floxif | 99cf8ebce4806ff05a5c9e5e7ca6eb54d6664be8e8a01ab462c2ce1703a7c64a

Analysis

max time kernel
148s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 14:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-28_cde2eb76f6f1af5239d1f6b8e8145340_elex_floxif_glassworm_stop.exe
Size 6.4MB
Sample260528-sa8rysds91
SHA256 99cf8ebce4806ff05a5c9e5e7ca6eb54d6664be8e8a01ab462c2ce1703a7c64a
MD5 cde2eb76f6f1af5239d1f6b8e8145340
SHA1 9a61b09db89e57fb23d00bdf3d337e9d908c02ee
SHA512 4182770e91c87ea0d06b61a26c10e8f6a7e4ca781f98785214259b3939d372ef15253ec7b8b3f3a9ba0509e994a4581dfa6b98bca42f7a753d00582bd2ab4c36
SSDEEP 196608:q81Sglm9RLslS+dmPC4IiXWrBfpMXOfCG0lGN:THlCL3jqYX6FJCFGN
TLSH
T1E16633223EE0D6B1E07165F07AAAC77595B2FC390825948F53E84B192F386538F2D736
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery floxif trojan upx

Malware Config

Signatures

Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/files/0x0010000000025cae-1.dat	floxif

UPX dump on OEP (original entry point) 5 IoCs

resource	yara_rule
behavioral2/files/0x0010000000025cae-1.dat	UPX
behavioral2/memory/5144-3-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/5144-27-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/5144-29-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/5144-33-0x0000000010000000-0x0000000010030000-memory.dmp	UPX

