7ae0856d6e13d019cf623c1208107f35497b2847cd06e9f6e55c7fdde16a97a9

Analysis

user interaction
yes
max time kernel
149s
max time network
148s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
07/05/2026, 02:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fluxusz.exe
Size 3.8MB
Sample260507-db5pcses9v
SHA256 7ae0856d6e13d019cf623c1208107f35497b2847cd06e9f6e55c7fdde16a97a9
MD5 575ee2b849e5e6097aedd8f58a9d65a0
SHA1 378ea69a0686b1141d3c15fa61d9ab99243688cb
SHA512 60b82dec9c69631eea98837a3a0f10d0a22e1fb210ce7de446c00f3d550fd3e14fd75447a4dfbcf5198b069a603f9cf73cd35c131871936dc1a2a88e0af12111
SSDEEP 98304:kIXSRhgO15R2vRdpiQivqNTqI6TruWA6BASz4:9XSTz4vRad
TLSH
T1E4166C07E29581F8C0AEC079C35BA637EA72B8C94534B29F5BE40B113F26F50AB1D759
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence ransomware trojan

Malware Config

Signatures

Downloads MZ/PE file 6 IoCs

flow	pid	Process
90	5424	fluxusz.exe
90	5424	fluxusz.exe
90	5424	fluxusz.exe
90	5424	fluxusz.exe
90	5424	fluxusz.exe
244	5876	msedge.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fluxusz.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
51	raw.githubusercontent.com
90	raw.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2340_1236306722\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2340_1236306722\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2340_1236306722\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\fr\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5472_1661615190\_locales\mr\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5876	msedge.exe
7628	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134225959077059223"	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-880639880-2214913997-617214392-1000\{D82D3744-F28D-43B3-9769-801472BF04F3}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-880639880-2214913997-617214392-1000\{5203A92C-4A37-4A3A-AE09-2B1BBC30C8DD}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-880639880-2214913997-617214392-1000\{9F4D41AF-BDF2-4ED0-B4C8-E029D9B589F1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe
5424	fluxusz.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
2340	msedgewebview2.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe

Suspicious use of FindShellTrayWindow 14 IoCs

pid	Process
5424	fluxusz.exe
5424	fluxusz.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe
5472	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5424 wrote to memory of 2340	5424	fluxusz.exe	81
PID 2340 wrote to memory of 4836	2340	msedgewebview2.exe	82
PID 2340 wrote to memory of 1800	2340	msedgewebview2.exe	83
PID 2340 wrote to memory of 1800	2340	msedgewebview2.exe	83
PID 2340 wrote to memory of 1800	2340	msedgewebview2.exe	83
PID 2340 wrote to memory of 5020	2340	msedgewebview2.exe	84
PID 2340 wrote to memory of 2052	2340	msedgewebview2.exe	85
PID 2340 wrote to memory of 2052	2340	msedgewebview2.exe	85
PID 2340 wrote to memory of 5636	2340	msedgewebview2.exe	86
PID 2340 wrote to memory of 5636	2340	msedgewebview2.exe	86
PID 2340 wrote to memory of 5636	2340	msedgewebview2.exe	86
PID 2340 wrote to memory of 5832	2340	msedgewebview2.exe	88
PID 2340 wrote to memory of 5832	2340	msedgewebview2.exe	88
PID 5424 wrote to memory of 5284	5424	fluxusz.exe	95
PID 5284 wrote to memory of 4308	5284	cmd.exe	97
PID 4308 wrote to memory of 5472	4308	msedge.exe	99
PID 5472 wrote to memory of 3584	5472	msedge.exe	100
PID 5472 wrote to memory of 5876	5472	msedge.exe	101
PID 5472 wrote to memory of 5676	5472	msedge.exe	102
PID 5472 wrote to memory of 5780	5472	msedge.exe	103
PID 5472 wrote to memory of 5676	5472	msedge.exe	102
PID 5472 wrote to memory of 5676	5472	msedge.exe	102
PID 5472 wrote to memory of 5780	5472	msedge.exe	103
PID 5472 wrote to memory of 2644	5472	msedge.exe	104
PID 5472 wrote to memory of 2644	5472	msedge.exe	104
PID 5472 wrote to memory of 2644	5472	msedge.exe	104
PID 5472 wrote to memory of 1948	5472	msedge.exe	105
PID 5472 wrote to memory of 1948	5472	msedge.exe	105
PID 5472 wrote to memory of 1948	5472	msedge.exe	105
PID 5472 wrote to memory of 1428	5472	msedge.exe	110
PID 5472 wrote to memory of 3120	5472	msedge.exe	111
PID 5472 wrote to memory of 1428	5472	msedge.exe	110
PID 5472 wrote to memory of 3120	5472	msedge.exe	111
PID 5472 wrote to memory of 4156	5472	msedge.exe	116
PID 5472 wrote to memory of 5220	5472	msedge.exe	118
PID 5472 wrote to memory of 5220	5472	msedge.exe	118
PID 5472 wrote to memory of 5220	5472	msedge.exe	118
PID 5472 wrote to memory of 4220	5472	msedge.exe	120
PID 5472 wrote to memory of 4220	5472	msedge.exe	120
PID 5472 wrote to memory of 4220	5472	msedge.exe	120
PID 5472 wrote to memory of 3240	5472	msedge.exe	121
PID 5472 wrote to memory of 3240	5472	msedge.exe	121
PID 5472 wrote to memory of 3240	5472	msedge.exe	121
PID 5472 wrote to memory of 3792	5472	msedge.exe	122
PID 5472 wrote to memory of 3792	5472	msedge.exe	122
PID 5472 wrote to memory of 3792	5472	msedge.exe	122
PID 5472 wrote to memory of 4652	5472	msedge.exe	123
PID 5472 wrote to memory of 4652	5472	msedge.exe	123
PID 5472 wrote to memory of 4652	5472	msedge.exe	123
PID 5472 wrote to memory of 3360	5472	msedge.exe	124
PID 5472 wrote to memory of 3360	5472	msedge.exe	124
PID 5472 wrote to memory of 3360	5472	msedge.exe	124
PID 5472 wrote to memory of 2756	5472	msedge.exe	125
PID 5472 wrote to memory of 2756	5472	msedge.exe	125
PID 5472 wrote to memory of 2756	5472	msedge.exe	125
PID 5472 wrote to memory of 5908	5472	msedge.exe	126
PID 5472 wrote to memory of 5908	5472	msedge.exe	126
PID 5472 wrote to memory of 5908	5472	msedge.exe	126
PID 5472 wrote to memory of 2644	5472	msedge.exe	127
PID 5472 wrote to memory of 5804	5472	msedge.exe	128
PID 5472 wrote to memory of 6096	5472	msedge.exe	129
PID 5472 wrote to memory of 5932	5472	msedge.exe	130
PID 5472 wrote to memory of 5932	5472	msedge.exe	130
PID 5472 wrote to memory of 6208	5472	msedge.exe	131

