668385C331DE3A189F94B36179EBD40B7A3862E9495EC8F0D01EB7D82316D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 503427987f0fe9b28172e590b12e9824df855647f4ee6599f0af32c673090989
MD5 67bfcc8331d178cae2a0428b004de83e
SHA1 025bdf83554b6b23cf09b1343d06c3fbd2e6173f
SHA512 e2338a8dd5429c618bbe4b78b5d9af938b947cff23c194f6c6ba8065ecee2c1bda8eb062dd1eb13afc6a5d954f46a1331d20c00235d45bc92067ccbcc2bf27df
SSDEEP 384:SiF1tNn/s3n9S8zsN0n8TUNTUlIl7COfzH3a9xO7glzJr8Wmn15wbAjE1Z:ZF1j+9XjwgZzKDO7g9h8Wmn12bf1Z
TLSH
T133C229F648D78836D9AE4747B77E2D068EBCC067B6851954B3D84A0CCCDA2BFD306906
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 028b9ea5620ddeda11ac235a1140f22294372629d81299e2a7f75390c1f4435c
MD5 0581e74d99b47c394e261a9f1bcb141b
SHA1 c80b0be0a7c196cccedae448b6e0ca36994072fc
SHA512 4f971a6c7f0d701378e658b56bbf2584a662b82e291996ac663d9999aa70e98905e29d1abf4002775b5361db3ce6bc5a811a8aeb290bcdc93da5180b393f8426
SSDEEP 192:qONx6O7+3hQmiUyeCGttb0gO2VoIgGhmU6:qONx61kGt9xO7+4U6
TLSH
T13402D8356D686CB75EB2AD45F98737239FA8103BE9912F40D6E81E0C00D765C2347827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f370e8365818ac110ee4c3a9b32a3343d5fa29dc4c47e8c40ddff765b870070e
MD5 2ce637cbdea4ad10d758e3aae52c9e4a
SHA1 9687b69d242b099d66993778460aa1786e2af34c
SHA512 f6fedb44ba4e6bdf35a0641f49085242f99b5a504706d7060cc697bef6f2938e205a6807f45d3e7a5d19bf45a3929d409060fc530908974152586de54e94234e
SSDEEP 192:JONQ86O7+3NQmiUyqCKGttb0gO2VogHF0SJrN+cNZqbfU6:JONQ86ZyFt9xO7glzJr9WU6
TLSH
T163121B356868AC775DE3A145F98736178EA9017BEB866F80D1EC1E0C01EF6AC234AC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 54c59479f9a9401301a9b2f14642cf0dc48c6b81f727c86fda22bd7386e2eb29
MD5 39a62030202696b1d5503310f21818e5
SHA1 57cf1d26bfcbcfe4a3993f58db6a66cdc8644fcc
SHA512 321078b1d198ab80d796610b231e96a4cda5e82c0d6d058f88ac574f53f059d90619afbbf58e7371eaec530990e893b526087817680ef57cebac6094cc37cb98
TLSH
T126E00102E31040B6C01D033201831B602BE2C62012F2171F562101683D67B062D30F40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 4cd645f3f0ef9291f6f9f88d83632ab8e4c40fe6ce2a2c4bb0857d5e0440b862
MD5 4a3dafffe54069cfc3c074f856cbc6ad
SHA1 74d05dc4c60f93c536325f78e45ef4b7cb005ac5
SHA512 e349c3574ed64c947b63ba089ceb79fe56b711186b3aff40799148c88e4d3037429fd4f919ca8cc71e6d526614333fbe75122738eea08e45f0b41e7821576b13
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ab59f6ec200514427374c7b8ec3f4faafffa4ac74fb2556bd138bd56cf904cd5
MD5 c05ae3752fa71a4eb00be00d71ee1e15
SHA1 23bbf0060a4c666ad387339ad4347f1a3b66654f
SHA512 30609c0575d4939de94dd6f0961d7a7ead48ce5b39be6fa4982f41c01d4af49e033a6e664039ddb34fbbaa08bd1737322a564101a51085763fea2a9804b050a0
TLSH
T1CDE00202A2100072C00D033201C31F402FF1C62002F2171F5231016C3C777073D30F00
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58bee6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58bee6.TMP
Size 392B
SHA256 4e60437307d9f4c7258760b4e0a34ca1c31c30b89cb13f038c26c28a5b4d0d8e
MD5 7f9fc1ffbf7014869d99a87bd97caeef
SHA1 4f81346e2cc9f053ee9171ccc82c45c361a675dd
SHA512 57a364ea0f4d137ce60c826b6a67cb56caea7cf9ad498acadcdc1618500615f56f09b3dd56eb512e9a4e70a147e4a0641b68d90bd64a637095c51daddeb5c781
MD5 SHA1 SHA512

Submit Download

15cbfaf4-a778-403c-8b5d-385622d77f40.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\15cbfaf4-a778-403c-8b5d-385622d77f40.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7b2446016b6e0b9b9eb7b893e36577c544d3111d95a70ff005b1367384e3fafb
MD5 8c672522f41e06929b35f532f1a0abe9
SHA1 1219194b74ebff0bf1d7baa1f855c4f4d0ab654d
SHA512 39298f9c97379937fcec0a22e1ba7ae3037433aea4bce2a7f2ff5e04d4151289d4d7abb67197e9d1a49f49bba520b59652597ad3ca59c18bd12da820fbee9243
TLSH
T14341E958BAED1148B3B79E5AABF6A86E447F79372F06955D10010E8F0A62B40C872737
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download