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0010000000025cae-1.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
5144	2026-05-28_cde2eb76f6f1af5239d1f6b8e8145340_elex_floxif_glassworm_stop.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	2026-05-28_cde2eb76f6f1af5239d1f6b8e8145340_elex_floxif_glassworm_stop.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0010000000025cae-1.dat	upx
behavioral2/memory/5144-3-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/5144-27-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/5144-29-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/5144-33-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	\??\c:\program files\common files\system\symsrv.dll.000	2026-05-28_cde2eb76f6f1af5239d1f6b8e8145340_elex_floxif_glassworm_stop.exe
File created	C:\Program Files\Common Files\System\symsrv.dll	2026-05-28_cde2eb76f6f1af5239d1f6b8e8145340_elex_floxif_glassworm_stop.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_5956_2067262424\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1897192324\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1976092469\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1976092469\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1667844768\_locales\id\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-28_cde2eb76f6f1af5239d1f6b8e8145340_elex_floxif_glassworm_stop.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3792	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134244538191125781"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{66022BCE-8CF3-47C6-9AB2-A9DBECB18D63}	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5144	2026-05-28_cde2eb76f6f1af5239d1f6b8e8145340_elex_floxif_glassworm_stop.exe
5144	2026-05-28_cde2eb76f6f1af5239d1f6b8e8145340_elex_floxif_glassworm_stop.exe
5608	msedge.exe
5608	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5144	2026-05-28_cde2eb76f6f1af5239d1f6b8e8145340_elex_floxif_glassworm_stop.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5956	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 5144 wrote to memory of 5956	5144	2026-05-28_cde2eb76f6f1af5239d1f6b8e8145340_elex_floxif_glassworm_stop.exe	80
PID 5956 wrote to memory of 4576	5956	msedge.exe	81
PID 5956 wrote to memory of 3792	5956	msedge.exe	82
PID 5956 wrote to memory of 6044	5956	msedge.exe	83
PID 5956 wrote to memory of 6044	5956	msedge.exe	83
PID 5956 wrote to memory of 6044	5956	msedge.exe	83
PID 5956 wrote to memory of 2660	5956	msedge.exe	85
PID 5956 wrote to memory of 2660	5956	msedge.exe	85
PID 5956 wrote to memory of 2792	5956	msedge.exe	86
PID 5956 wrote to memory of 2792	5956	msedge.exe	86
PID 5956 wrote to memory of 5708	5956	msedge.exe	87
PID 5956 wrote to memory of 2792	5956	msedge.exe	86
PID 5956 wrote to memory of 5708	5956	msedge.exe	87
PID 5956 wrote to memory of 5708	5956	msedge.exe	87
PID 5956 wrote to memory of 4472	5956	msedge.exe	89
PID 5956 wrote to memory of 4472	5956	msedge.exe	89
PID 5956 wrote to memory of 4472	5956	msedge.exe	89
PID 5956 wrote to memory of 1860	5956	msedge.exe	90
PID 5956 wrote to memory of 1860	5956	msedge.exe	90
PID 5956 wrote to memory of 1860	5956	msedge.exe	90
PID 5956 wrote to memory of 5664	5956	msedge.exe	92
PID 5956 wrote to memory of 4704	5956	msedge.exe	91
PID 5956 wrote to memory of 5664	5956	msedge.exe	92
PID 5956 wrote to memory of 4704	5956	msedge.exe	91
PID 5956 wrote to memory of 5696	5956	msedge.exe	93
PID 5956 wrote to memory of 1912	5956	msedge.exe	95
PID 5956 wrote to memory of 3224	5956	msedge.exe	96
PID 5956 wrote to memory of 3224	5956	msedge.exe	96
PID 5956 wrote to memory of 3224	5956	msedge.exe	96
PID 5956 wrote to memory of 3428	5956	msedge.exe	97
PID 5956 wrote to memory of 3428	5956	msedge.exe	97
PID 5956 wrote to memory of 3428	5956	msedge.exe	97
PID 5696 wrote to memory of 1124	5696	msedge.exe	98
PID 5956 wrote to memory of 3936	5956	msedge.exe	101
PID 5956 wrote to memory of 1064	5956	msedge.exe	102
PID 5956 wrote to memory of 4548	5956	msedge.exe	103
PID 5956 wrote to memory of 2880	5956	msedge.exe	104
PID 5956 wrote to memory of 2880	5956	msedge.exe	104
PID 5956 wrote to memory of 6108	5956	msedge.exe	105
PID 5956 wrote to memory of 6108	5956	msedge.exe	105
PID 5956 wrote to memory of 3616	5956	msedge.exe	106
PID 5956 wrote to memory of 3616	5956	msedge.exe	106
PID 5956 wrote to memory of 4724	5956	msedge.exe	109
PID 5956 wrote to memory of 4724	5956	msedge.exe	109
PID 5956 wrote to memory of 5440	5956	msedge.exe	110
PID 5956 wrote to memory of 5440	5956	msedge.exe	110
PID 5956 wrote to memory of 5608	5956	msedge.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-05-28_cde2eb76f6f1af5239d1f6b8e8145340_elex_floxif_glassworm_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-28_cde2eb76f6f1af5239d1f6b8e8145340_elex_floxif_glassworm_stop.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.bandisoft.com/bandizip/
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7ffbda6ec188,0x7ffbda6ec194,0x7ffbda6ec1a0
    3⤵
    PID:4576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,14115334617691934487,18014507838522405672,524288 --field-trial-handle=2228,i,10236392641328738606,1874108171434374795,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1772,i,17726985623500791583,4827926836106943405,262144 --field-trial-handle=2228,i,10236392641328738606,1874108171434374795,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:2