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\fluxusz.exe
"C:\Users\Admin\AppData\Local\Temp\fluxusz.exe"
1⤵
- Downloads MZ/PE file
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5424
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=fluxusz.exe --webview-exe-version=1.2.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.fluxusz.app\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=5424.5864.6393133316649697673
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.fluxusz.app\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.fluxusz.app\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff935d2b078,0x7ff935d2b084,0x7ff935d2b090
    3⤵
    PID:4836
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fluxusz.app\EBWebView" --webview-exe-name=fluxusz.exe --webview-exe-version=1.2.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1848,i,2359154374708206211,6744032771355506274,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1844 /prefetch:2
    3⤵
    PID:1800
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fluxusz.app\EBWebView" --webview-exe-name=fluxusz.exe --webview-exe-version=1.2.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1940,i,2359154374708206211,6744032771355506274,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:3
    3⤵
    PID:5020
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fluxusz.app\EBWebView" --webview-exe-name=fluxusz.exe --webview-exe-version=1.2.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2256,i,2359154374708206211,6744032771355506274,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:8
    3⤵
    PID:2052
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fluxusz.app\EBWebView" --webview-exe-name=fluxusz.exe --webview-exe-version=1.2.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3504,i,2359154374708206211,6744032771355506274,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
    3⤵
    PID:5636
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fluxusz.app\EBWebView" --webview-exe-name=fluxusz.exe --webview-exe-version=1.2.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=3892,i,2359154374708206211,6744032771355506274,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:8
    3⤵
    PID:5832
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fluxusz.app\EBWebView" --webview-exe-name=fluxusz.exe --webview-exe-version=1.2.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4700,i,2359154374708206211,6744032771355506274,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:8
    3⤵
    PID:6016
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fluxusz.app\EBWebView" --webview-exe-name=fluxusz.exe --webview-exe-version=1.2.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4820,i,2359154374708206211,6744032771355506274,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:8
    3⤵
    PID:6168
- C:\Windows\system32\cmd.exe
  "cmd" /c start "" "https://fluxusz.com/ks/"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://fluxusz.com/ks/
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://fluxusz.com/ks/
      4⤵
      Drops file in Windows directory
      Checks SCSI registry key(s)
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:5472
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x304,0x7ff92576c188,0x7ff92576c194,0x7ff92576c1a0
        5⤵
        
        PID:3584
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,7425585958466544403,3605527611523887557,524288 --field-trial-handle=2528,i,5437413246982569632,12545545111979750483,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:3
        5⤵
        Downloads MZ/PE file
        System Time Discovery
        
        PID:5876
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,16886494461227583555,15643513303117233853,262144 --field-trial-handle=2528,i,5437413246982569632,12545545111979750483,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:2
        5⤵
        
        PID:5676
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2192,i,2269441063888108554,10272858063985233802,524288 --field-trial-handle=2528,i,5437413246982569632,12545545111979750483,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:8
        5⤵
        
        PID:5780
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,8344403112916425785,13396284323768441798,2097152 --field-trial-handle=2528,i,5437413246982569632,12545545111979750483,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
        5⤵
        
        PID:2644
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,7978831139147094736,9200709938025850018,2097152 --field-trial-handle=2528,i,5437413246982569632,12545545111979750483,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
        5⤵
        
        PID:1948
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,17604026131665704904,5813455522719433445,524288 --field-trial-handle=2528,i,5437413246982569632,12545545111979750483,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:8
        5⤵
        
        PID:1428
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,5819442770666554610,5829619531216048487,524288 --field-trial-handle=2528,i,5437413246982569632,12545545111979750483,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:8
        5⤵
        
        PID:3120
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4948,i,9556515648188647789,6159996732242258394,524288 --field-trial-handle=2528,i,5437413246982569632,12545545111979750483,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
        5⤵
        
        PID:5200
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4948,i,9556515648188647789,6159996732242258394,524288 --field-trial-handle=2528,i,5437413246982569632,12545545111979750483,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
        5⤵
        
        PID:4156
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=6084,i,16389729486213176079,16462088633619181614,2097152 --field-trial-handle=2528,i,5437413246982569632,12545545111979750483,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:1
        5⤵
        
        PID:5220
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6224,i,4592361349945791412,1606089532109762761,2097152 --field-trial-handle=2528,i,5437413246982569632,12545545111979750483,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:1
        5⤵
        
        PID:4220
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6424,i,17555851796405599258,13986494280226284212,2097152 --field-trial-handle=2528,i,5437413246982569632,12545545111979750483,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:1
        5⤵
        
        PID:3240
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3400,i,2292331544302564808,14889362232289137718,2097152 --field-trial-handle=2528,i,5437413246982569632,12545545111979750483,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:1
        5⤵
        
        PID:3792
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3656,i,10577743404470146866,13131219450299079529,2097152 --field-trial-handle=2528,i,5437413246982569632,12545545111979750483,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:1
        5⤵
        
        PID:4652
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=7100,i,17985982981587356128,17081771066910011952,2097152 --field-trial-handle=2528,i,5437413246982569632,12545545111979750483,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:1
        5⤵
        
        PID:3360
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=7236,i,6913372077566375304,2980028513928171562,2097152 --field-trial-handle=2528,i,5437413246982569632,12545545111979750483,262144 --variations-seed-version --mojo-platform-channel-handle=7256 /prefetch:1
        5⤵
        
        PID:2756
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5888,i,16198970607412331118,7570552880059567963,2097152 --field-trial-handle=2528,i,5437413246982569632,12545545111979750483,262144 --variations-seed-version --mojo-platform-channel-handle=7292 /prefetch:1
        5⤵
        
        PID:5908
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,13251008868694846119,17081851306327539198,524288 --field-trial-handle=2528,i,5437413246982569632,12545545111979750483,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:8
        5⤵
        
        PID:2644
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,16895615918176498425,14948902642091355539,524288 --field-trial-handle=2528,i,5437413246982569632,12545545111979750483,262144 --variations-seed-version --mojo-platform-channel-handle=7516 /prefetch:8
        5⤵
        
        PID:5804
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=596,i,10014642737779012926,4323309075029808967,524288 --field-trial-handle=2528,i,5437413246982569632,12545545111979750483,262144 --variations-seed-version --mojo-platform-channel-handle=7560 /prefetch:8
        5⤵
        
        PID:6096
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,13678328113114567916,13393104167475270961,524288 --field-trial-handle=2528,i,5437413246982569632,12545545111979750483,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:8
        5⤵
        
        PID:5932
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5684,i,7660423544240967725,14680441559062389176,2097152 --field-trial-handle=2528,i,5437413246982569632,12545545111979750483,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:1
        5⤵
        
        PID:6208
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,6932829516235865744,1168980059399272706,524288 --field-trial-handle=2528,i,5437413246982569632,12545545111979750483,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:8
        5⤵
        
        PID:6304
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5824,i,4159591039444076852,17729482114946511950,2097152 --field-trial-handle=2528,i,5437413246982569632,12545545111979750483,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:1
        5⤵
        
        PID:6312
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3580,i,14698632512654696847,14264852817715471445,524288 --field-trial-handle=2528,i,5437413246982569632,12545545111979750483,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:8
        5⤵
        
        PID:6480
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=3548,i,3994395430259575172,12630249861961652609,2097152 --field-trial-handle=2528,i,5437413246982569632,12545545111979750483,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:1
        5⤵
        
        PID:6488
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,6155421010273526619,229155048512606577,524288 --field-trial-handle=2528,i,5437413246982569632,12545545111979750483,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
        5⤵
        
        PID:6596
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7668,i,5278109019635394837,4400984221546140764,524288 --field-trial-handle=2528,i,5437413246982569632,12545545111979750483,262144 --variations-seed-version --mojo-platform-channel-handle=7128 /prefetch:8
        5⤵
        Modifies registry class
        
        PID:7448
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7652,i,4571032146383668019,17408625461301490392,524288 --field-trial-handle=2528,i,5437413246982569632,12545545111979750483,262144 --variations-seed-version --mojo-platform-channel-handle=7588 /prefetch:8
        5⤵
        
        PID:7456
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=6112,i,11882298249635659839,17788985492464054206,2097152 --field-trial-handle=2528,i,5437413246982569632,12545545111979750483,262144 --variations-seed-version --mojo-platform-channel-handle=8632 /prefetch:1
        5⤵
        
        PID:7644
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=3720,i,4363981193210034293,13198293167981229729,2097152 --field-trial-handle=2528,i,5437413246982569632,12545545111979750483,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:1
        5⤵
        
        PID:7880
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7484,i,17368629572809812129,4020794043079139944,2097152 --field-trial-handle=2528,i,5437413246982569632,12545545111979750483,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:1
        5⤵
        