    3⤵
    PID:6044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2400,i,18417408392868883464,12041225841380180147,524288 --field-trial-handle=2228,i,10236392641328738606,1874108171434374795,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:13
    3⤵
    PID:2660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,6062850258467175168,7173421513911706378,2097152 --field-trial-handle=2228,i,10236392641328738606,1874108171434374795,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
    3⤵
    PID:2792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,9513193537690304727,3521816614191838181,2097152 --field-trial-handle=2228,i,10236392641328738606,1874108171434374795,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
    3⤵
    PID:5708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4952,i,15635061871238234144,13706237187171946279,2097152 --field-trial-handle=2228,i,10236392641328738606,1874108171434374795,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:1
    3⤵
    PID:4472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5108,i,7189139171673939914,9693042428789631473,2097152 --field-trial-handle=2228,i,10236392641328738606,1874108171434374795,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:1
    3⤵
    PID:1860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,3686796119295932720,3951197888039309520,524288 --field-trial-handle=2228,i,10236392641328738606,1874108171434374795,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:14
    3⤵
    PID:4704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,13979553330244986933,8667043207294762771,524288 --field-trial-handle=2228,i,10236392641328738606,1874108171434374795,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:14
    3⤵
    PID:5664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,7444421080306974192,8200308778141651530,524288 --field-trial-handle=2228,i,10236392641328738606,1874108171434374795,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1104
      4⤵
      PID:1124
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,10232841814099652066,16485515560373474043,524288 --field-trial-handle=2228,i,10236392641328738606,1874108171434374795,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
    3⤵
    PID:1808
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,10232841814099652066,16485515560373474043,524288 --field-trial-handle=2228,i,10236392641328738606,1874108171434374795,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
    3⤵
    PID:1912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6396,i,14721957607970502288,9035921716990199292,2097152 --field-trial-handle=2228,i,10236392641328738606,1874108171434374795,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:1
    3⤵
    PID:3224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6464,i,4866939024205269335,8687898423264307,2097152 --field-trial-handle=2228,i,10236392641328738606,1874108171434374795,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:1
    3⤵
    PID:3428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,17125647274427169487,13538033234639030047,524288 --field-trial-handle=2228,i,10236392641328738606,1874108171434374795,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:14
    3⤵
    PID:3936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,13146313757492747504,17211605748154110735,524288 --field-trial-handle=2228,i,10236392641328738606,1874108171434374795,262144 --variations-seed-version --mojo-platform-channel-handle=728 /prefetch:14
    3⤵
    PID:1064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,1174587749980985464,15416048720355176442,524288 --field-trial-handle=2228,i,10236392641328738606,1874108171434374795,262144 --variations-seed-version --mojo-platform-channel-handle=7100 /prefetch:14
    3⤵
    PID:4548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,13362653175228515626,5520920087078421601,524288 --field-trial-handle=2228,i,10236392641328738606,1874108171434374795,262144 --variations-seed-version --mojo-platform-channel-handle=7132 /prefetch:14
    3⤵
    PID:2880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6992,i,3239671219716719389,13339869390530991007,524288 --field-trial-handle=2228,i,10236392641328738606,1874108171434374795,262144 --variations-seed-version --mojo-platform-channel-handle=7120 /prefetch:14
    3⤵
    PID:6108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7120,i,9719691584171338838,979997749808411841,524288 --field-trial-handle=2228,i,10236392641328738606,1874108171434374795,262144 --variations-seed-version --mojo-platform-channel-handle=7096 /prefetch:14
    3⤵
    PID:3616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,8009639295465327302,7201086034657198920,524288 --field-trial-handle=2228,i,10236392641328738606,1874108171434374795,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
    3⤵
    PID:4724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,15801487212571858297,9516083600007511799,524288 --field-trial-handle=2228,i,10236392641328738606,1874108171434374795,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:14
    3⤵
    PID:5440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6180,i,1937589210513193386,9456233549739076096,262144 --field-trial-handle=2228,i,10236392641328738606,1874108171434374795,262144 --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5608