        PID:6304
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7424,i,1784511529912803212,10713246732054134730,524288 --field-trial-handle=2528,i,5437413246982569632,12545545111979750483,262144 --variations-seed-version --mojo-platform-channel-handle=7420 /prefetch:8
        5⤵
        
        PID:7080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=3568,i,6462882162477643489,10299484447078105628,2097152 --field-trial-handle=2528,i,5437413246982569632,12545545111979750483,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:1
        5⤵
        
        PID:5896
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=4708,i,7677864576744618500,6438436285024087560,2097152 --field-trial-handle=2528,i,5437413246982569632,12545545111979750483,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:1
        5⤵
        
        PID:2540
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7408,i,14436786567655289264,13447411860946225098,2097152 --field-trial-handle=2528,i,5437413246982569632,12545545111979750483,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
        5⤵
        
        PID:188
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        5⤵
        Drops file in Windows directory
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        
        PID:4764
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x308,0x7ff92576c188,0x7ff92576c194,0x7ff92576c1a0
        6⤵
        
        PID:6128
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,12338758674547741145,498090186603925204,524288 --field-trial-handle=2620,i,14074590754744675973,16926657221708022626,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:3
        6⤵
        System Time Discovery
        
        PID:7628
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,1158437706941646320,9667109649819063010,262144 --field-trial-handle=2620,i,14074590754744675973,16926657221708022626,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:2
        6⤵
        
        PID:7756
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2260,i,14052986396049777691,18059503642027165031,524288 --field-trial-handle=2620,i,14074590754744675973,16926657221708022626,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:8
        6⤵
        
        PID:7768
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,1783702752145056079,6606634730136823845,524288 --field-trial-handle=2620,i,14074590754744675973,16926657221708022626,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:8
        6⤵
        
        PID:6816
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,1783702752145056079,6606634730136823845,524288 --field-trial-handle=2620,i,14074590754744675973,16926657221708022626,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:8
        6⤵
        
        PID:1980
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,17190122727533091427,2626437815103642383,524288 --field-trial-handle=2620,i,14074590754744675973,16926657221708022626,262144 --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:8
        6⤵
        
        PID:8
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=136,i,8254182924092803351,9177039919495918923,524288 --field-trial-handle=2620,i,14074590754744675973,16926657221708022626,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:8
        6⤵
        
        PID:4524
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,5280225023594599040,5492969906061427129,524288 --field-trial-handle=2620,i,14074590754744675973,16926657221708022626,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:8
        6⤵
        
        PID:776

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5928

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:7620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a0ae5c88f5ac0e85f4d9ed9739dc5c3e836b51f8f94ab0a0a815e15e6d7f9fb2
MD5 b5a2f1f748ba778962692efcd65c8d46
SHA1 bb671310143003e711a647c035e09d5c9b63fe6c
SHA512 18b30f1e1406db7dccce315933d12fa9ab3f3ba1b2d57aa088711c7feb371c7428abcea821944af85d032f2606cae854aa9590c90f7206e3feba6d4938bce2fe
TLSH
T17FD0233577599C17C4F51471016143B52357C84578DFD2C5D22E401D4CD955673FB2C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 91928b2d827cb83592ed1c0c87588da2f0021f000b28d77dfabf410fc1e4e874
MD5 cc7e7d46c6e9805106023206fe22c6e6
SHA1 72ce11f67339205e0a2c8ad41b9c4a4fb6476d88
SHA512 45a6723d1e0774fae878af99a0298786399a81847cfd584f1a1231c6a5af30cfe87fbee5913e06509df96c8dc60324a6dd1ab3db022cad667ae4e1ca1eee1abe
TLSH
T162D02339B7495C13C5D518B5005043A17393444134AFD7C5512E242D5DE592572EB387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c5f64ffe0ef005cb506aa8c0fdb5b1968fd214691602fa39b06c714146a00d11
MD5 ce8b9dc683ab4cb6ed37e8ae6ecdaf66
SHA1 840af0ed6de01d8a36c209d5bbb9bb637ba87d0b
SHA512 2e43acfed3c5fb7c0ebd76557cb8c26f4dc16311e50bd46d1143e43ffb34b15da21da14229d9f73226cf40a0087fd8a45bd29d8bcb683b3b033860b6da0a12c5
TLSH
T16DD02335B7454D13C5C118B5005043A17393444134AFD7C5512E242D6DE493572EB387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 40a64a56a478a0fd099a66c59798b6e279b6b7a22b9c8f9d0e45f56135026fa1
MD5 032db306dcef8996b2e04b1c5fb92915
SHA1 02e99bb7c04d80a0b1c444a4a3141092712f9615
SHA512 12a489ea13d1adccd0f85ea48f28ceabf79d50bb27aa46f0f1f6549e12735380b43d6896a6cf0d0fe25fa658a6b4710cab9bb1e977ad5ee1195bab21537d0a4a
TLSH
T1B7D0806C15715C35CCD66970059577293736C862AD5397561877243C0CC345119AE5C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 216e5a58e94c95e4c592e121ed23c441ec531761e040f8880c57b5a0eeb12a05
MD5 f1f73be01fc9cb63975347633d0f1f5d
SHA1 f230981f769254dfada73ff34023c59d3fc9e431
SHA512 ca6d69ceaaab5881b54441e2b4497f43910120096c7a0d920d8c758912f79a2412a29a5ae43a3a7088a874b76ff84642d7fee5f4e8a9e542d4576447ad768896
TLSH
T19BD0806C15715C35CCE66970055577293726CC62AD5397561837243C0CC345115AE5C7
MD5 SHA1 SHA512 TLSH

Submit Download

5b175577-d767-4d65-bc67-a3b0718ba8bc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5b175577-d767-4d65-bc67-a3b0718ba8bc.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 4647547177dec85ba83c7c7a634b643b70ccc0f9336f544b6eea3c4d4165c18b
MD5 18aa206ff9225a50552e4f2c4c3a162b
SHA1 12fffbed169f4d7e54227470aec3227fe1c843c9
SHA512 b014a9c24fc27c027d2047a9cef275dae9936825d8394e42607df631c48c1b57c35a1c92e1f10bbfcc605389e8f80ad7ec6268a068dbfd9fcad9cf1d06e59911
TLSH
T170E022EACD20DC3B68FA071D2454064AEB58132F2B418D4B763D960C8FB023A4BD686C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 ca29f2c535f17c7cf9925b91eeb434aa904ee8ba125e1a6b45ad4ef0c9751d54
MD5 fd8921bff010ff9b9ef70dc4f8ceda42
SHA1 dcc93b7994033a573d407ac5aba23123c29d5ef5
SHA512 598a736e46367065abea8bd90d49faa9cf23111abecaf9d6ed3c6d721c56209209a496d3ddc831bd0b8e36087aba76aa7bb6f90f589dd60d5144c55836eb4aec
SSDEEP 48:KyQoVKtAiHdkgddlY6SFmLKXW3G5LEvINVEvnaWP8lZtS+4D14u0/CwI5kIDjKWl:KyQLOqWX0+W3fCEvndPAnK4v/CJHDO0H
TLSH
T125910B82999ACE19E7D6C4BC8DDF14EB323506DD14372E6B41C5087E59BAF5B0372430
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5968c2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5968c2.TMP
Size 3KB
SHA256 71add15b95ea2c28e912fbf3375788dcc974a45dcdaf557b0ac3b32f288ef32f
MD5 edb0ab99391dff197411b829b408e96b
SHA1 0451243db1888b5a7f4f6401140834032f6dae8e
SHA512 7de42ae0c5b4081683b82e62b40a74c5d8c8a9148922c0ac054bbf897a0e5ef9c301d00d76a97a4527660f115f7f2d4dc9478913c3fb20e04c526837a8d52ab6
TLSH
T1AA61A79259A5CD28E7D8C1BC8EEB14EF71354AED157B3E4A01D4543C0AB6F5B4376430
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 456B
SHA256 c5ce9aaf8ffdcb8a00463a7bf24001885e0a792f110c8db74a1e2f4392cb0e31
MD5 f23d2df21a39aa8d814cade6c37856c8
SHA1 233e65707015a53f83a0d53db03a4af8fab21ea6
SHA512 a7b50b8cafba80f6baca44b260f8379852c4176f3dd57168812f3b4b811d2ff340f09f8ce625cc2adecab2851cc33725cb729548a3da98b041387c7952077918
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 dc7afde5692a1d96b8d58cc85599917a96d325cead3eb3c0cccad6377c246e0c
MD5 306650e0a2e17f5a128dc616193fde37
SHA1 5a0ae998bbe916c7ab33de7c68f14a2d077cdd4d
SHA512 67a59ca3e3ade9c4ed598a84172189fe2b352a6ae2739203cc6677727e65edf69f21d21c53044cd2cbeaf08d7391c4a246273bd1fa98134edaf0ddd813ed3dfd
TLSH
T180E0DF0604CCD22D9018F8D793684308C2E3B44BAB8A3EC26B08CC8C7101A43AA8A295
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 24KB
SHA256 83089e5946d300d0d40aa0aab4a54e1008ca2fb75833f91c4d9b11f795a52f02
MD5 5402bd28b79161e7055cc95c6eac1c70
SHA1 96600c380aa4a40a1809fb6e72e20388d233a6c4
SHA512 1fa2d12a1e485e0a736549230881d1179911bd200c91c9fcb134dd0cdd557286d497c436bc4a65268b027859ed1bed0c68fa0cf9321b81ea8df10653aee6888d
SSDEEP 96:3BCx25EdZ1lWkmzsmTUyPtdDwdZSGg7IBMSqhwx/O0JutP2DcADux:xa2EyzJULw7IBMXY/YYcy
TLSH
T1E8B218D77E787813EB462A39212E3635C83BE5198FA2EEA07C11A0168DB446550B58BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 256KB
SHA256 da5f9cb78bf786f62a1e0daf888130a49fd9dc6f0d33e8776855724cc90ac952
MD5 adf69987ec0e65100f38a063241ce968
SHA1 e4d9d64168d2a7b44472bac6ba432c59751d08e9
SHA512 2739cd11973cba263e50f103459b3a0a1cc796ecdfaeaa85588b68b604556bd7590fc018927df5446d8852c7bcf406b5846c3e6da956b0bf523a366ae12e66fd
SSDEEP 384:4DY5+35y9GAAZGaND7cg/83uICtTBBI+vx7DXspU3iI+35yAZoaYYes28naRZNzL:48Y3s4jptTBBvsU3S3s/BP3su3s6
TLSH
T16C446D6F4E344815CF69407524E73C7AD9AAE07EDB62FA9075224030CDF323AB59889B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 1015B
SHA256 9845a726213eeb3f740f97212191f95a3c722f54e72b9d3f80e8d32cc9b904b4
MD5 78746c02d0d1fa7db984354eec48b94e
SHA1 064b8b36bd12749b0f0e33ab47d12a0c99e7dcc1
SHA512 67c0054ace1a3c2a608f75587fc5d712193661b3ae1bc1727144e9041047629ac376112d367c422fd1cf80718cea0ca7dc0dc0b2668795264d76828489100502
TLSH
T1BE1176BF24351A43D3A35DF86795339CE7025E4A9AC2F3F4E313E22A0ED09B86483110
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 4d18a5a79b784ca8904637d85f275903582f83d67ec830cc5a0ff09e5bd6c60b
MD5 524574fe62ed23b657a614664638d06a
SHA1 64d97e49727fb9c665a7ea3e47525b75ceaa5d1f
SHA512 a8fb77020d1cceb9bf2b2df8b652b780e8293d7932b346d9368f0c32bf5c0f6088ae5d6b18e7e389e12a7352ddd15007535d923dd644f418caf59f864158dd72
TLSH
T11CE0DFA144EEC16AA248B0DB9329A70AC3E53406EF8C2B829B04DC5CB145844FF862D6
MD5 SHA1 SHA512 TLSH