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

symsrv.dll

Path C:\Program Files\Common Files\System\symsrv.dll
Size 67KB
SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
MD5 7574cf2c64f35161ab1292e2f532aabf
SHA1 14ba3fa927a06224dfe587014299e834def4644f
SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
TLSH
T17863F1372AB5807DDD210D37949F835AB771E5A76C20643FC25907D988B8DD0E3239AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 d84a5a90ab1d40dac7b99ce1bcfd6d17c8a18a5ce62aa8dc69a49007cb9d5865
MD5 e72cb93e115de9f52a37f7c8c054a780
SHA1 e6e2e1770913e4b129cce6cc793089f84218d212
SHA512 0aa263a8593498d9b9d10c3185163b6b882ca08013bb8c9e789b0751c572c8da357401ff67115c6159cff50a23faa6169d28ab49e65f58120ace0b6447ddfa53
TLSH
T182F0A9AAC931AC2718FD0B1970A9174AEB5113672780845F3B3D560C4FB563B468585C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a426157f9a7b0c0dceae6019c906bc59adc17c95b8884b68c3f90869f0944c50
MD5 7869fa74e687e71b5eab1a436d95de8a
SHA1 45f21025edd4a0b92dc0b435ec7f36ec00a8c0c5
SHA512 a5fcd13eb8d5ff78ffde7503eb6912dfc4d9d4f964b52abae684013d9a3aa2ace000f33ef8125cd538bcdcae7964476a96a5320ce6ce3a5a9bbabad0555b99b2
TLSH
T1AF81E61D04A13B47EF2E223DA0D419383971645B39673F1322B078724827BADD44EFC6
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58eb84.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58eb84.TMP
Size 3KB
SHA256 f401c1833858073db26bfc35502533ae1e7c10fbb79aaf3e8a605ea57863c91d
MD5 dbe4f267a462f8e3b36ac207894280b3
SHA1 d06463b5b66aa15da8b5cdc11aa7c24bc32d334f
SHA512 c5fa6842a83582ebf042f2e2aeacd062686eecd1c4cb55ce4159b794a963edf242cd4b64cd08987d6f2e64e5e726ec7dc968656861846e7205577f5327994026
TLSH
T17F712B1D01917703EF2C163DA0E4253871B2A45B3A973F6321B0B875542BBADC91EFC8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 90f34f5b0732eacf7ea703394e892c92749e0ac0d281755f4fba056fe412b21f
MD5 819b23215e28b23d7d8204ba2acb66e9
SHA1 ae7f4463325db101dfd1e630e82d1d914317f690
SHA512 f26b1d3eb0aba6d052cebc3ad9bdda7b0bffa01f7d5f3bb32052b6cacdc27fde80d115ecb0f6647e3710644be18882155eab543e6db30a8ac30dd5337f47b745
SSDEEP 192:D19vCJwegqiJRdJ9pJvaij6/1fzsyUIIeeap2/UQh2EKlH2PtFz7zPRoZPiobN:D19v6wegqaRdJ9pJvaiG/1fzsyUIIeVV
TLSH
T10D029EF383E8976DC95159F06A24AE6ECF2D0615836C3C1AC9E8AF47D3D2063E141A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 7975aa138265301fe73f3932c0d8ddf6a0393913c1f45d30e112eb789e341df3
MD5 a75c6e87385efd9209c7191912f4ad56
SHA1 0f0a6657d9ba2fb645fb37fe02317db05bf3498d
SHA512 d991deaaea2db5610192390f59e9c27c64f081b23e3d2a6b64b77723c4b9db46ab03112ff312eff4d5070f199e10df2592b74cfb767e1164aee11bcebeebc661
TLSH
T1DF3180F783F4856ECA0195F0BA18AE2FCE2D0515432C7D9A85E4EF1B93E3471E141A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 d519fbe51370e7b0473744812db509ecee896b0b4f4dc167cf4f1bbb26ce87d4
MD5 b924e69ac41c086012761b6df1a9006f
SHA1 d43c228e45acc3feac76c8e29cc0fcf48b304289
SHA512 4ea2346a572c5dd88c84b50e7a314053216176bd07eb77adf2c97456a6ea087c089eea7bcef621983c7e5c18680da0b50fefb7f9b4113e4e6f29ff379654f5c9
SSDEEP 384:sxZSV0A/f6s8Vl60Ly8WJ/bp/egKb3mhjC:sa2A/fas0o/bNeg+37
TLSH