Submit Download

2dc924f7-c198-422b-9711-8c71ee6c4a0a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2dc924f7-c198-422b-9711-8c71ee6c4a0a.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 697e2c0f93c75cd9894c08b5743d7766f7255e14bcc121a6605f76dbbf463de4
MD5 8cfb094aac7e95a2144907a58b6608ff
SHA1 1a338b468d6cf24989810a37b032134fde532dd0
SHA512 8814e168a0e39b8706d8ec4dca732edbf4091bf2419723931197af3da49db1fafb7788e14a42c5f5477cabcf1099dbcdbd3415a0dd0c034b991f4bde67c9a5b6
SSDEEP 192:DMVOZWgoj7JEzZegswE0g5cYGj6oi9RD7f+7ZVs1wF9g2gZ6Ag9g1n7gIEZmvzQD:DMVOZWgojtEzZe9n0AcYGGoi9RD7f0ZB
TLSH
T166329BE3C3E4866DE85259F4AB183E1FCD190918432C3D7ACAE5AF4BA3E2471F14165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 e67505dd7ded28dfec82d32c7ae475c81da6843707288af863867be76c528f4f
MD5 a80c13816f932570e5fe1d25930bbc3f
SHA1 47d93e9cab65f63cced803ecb02dbca82c088417
SHA512 70cd612df238072e54352aad09f084a2aa0879f3db65b5be68ef6f9af6e2ac10a2597921cd5e944abaafd534070567b95cecc9a705e958e694f63b2b23994cbe
SSDEEP 192:DMVOZWgoj7JEzZegswE0ghRc1j6oi9RD7f+7ZVs1wBn7gIAIhQUZmEqV6vrJg2gT:DMVOZWgojtEzZe9n0URc1Goi9RD7f0ZE
TLSH
T1D832ADE3C3E4866DE85219F4AB183E1FCD191D28432C3D6ACAE5AF4BA3D2471F14165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 a56fc0c09bb58e3d27f80ffaab57c19e73108154787e6c3f6486d36a29a01df8
MD5 7802febe64303d061d17618f403a2e56
SHA1 e4e6b7b645dd3bade318933723149d1c62251e1d
SHA512 c5bf9ada681c2f015251e6a8e4247e09c86d8aa1321024d52ad42fef250c6cbcfb725aff49e1bb6404a3f83bab479ebd17214d365a9578fe61c6f3da3629324f
SSDEEP 192:sxZURAyMqZ/K1Ml8WmAP/fzs+WpVR0V3SscyAzodpeQL5qECHW6+WN6RFQQZb12u:sxZUpWO/fzs+WvR0XFSHbZ1I/tzQVSEE
TLSH
T1E392E617A5345ABF8DDAD219F645BB63D2F91422D2904E449AFCCE0C00E6BED220785F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 1e74f8df205cc8d8bbf2ecdc4a4569bceda91d0fcf1812e64169cce91c55c90d
MD5 422d0c61ae0ea34505bf16c086434b2a
SHA1 3f4775573c4ffee7abeee0222c0ca72818d7f05c
SHA512 7f6d2fbc5296480ccdc6f954648bbd4f6d882b4e867aa029a85cae733af01e898b3d2f8c1d011147955d17e06996a3a2ada910e6c3f8aa29b35b5269ef2583f2
SSDEEP 192:sxZURAyMqZ/K1Ml8MjAP/fzstZV3SscyxJzodpesqCHW6+WNOQ0c1d/zktdm3UQk:sxZUp7O/fzstZXDijHbBf/UQxEV
TLSH
T19872E8166A34997B8DDBD219FA45BB53D6F91532D2900E449AFCCB0C04E7BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 05488daf076d56d627bbb653f3bd7c5a2b129e52303f2702a2e06f11420b0820
MD5 8e7a10f436e70252e0d3ccd1a2823b93
SHA1 0694a31002fdab0ae6de75a12117ba7f2ad222d0
SHA512 dec2b30cf406046c28d932088d855e730af7ba0a434e7300b9eb0f6c702a1f50174dadd6045eda155c3d79ac2aca4db6aecffc2a52395f355c5fc054dc9a64fc
SSDEEP 192:sxZURAyMqZ/K1Ml8MiAP/fzs0ZV3SscygzodpZ5HW6+WNwc1d/YtA3UQ+OZIgjjJ:sxZUpqO/fzs0ZXh7Hbj/oQxjV
TLSH
T11062E7166A28997B8CC7D219FA45BF53D6F91563D1900E489AFCCB0C04E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 5267b1e2bddcca69b95364198e217a92b44f05a5e5bf5077904e9a6276777786
MD5 b088f8a1ef3ea653145e57e30a25eb5d
SHA1 fd949ffc2d3fd75af4701e0c7904fbd9292eb205
SHA512 e4cbf7ad08d1ec2662b2edfbb86ac85f6e30b592496bd67ef86b8d1019e16b802e702dbd49e2ef0d5ab4c00b95093ea53c7cefd9a81f93b5e2e4fcfe8b2814da
SSDEEP 768:wsk8noNT7pLuLn4vWvP5OF8F1+UoAYDCx9Tuqh0VfUC9xbog/OVtI/eLlkqHdvrM:wsk8nmFEn4vWvP5OFu1jaAI/eLiId8yE
TLSH
T113F2FB3B280CCB7E4F800E9CDC2A7E9F6DE4028F96D8895447E9984C03DA6EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 8f0285bf6f2da50a8505e99637fefb1149b0322e334a82db3ffd708ae2093c82
MD5 59a65ab7b46073f2b6a866bdce2dda1c
SHA1 2e6439b59c2cc0ea70194aece3986b6ec1da6f27
SHA512 130a2ef74e3884b618d0a4bdc52bc1726fae653382f9e6d99285b127f257b125d84a5f963f7a19103c6342947a7701283fd03b9d8b6321e0c79c97cd2391df56
SSDEEP 768:wsk8n557pLuL/PvWvP5kF8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPI/eLlkqHdvrox:wsk8n5PE/PvWvP5kFu1jauI/eLiId8yK
TLSH
T121F2FB3B280CCB7E4F800E9CDC2A7E9E6DE802CF96D8895447E9944C03DA6EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 4331d9d2b76df61f25e6083c705310539a404d1006ac1283f1b6ac94ccdcec08
MD5 fea373ace9960370bdf32ff7136fa6d5
SHA1 2263c331a70c8580a1bb2347739301e87a40a12e
SHA512 9bc8cc5b4ec9b8a4d40767fd53e64dc580b928f3bcc980269da55d27c9138d2a43c86e9a18e4a0e1fa5431489dee4526d6613440878f360b296b8e7156bcaee6
TLSH
T1A8E0DF7106C8E97961292483073D8308C2EDF407EBC83A82AF80CC4C6242A06B9962A0
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 316B
SHA256 ac23e0d3829851ef095fb354029306041b1cc25aab336338591c921bd24ec6da
MD5 ac73fee8faa323dfb403da23c922ca30
SHA1 e0d5711afcd4ccdc9712515fbbf7bb59e52c1a81
SHA512 6e8580da7ec037107e32f63be2f607067c38cdcdab2a3dbc2e9394765d22db9489b0f1c8e6dec96df1199c2aa48684202f43ea7c5af076425022ba6b65ae1e26
TLSH
T1A0E0C24133A00B05D91B6DB2B7B20B830358E07B219650F3519E8A21EE467FA7C5F1E8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 01a8bd9fdebb63ccd40cc2eb46c0db47e0c766f7df1010ae234371079e4495ef
MD5 3384bc2f9977afee279fb55cb7ba736a
SHA1 9e830b87a4676e63c2886b478f2b91d4e34f41f8
SHA512 2d4d065885364b503188e56a60bb76c9a4e58c972a70c399d0269a6b9019594145154fb9e4afd7fd8ed67b286cc19d8075e578bca88bb51facac3eef09af556c
TLSH
T1AFE0D83015D9C62B614964C7532CD308C1EBF407DBD82EA97F08D84C6306741B647295
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 670360557437b08d573a033129c07e3f0735dae26e2485fbffca6af0ba34aabf
MD5 7df8788867aeacc0e4475af8050c1516
SHA1 22642f8e91e407855927d9ed627ede6aae06f496
SHA512 6e5bb35eda3430fcec236a67b7d9e07305a389ca79e491303def90c94313cc344414c198af679357386649aaf0c38d5a441d096cc8ef3fa77a93607945243a29
TLSH
T1A5E0867045D9D639500974D743689B0DC2F6F80B9BC83FCE9708C84CA542766FAAE7D4
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 43a8114ef175d6953f1878acf0a96ef40136267441c54417c652a089eb32e633
MD5 7a032dd4d6a3a5a01c0a1e41f4c44219
SHA1 f0eb1f91a69dcf18d556a357160625f913e137ee
SHA512 a521afbe9d19aed34225a57c8539f5308efb06f15cb433ae9d00c8b5b36b7b45ed91ae9092acc99b0a1d3bf85d71516e55dcfceb1a1d47b7a516305769a516f9
SSDEEP 96:KcKoKziqGxeK6wyKawKfKAtKKOwSqSYKDCE9+KOAauVOK+0ZwQKpK+KKEKzCssAW:eflBf6532xxBzXcn5H3POrX0Vh9
TLSH
T188B23611757A02913A7EA9CA8595B82E46C331737418E43B7BB900B61F6BE20CDFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 dc33c2e645cb9c5dbc3371a774bbe80ae0f82fde0b7ae91d5f5c1d81ceeef4e6
MD5 39fbe76dc811c9919da29f86e0e2bc1c
SHA1 cc96c59bf38273cb421dfeb09cca5800d3b62980
SHA512 a30837ebe03ef4c23a7e8c7eb965c1ca2c8d21ff7424ea379fb68eb4fec6875ea7c1ef6ea286139d9021e4c3b529d1a70b575e56b16db993d491348d716ab10a
SSDEEP 768:OF4cmwg6rrhlLYVvr+7rOkwGLKB7ll1tIQTv:Tc9rEvPkFLKpll1S4
TLSH
T19DF2287DEC64C97FA8EE7F88A70E26129DE40177C5B85998D7D50F0C80B608DF706926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 c0f6f9849280d0ccbfef4ec0c72ffbcc2fbe30057da189c76e5b99be3eba75a5
MD5 dcc2f71852d8955d2cee5350cebae8db
SHA1 8d2befd3aaa8f4cb8cf3f7b67295164cc29f5865
SHA512 cceea0d43a41c98bfcac9c497d205b35d13a56c29d4298321c7b5148bef39c31c9fdbf6baae49c3295a20aadb32cc59393999c1352b5f9167a04e94d55392bfc
SSDEEP 384:nBiFrcXqnLsN78TUNTUlI4k+rDqOABA3XSI2Tvf7YVR1r+7rOQ24a1tTzNWQ3rNZ:oFzLmwg6rrRSIUYVvr+7rObv1tIQTv
TLSH
T1FFC25B76E898CDAFFCE64BC9A75A3603EEE04163C68C5ED4D5D81E0C00DB19D530B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 a43b4767cd6a206fc14547fb0ce22af977ef617f4bac16f65919150989502c0a
MD5 8f0076ebac03f947e30ed8eba2cfa4b9
SHA1 8433056c69b8e1cb2283271c40faa20a93f76303
SHA512 8ac9645b8da3518868d9d65d7c5ee449fc8bab326fe61077c07de21df2b4f67c74a16ead61872c2780f9a1fea2a96e17385e7569150edc22c4d8e926ba4f345a
SSDEEP 768:OF4cmwg6rrilLYVvr+7rOkwGLKB7ll1tIQTv:Tc9rBvPkFLKpll1S4
TLSH
T1FFF2287DEC64C97FA8EE7F88A70E26129DE40177C5B85998D7D50F0C80B608DF706926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 2c83a326aa1a3d70144f85bddfadef804ba08affa100a3a31663915acaa8502e
MD5 1b5c327a8f962cf25ff5f111f9f380b2
SHA1 e3436c5f70f7a93769b85693e7cf77a0243e43da
SHA512 1889084d6fe5984199c223d3daa6bd1b26db6e1ce5edf543d50221bb3e5f1fcf1e836d3f9a8c1a70899a0199b0542298ec701afae4821a71e46d761e84971a12
SSDEEP 384:nbiFavqMe3sN78TUNTUlI4k+rDqOABA3GSHTvf7YVR1r+7rOQU4augc1rN1k+5vA:2FayB3mwg6rr8SnYVvr+7rOvvpAw
TLSH
T1DBC23975E8A8CAABFCE68BC9B74A3607DEE04153C68C5ED4DAD81E0D00DB19D130B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 28073dc0c20fbefc1d63eb65d080541f04c3cfa7b247e6afd3aa62baacb21ddd
MD5 a74166b3b667167075bc962db0fae727
SHA1 e60475b831108747030dfdfc0ff15c1b74bda15d
SHA512 aa1458436d4cc1fe236f071ede0c2489b27a7a370270aafd43ffc8f1781c12b63acc8e32265d9ab37612c64351c5dd641c66c380749ef5df137f0810586408ae
SSDEEP 384:nbiFrcXqnLsN78TUNTUlI4k+rDqOABA3GSHTvf7YVR1r+7rOQ24a1tTzNWQ3rN1v:2FzLmwg6rr8SnYVvr+7rObv1tIQTv
TLSH
T146C25B76E898CDAFFCE64BC9A75A3603EEE04163C68C5ED4D5D81E0C00DB19D530B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 deabe6fd338127712727b226fe0d87d6f8b7beaab69c8cd182dc984afaf164ce
MD5 c1d2fa7357c86cb109c354902ef1c178
SHA1 81902460ea02b0fb3324218bcb00a8f63c2ac98a
SHA512 65fc75200187e71e40ac0ef6cc420acebf0acd6f0764fbd14ca4ebc7975426e5a3476ba32808504630bede25e6044a7949dc62a6966ce8d2478badc418c525b4
SSDEEP 384:nDiFavqMg3sNW8TUNTUlImkrqOABApF+VTvf7YVR1r+7BwRYV/Vw1mRJrN1k+5vt:uFayv3XwgRB+pYVvr+7BwRYk1mf9
TLSH
T1F0C25C75EC58C9ABFDE64FD9EB4A6A07EEE0016BC59C49D4DAD81E0D00C719D130B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 28473ff571096e731f9970b4f946595c3ed44359e000161b991800c26636e6cb
MD5 29508334f6ba683d49296e10d089ab19
SHA1 e0f94880b7b7f17a5866b0f863e47dd0d686ad00
SHA512 69e73f106e5202e1751adc5ace8a5047f7bd7b511e727975960c80526978844af6c656dbaaeae8a6b31ffe8881f2d4a9c85e5152f2580db61ea5b375291387bc
SSDEEP 384:njiFrcXqn0sN78TUNTUlI4k+rDqOABAoISDTvf7YVR1r+7rOQNw4a1tTzNWQ3rNZ:OFz0mwg6rrbSLYVvr+7rOkwv1tIQTv
TLSH
T1BBC25B76E898CCAFFCE64BC9A75A3603EEE04163C68C5ED4D5D85E0C00DB19D530B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 67cbf74951965cfa2ac5691cf987b9222c69cb3b10b48469d19de08807027d12
MD5 ec5f52e75caed2ba34cb6e029901c8d9
SHA1 d7a8162bba1ce006056f254a24f9a026ef2d0b48
SHA512 9b0034639c24e45fc7f78e76e45993e8ed4a3c78e1b052442aba7d50af2b1628ad41cbff0b29d2e1f17b78a067b7adef4a0e9ae54be984c3e3caf31898ce2c3c
SSDEEP 384:nbiFavqMg3sN78TUNTUlI4k2rDqOABA9GSHTvf7YVR1r+7rOQU4augc1rN1k+5vA:2Fayv3mwgSrr2SnYVvr+7rOvvpAw
TLSH
T1F4B24A75E8A8CAABFCE68FD9A74A3603DEE04153C68C5AD4DADC1E0D00DB19D530B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 933f3c8c486b92bda1f6343f014cb132adc8ff17dff0731d80af04e8da82ad87
MD5 b9bb0caeb6a3f4c41dd73f902b4c282d
SHA1 6a37123c07c6905c90db6ad96f42da3901e8668f
SHA512 86636a749fd579f3ba33c626cbc4570db4abad20b8e6f8b1ce5cba1e6b5ddf8d1ac6a1b04a51f47c88e090458d2311a6c9833271e5de6c4ca040616476190a28
SSDEEP 384:noiFavqMg3sNH8TUNTUlImkrqOABAJr+0Tvf7YVR1r+7rOQM4aRYV/Vw1mRJrN19:zFayv32wgRz+GYVvr+7rOxvRYk1mf9
TLSH
T1C2C26B75E894CDABFDE64FD9EB4A3607EEE04267CA8C5AD4D6D81E0C00DB09D130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 4fa4585bb2b3f5d8c623dfbbb7c48609f45d34162dcbb12660f5b910c5b3cd48
MD5 8be40f1e015cab2781d8c02b07340645
SHA1 4277a758a352ac25806c29219b11ce05e5a677b9
SHA512 5095194c62226503aa7a151e239f55850eff3ce7cbdf26dbe611fa7ca4b9008e463c8562e4829cdad77ae726c1b2073e55fc46389758759d645a3abcd20874a8
SSDEEP 12:TLH8PFUxOUDaaWZXiDiIF8izX4fhhdWeci2oesJa/Si3isnJazeSd0tmQQtAd0au:TLc5UOl0afDdWec9sJULsa+pejB5fc
TLSH
T16892DF236D351033E8EE4736FC8349910EB8136ED9A7B884CDE049621DB1BC1A2896F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 4af1a9b6dd70df70388d054bab80c5a7823d3c04e957dd9fb548312de2ee2feb
MD5 e830e5d07c11e100007d7331800969e1
SHA1 3fe95b285ca23768da19a697d9f212bdffc95a13
SHA512 12f8308dbc6f5e261812e2a248bce416cbb7144de9f503aebb83e5704c67c51d09c36377fd46a2fa8fe92b138c89727d61cd21ba2064fa8c6bb4354e54b3ffee
TLSH
T178E0021112014277C01C033010C71F103FF3841003E7430A1730527C1D323043D30F40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 177112aedef77dcf0a3cd69bfa234f4ee33c2dab9f332117e65da1b203a866e1
MD5 45e80ddd5f605ec776ef112ae6523df0
SHA1 84046e2e787a12bea3baa38c942bdf349ab93d88
SHA512 7e8accabc94b235ec8ffcd48ccff70e3a48a7d1fae18dc0ea4075965faa3ab1cab18ea0e8e5db839f1214e687adf064fe41384de4220ef40cc0256ac119e4bf9
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ce546ea0f00c807812e9c90829b0c2426216a40b53716011119a78204802d8f4
MD5 1e0537844592e02ce05b10be86fc02ee
SHA1 c605ee215c464076d3feb4a5b31659eed7c01ff5
SHA512 49aca7607e60fb18a0e326e17d063a6435bd214ed8d3c0f549404858f81971abf2c2e5bf20bf17f891dbedb63daf55174f7696f3e027eee505a1d58ad1b80233
TLSH
T117E00913530142ABC028133010C71F203EF3843003A7424A1F30927C2D323043E30B80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58c83d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58c83d.TMP
Size 392B
SHA256 f1d02b9861c69fae2b9ee161f81553db69980158a47a9bd68b0ee1ccec75c51e
MD5 dde174f28dc8aadf08cd7a34f1ef750d
SHA1 be506d4df0c987cb362f5b235a41d39bcea5fdfa
SHA512 9bcdf5dceb8c91b023926b73ea82ab3ccf4ee516595b0bf1ca1c7061cd57d11008f23bff900604cf2797e09836ef7e2b1de7996c5f15e9f65267cf1e7a660a54
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 cbbd637d666cf368d43c7d7bb641b0d0d8073d59715b0c3454b4e99f4e130b69
MD5 9490a3a9f66fbd6642bd21675142826f
SHA1 71364e4cf2f522b84801c9ebe34b99bea00ade86
SHA512 77b7261ae8c9c3e8b81ce7c358fc95ded2f670e5ef97de10040da02490e49d529f37091858d773f829ff99262b85be1b7bcf0b0552df92efcfdce8c18343a274
SSDEEP 3:MsEllllkEthXllkl2zERiK+l:/M/xT02zii
TLSH
T19E440405FFC40715C711153140D1C3501370D43105135747375104177FC55704C00040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f78d1668013b7fb0a4d16ac8bd1242532ffccbb8b27232ebae77e0fa547bdb73
MD5 f56bbb33ef6bd3e8f482fdb466f5438f
SHA1 14d66cfcdd04fda5ab4ee6146fae3ea99b15fea4
SHA512 5f40d8a9e75bbec0ca57e3c9d6ea01ea18751953f7c79444062157e71f5008d03d5a9774280612f6bb99bd7746be86b45d40d1e9bac0fa531cfa05ab75c4cac2
TLSH
T145414B5CB6E91108B3B76F5AABF7B86E443FB9372E06C59D10010E4F0A26B00C861737
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5472_1167014002\CRX_INSTALL\_locales\en\messages.json
Size 851B
SHA256 6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
MD5 07ffbe5f24ca348723ff8c6c488abfb8
SHA1 6dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA512 7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6
TLSH
T175012506E2516A2B03B2A12775613641F57045EA1200DCBB7A7CD41C9FB6DAB918BBD8
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.fluxusz.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 78a42a78ab09ad34a912c77b2dc718ef909f272771e909a1d66c4cfeb2ff3b71
MD5 837829dc8612895b3751e6973701a4da
SHA1 a39f1987559129b95b844ac15bcf2a81d04b2467
SHA512 5b15da4246c313404f2b1a7abc17abbfbb4e51b7c9a71cea3c9753b750623b96d42954b1f29b13021899d9fa26bef808dd6599bee0fd1d00238c18cf8e4bf6aa
TLSH
T1A9D0121632011534C81020330443A24C0401D50F84464044542EC96E1B080A04E03881
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.fluxusz.app\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 977045d699c435436a6db9a4b222165ef69e9de83b15944f35143ac7a297cbc4
MD5 8f9964aac46ac613adf504b5462924c0
SHA1 fc0b323b7192389686e32ae2b5439ea7d7f4199a
SHA512 dcf6aad327995360ce64c6d81855421570de278e0bb2e362f9951d4296ab7728ec655890ccff345f90b2f3eb1918ac1544b0aa0389b79f35d83ee0515f8469ba
TLSH
T110D0041471003410CD0110350451C35401115C044C5311440017445D0544051C543444
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.fluxusz.app\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.fluxusz.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 312B
SHA256 d943c72c176e5580609f8dee70f0a46da20ce02265c46705a8fa56a677f1ed17
MD5 319c47557c4bdc6018355d9144cdcac2
SHA1 10bba71a93a7f855dc8c5cc2014a31f3b733d3e6
SHA512 502fe0d004e8ce132210e1fd5da31c80a6f03b49c7938ccb656deb8705a40fc31f00fbe61d049985c76a1430fa3832a8870640ebbe150c186d4418fb8823429f
TLSH
T1FFE05E59A09DDA53CF5309389EC0084136328D356B023AA7877BB02A4456BC14203541
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586404.TMP