T18E72D757AA38597B8CDBD319F555BB63D7F90522D6904E449AFC8F0C00E6AED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 87bd84c038f5dfc8d31b94e8f0bfa8fdfcd1286f32db15b456454424c47aad66
MD5 3fc7285c638528349eec1dc3ab09c2d3
SHA1 ce9ea786a38850aa48b94da0082cea84d5e46820
SHA512 19d37fae3388ae5acc4a14a8a7dca701d25df476c6e312178bc63c38030100c9a58b4449b4aa5e0b038691eedd773c1dc6a695041a27f0b9261b1a016baa6c0a
SSDEEP 384:sxZSVqKA/f6sdJ0Ly8WJ/bp/e37Kb3qh16:saEKA/fzJ0o/bNe37+3H
TLSH
T1EA82D757AA38497B8CDBD319F555BB63D7F90522D6904E449AFC8F0C00E6AED620382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 17da63599219cf4cd6ee92ad9494e387cd45cf5d0870baf1743df7aeb2a4f516
MD5 9715de88d5859d877332418dd2579cce
SHA1 34ef3ace8b7a3c7cff3a9d9884329e2fe097dc21
SHA512 207d22e1231cc1f42297a61ed30234a01e417d942ed1e116abd364ff9ce0aa8ab284d3e246931ae23ef2471ae4d4387ecdf4635960b9ecee1150c5ea9bed3ea3
SSDEEP 768:ciWKy8Eq2A17pLuLn5dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3B3pQLlH:ciWKy8Eq2ADEn5dWRm5rQW7u1jaKB3pw
TLSH
T132030B3B680CCB7E4F805E9CEC266F9A6EE8018B6698895447FA444C03C76EF55174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 05eafc30474161af5e4e65d51ce0fa4e88f502b708486f61cb6b759f672a3af1
MD5 9c2a10e56cc2ce5be43ba2fd45d905f5
SHA1 53f678be946acdaece428055d2e2c1b6ae991eb0
SHA512 c6971b6e2573caa96e0134877b6f6ecad7067ee62937a81f78f312f009ffc836ab1a2e48883f65034856855e174e0a9ec5efdd80d57699e90c939b853ae8e7e6
SSDEEP 384:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv7Gxz:AFBHhTofhno2mB21q3Llbfe3sLDdeEp6
TLSH
T195B28F56717B12023C3D290CA7929B370E8272A33458A56F7BB900BA4E67E215DFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 5f3083b8e58bf592b62a807805b6bcbf9bd9438106ec75b5115a49dc9074971b
MD5 30f51c3f6d2f69b90009300d51d59080
SHA1 7e8ff79e291d32062c72ce7e653990d9fad10766
SHA512 401abfd92d63d6c4ecd919c2b485b3271b3459dd74c74803015bdda3223f673ee289da2d3cc7c8ef2203d8eaab2b9da9650b59bc213fc471f24f67d1a9cdbf22
SSDEEP 384:y5hiFKurQXin91feruR38N78TUNTUlIR6y21qjkpfb7oV9Ph7OSmdlbkEms3GQiX:rFKurh9QrS3Iwg0rJoPMlkE58/7
TLSH
T1F0D24C32ECA8C9B7ECE65FD6B74A7A079FE44097858C9AD4DAD85E0C00C769D1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 7b7ebd754d3b386bc9eea381b48360d7356409f69a1bb299bb887bb6f4aaa21b
MD5 7df7b25673ca6b9c89a21f1e61df82a1
SHA1 c744a2ca781bdae606697df8439e0df19e420347
SHA512 a01f06dbbc773e84715327a54115400c96eadb0b68b876c6de4c53235bb0c158a7f5958a5d7bfba46354b03d35b2554bf8fe2a6a4392842246781b6da48415d3
SSDEEP 384:yGiFKurQXin91ferGeR38N78TUNTUlIR6y2Tqjkpfb7oV9Ph7OSmdlskEms3GQiX:kFKurh9Qrp3Iwg2rJoPMukE58/7
TLSH
T1C8E293F198E789B7D89E4B87A77E6D029EFCC053B5485584B7981D0CCC862BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 ea9251e868de59e92d1dee6518432402af42d79091c9795477ee6e291fb3d936
MD5 e53ffeb71391317e2919516f9b251030
SHA1 b6645d3ebf7d29ea94c9e1246be0c9245fe9a6cc
SHA512 71647bb32323041cc80951d62e297be9885ce44bd5dbab9c04d0282485407396a1723cb185b7453df6b4a64e4880c79f61f31eb4d420d4c8b208057d9e0b32a5
SSDEEP 384:yXiFKurQXin91feruR38N78TUNTUlIR6y21qjkpfb7oV9Ph7OSmdlbkEms3GQiKy:zFKurh9QrS3Iwg0rJoPMlkE58/7
TLSH
T1B3D24C32ECA8C9B7ECE65FD6B74A7A079FE44097858C9AD4DAD85E0C00C769D1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 7d67f5d20c001c280b367b120cdc94ad6b9fdcac13bf9f265713d8348923a00e