Path C:\Users\Admin\AppData\Local\com.fluxusz.app\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe586404.TMP
Size 48B
SHA256 e8ec869e81cec210b0f06c2b1ee707f9c9356819a15e08cf719f671aff7a69e7
MD5 1a49024b7a0d0d458f8e41c29fc3fb55
SHA1 85a5ecad7239f4248f0527cc73088c6d8f3d78d7
SHA512 1a3dfefa8f08f293761210aaba97ab90d60dcd17df228d378c77cb287f3170b2093d7a1d6cc00c1074458b7a6aca145f9af92aa86d39d8adc28e6a4d7f6f5c69
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.fluxusz.app\EBWebView\Default\Network\Network Persistent State
Size 2KB
SHA256 26ec4a62ea7ef2d633f595210362a0f37fce72a8533ebbf02ec32b1b459cb6b1
MD5 196d62d1f6e329029fa10a30f5ea5862
SHA1 ca20f74bc287fb9e209137e4b8f46ea8f6df7c5f
SHA512 9a936e0a3beb90db9ff6836ee1beb86fba62c9eb6ed9f2900c4c9123661ad0334f0cb2d6ae71f056834d12b27fcabb87c7fe89a5f705f134f821954fc137d645
TLSH
T1B751AEA3C3E8C66D895166E477343817C92E0519A2243D2BCDEBEBDA67D10B1E22124F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe590f87.TMP

Path C:\Users\Admin\AppData\Local\com.fluxusz.app\EBWebView\Default\Network\Network Persistent State~RFe590f87.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.fluxusz.app\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.fluxusz.app\EBWebView\Default\Preferences
Size 6KB
SHA256 69f3b4ce2cc454ad4884bf7d6927565cc23d4ba57cc9250ce60e075786fd1977
MD5 2f44f6dd090bd2edbce505ab8332d7eb
SHA1 814be6a5e19b122914f74b3cedb394d6cf76349a
SHA512 61a8b51609d4f16430a43199caf3140b00d78cdc6c9a69c5f78a1c6758404cb7bc45e2576f011ad110d4c945df9c68f8c6930495326b89a0a1faf84fcf1f20f1
SSDEEP 192:st60T+f8Z8paip/S+WiTr1GoxgvTBAgMC:stPT+bP/VAox9C
TLSH
T1F0E1A903AE24697F5CC7E6197A35BB16E2F9107265C50E94ABFC870C04E66CD230794F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe587ec0.TMP

Path C:\Users\Admin\AppData\Local\com.fluxusz.app\EBWebView\Default\Preferences~RFe587ec0.TMP
Size 6KB
SHA256 c9ee2d9369742fe7e17a362606432f35911826528c92a24cd4164131c64bb12c
MD5 65ad9ab296a24e83a899683b9a0aa33c
SHA1 c08aa36c27398fd5818771f9dbcb4ff75c9384ff
SHA512 17266f3277b64c3ee7f3462d81cba0f282043e3ac2ffbb1544be0b6308f26ab3aa76a9d623cb0927cf8fce2899953dc4bf5c9778ae700fba8a810599f6e0cc59
SSDEEP 192:st60Tzf8Z8paip/S+WiTa1+wxgvTBtgM8:stPTzbP/VlwxG8
TLSH
T1DED196035E68697F4CC7E619BA35BB16D2FA107266D50E98ABFC861C04D66CC230B94F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.fluxusz.app\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.fluxusz.app\EBWebView\Default\shared_proto_db\metadata\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.fluxusz.app\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.fluxusz.app\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.fluxusz.app\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.fluxusz.app\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.fluxusz.app\EBWebView\Local State
Size 1KB
SHA256 b6c2df5dae5b29cce8663ce6b918c823135a66da5681b9614e23de5e2d5bc396
MD5 0b0494ea152c1e5c51a57afed1750cbc
SHA1 795318af42764128108f9de55d20ce5c0f1c0ee7
SHA512 986fb5edd6c272c0469e3a7a4e5267c0c383b861a18b67206cc77bc0e92029f9ee6215b844307dd6b21f68648b31faba383b2ad08737b033cd86c49c550be7ff
TLSH
T12231C773E4A47B3A6DE35282F503BA971E304035C2948E8C65DD0B1811D71DC6B2BC3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.fluxusz.app\EBWebView\Local State
Size 2KB
SHA256 8bc7549fb6cedf0b6a9bd2fdf9b6e7348d96cc1bb58a089c6126139edcaa85b8
MD5 e8ad8683755862faa4dea16a323e8799
SHA1 f6b2541e86e2f4313a570ecc28532dbc497e60f4
SHA512 8f060900f44be94fdbcfc275e97e09fd5914e12759aa3883bc0862cf01ebf3f3441216a6a6dc8202cee013e512646541c7f0b6fd549456f1642302aee628e765
TLSH
T11951B433B854AB3B89E38690BC063F135E3541718A955FD4AADD0B1C00DB1AC2707C7B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.fluxusz.app\EBWebView\Local State
Size 3KB
SHA256 bb40b74e1a82f392bd54c0f6cbb373f45590a560f4b1ae6d51c6bf1adfcbbe6c
MD5 c8254dc93ffdfb2dc34cf72c4ae879b7
SHA1 5c1295e1b90c44f379e18f39bc1f09733cb1b770
SHA512 0636987450a03a6985b954009299b742f8871f166e0a36d49d5198344699c38eb9e6ece831d6c54c2b02083d944678f02b4dc49406b3171d74c530162718a2c4
TLSH
T14D717536A864A63B4DF39A51F8862B166AA55136D5D46FD8D9EC0F0C01D72DC2702C2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.fluxusz.app\EBWebView\Local State
Size 16KB
SHA256 77d71697bb2a0fb9075a3af8e6099e86d944fd6123a4c8d49c6a976684508d19
MD5 2b070f9a62df3e31d2304c7f6ad70246
SHA1 ce9368483e0d2288ffa6f5fa83a0aaf0cde7593c
SHA512 21c09136095c7ed5eba505cb5ff40ba24f19a93951645d0190f9381c2f16844390301b99813666d1777094c0ed68a9712172e37388295959792865f4a1f44e00
SSDEEP 384:zcfTPLdSWCUkEaV8DNYi0qnSXaqZvsNbLDCriIAxRUK:0TRMUVai1SKqv2D/jbUK
TLSH
T1CD72BE72AC78A62B09FEA965EA0735075AB5D065C2D42F8CDDED0F0E09C26CC1B16D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.fluxusz.app\EBWebView\Local State
Size 16KB
SHA256 67e8d147390f6a0bced27e8fba8c1aa1250215627a9a68d7a54b9b32b8d983ca
MD5 4e7735549092a3e12aeb441ed194279d
SHA1 cc38584d4a821a379e0bf31c3990fb18653f1017
SHA512 863688e986e26840803598e624acfbcd636f212750e1ffca185a5033cb7e88c4027a8873a1ba7b9b66c8f0d6e3428193d8f920f1add0d4607aa2d506f7009905
SSDEEP 384:z7fTPLdSWCUkEaV8DNYi0qnSXaqZvFNbuDCri1AxRUK:PTRMUVai1SKqvmD/ObUK
TLSH
T15972BE73AC79A62B09FEA965EA0735074AB4D064C2D42F8CDDED0F0E06C26CC1B16D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe57f80c.TMP

Path C:\Users\Admin\AppData\Local\com.fluxusz.app\EBWebView\Local State~RFe57f80c.TMP
Size 1KB
SHA256 4ab12995460e2d3f7ad4ea2d5a89b04d000955ef798c11b1b4283cd8abe91e76
MD5 0c1d37d40ce08802ed190b08edc473a4
SHA1 89379a8e3f745c761e123bccbead8df6d7398f37
SHA512 09a1f0452e629ee2e1ec9c0b44e6b53d074ddc7d2968686cbf0d044c5c03a09d06514547b93212b83a22c0a45205cf2fee7dd9fee5e512c2f10fb0702b2243a1
TLSH
T153219533D495BB3A79D24192F403BA862E60417586488E4CA5CE0719119B0DC5B27C7B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1800-27-0x00007FF9434C0000-0x00007FF9434C1000-memory.dmp

Download

memory/1800-278-0x000001CE824C0000-0x000001CE825EB000-memory.dmp

Download

memory/1980-1630-0x000001FC2FA00000-0x000001FC2FB2B000-memory.dmp

Download

memory/2052-88-0x00007FF943B60000-0x00007FF943B61000-memory.dmp

Download

memory/2052-89-0x00007FF9434F0000-0x00007FF9434F1000-memory.dmp

Download

memory/2340-257-0x000001CD1C810000-0x000001CD1C83E000-memory.dmp

Download

memory/2340-258-0x000001CD1C850000-0x000001CD1C85C000-memory.dmp

Download

memory/2340-259-0x000001CD1C870000-0x000001CD1C878000-memory.dmp

Download

memory/2340-260-0x000001CD254F0000-0x000001CD25519000-memory.dmp

Download

memory/2340-261-0x000001CD25520000-0x000001CD2555B000-memory.dmp

Download

memory/2340-256-0x000001CD1A4D0000-0x000001CD1A5FB000-memory.dmp

Download

memory/2340-1727-0x000001CD1A4D0000-0x000001CD1A5FB000-memory.dmp

Download

memory/4156-567-0x0000014E7B000000-0x0000014E7B12B000-memory.dmp

Download

memory/5020-1690-0x000001C518C30000-0x000001C518D5B000-memory.dmp

Download

memory/5020-280-0x000001C5143F0000-0x000001C5143F8000-memory.dmp

Download

memory/5020-279-0x000001C518C30000-0x000001C518D5B000-memory.dmp

Download

memory/5284-287-0x0000014001420000-0x000001400154B000-memory.dmp

Download

memory/5424-254-0x0000017DA8B30000-0x0000017DA8C5B000-memory.dmp

Download

memory/5424-255-0x0000017DACC80000-0x0000017DACC88000-memory.dmp

Download

memory/5424-1681-0x0000017DA8B30000-0x0000017DA8C5B000-memory.dmp

Download

memory/5636-90-0x00007FF9434C0000-0x00007FF9434C1000-memory.dmp

Download

memory/5832-283-0x00000197BABD0000-0x00000197BACFB000-memory.dmp

Download

memory/6016-1659-0x00000289B9F20000-0x00000289B9F21000-memory.dmp

Download

memory/6016-1660-0x00000289B9F20000-0x00000289B9F21000-memory.dmp

Download

memory/6016-1661-0x00000289B9F20000-0x00000289B9F21000-memory.dmp

Download

memory/6016-1658-0x00000289B9F20000-0x00000289B9F21000-memory.dmp

Download

memory/6016-1657-0x00000289B9F20000-0x00000289B9F21000-memory.dmp

Download

memory/6016-1656-0x00000289B9F20000-0x00000289B9F21000-memory.dmp

Download

memory/6016-1655-0x00000289B9F20000-0x00000289B9F21000-memory.dmp

Download

memory/6016-1662-0x00000289B9CE0000-0x00000289B9E0B000-memory.dmp

Download

memory/6016-1649-0x00000289B9F20000-0x00000289B9F21000-memory.dmp

Download

memory/6016-1651-0x00000289B9F20000-0x00000289B9F21000-memory.dmp

Download

memory/6016-1650-0x00000289B9F20000-0x00000289B9F21000-memory.dmp

Download