MD5 019b051fc8e183b0e60a9869a28a404d
SHA1 96b5e722445e86a07fbe278477f9f370dabd49e8
SHA512 34ee8f77212f212053a20b458d461ee07d4723c699beb07171446cc842422667739e15364cce12ed02dc5c308dbced6eaff40b65925d4f313bc64d0eb31c215f
SSDEEP 384:n58iF9CcmyWCs38NzA8TUNTUlIxBydvpoJajkpfb7oV9Ph7OSmdn0hkP+lFYS/Tn:xFccps3CAwgg27JoPMn0hkoFYS/r
TLSH
T1A0C24A32ECA8C9B7ECEB5FD9E74A7A06DEE011A3858896D4DAD81D4D00DB29D1307C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 f4611eb27982c7269e0317644f64aae0525f6a699faf3de98bcfbcb35508c04b
MD5 09be3bd1bb3119a55c7c9ab38a6cba57
SHA1 615de82022ce5fddae0ae9d220555666a9da8c90
SHA512 f86568259204ebd0c199eab3c3073c137ff1d03aef47a87f3344a676276dd468ff567222ee04c583e6cd0f329cd0478397c8869ec27bda857a4035db3d2ec23a
SSDEEP 384:n5hiFECcmyWCtR38N78TUNTUlIRTyw1qjkpfb7oV9Ph7OSmdl8kuHy/7Igv:uFPcpL3IwgHrJoPMykn
TLSH
T159C23B32ECA5C9B7ECEB5F99B74A7A03DFE04163858889D4DAD95E0D00DB19D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.28.1\typosquatting_list.pb
Size 507KB
SHA256 b34c96309ee41ff6d06dea8e605991b9b8c4d67fb4885cde883350c3b5ad674d
MD5 60b2b141019ad9ca0918db29dce42c12
SHA1 574e04a0a62023df2271a4633378f57320d33c8c
SHA512 918e6ea325b74876026691a37440441ffd3be78736595127ce77288e0bf3ab8597d52c62f94956f5567d1f985c2d38fa82f288ee330f8282f0e804ec2dc06b14
SSDEEP 3072:diBzZPXsIPv9aayls9OPzItqVCLWtQAMDvUlDetL81QFh9QGFFXaYllJzCWCD43s:ozZsIPv9akA0WuIDo/FhJFXNfFw43s
TLSH
T189B4C5B9DFC00194DB78112D20BE71D8181412A580E9DFEAFE7D855F2BC2AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 77e70e8b8743a25be5c59f81e522c4ff36a644045bc2ac516b55c20d92ebe356
MD5 c4b0d590ee04da586d12ebc5feb88ba6
SHA1 33e3f5b81fd46087b3774706cadb29c7f2f0d216
SHA512 8f84250c6ca92a38693bcf3125eac4f7ac8a7492e09f3424d24e14dda3b42348d897f9fbe6b93c5b4a0e4a889dca7822dcc924dc6a332f0e796240e7989fc3bd
TLSH
T1BB5160E05C7C2AC1D0BE0E6FA48B38FC82ECC325F4A4357D6818EA88097921D748083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 6a4aecd4ed148884a63e4abae2168c52414a1142610b58465aa6bdca459952a3
MD5 73c8164afa45fac88a61daee9f231ec8
SHA1 4a8d70370da9180edb84ed7527fc645da7e6baaa
SHA512 6f4f439006a7fb81fcd68936c2d3baf32e2abf509eae7e7e7e57e694a1818bd5c0fb783d1c3f84bab342dcf6fa8765809a161b3a28f55b6d068315418f35c28b
TLSH
T1A55130E15C7D1AC0D1BE1E6E648738FC81ECC726F4A4347D6818EAD90A7961D648087F
MD5 SHA1 SHA512 TLSH

Submit Download

d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 d6bb12722d8ec159af735b3270f83013e8b8e2df54df596eac54c458b11d445e
MD5 e6d52bbc2ba6378f83c8e079c3b58d30
SHA1 2768e8f09a3d414aaa25fb104cffb69e02b8198f
SHA512 40af0fc8008a9d3194c4718b4d0a75793b652b2ee28798bc85f27b90ee46c59025f8d0c8abeea9ff371c756962db066f2f00cee485b203e688a9ee8f2e48648d
TLSH
T171C02B8F243E4DCC4E4A02399048032B8FD07518302402388C0BCA00003DB0E5F4405F
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1897192324\data.txt
Size 146KB
SHA256 4d3b611b8b664c9b2e4503f41eabf3833860e521447c1dc921f0849e0c8633de
MD5 824a5940f80f495eec4743b1e719aa38
SHA1 1194b5bb383ef6fb33dcf906c99743f23cfaf790
SHA512 979860e2f4dbf25a3562c9e29c218f8d779a98a0f652dbfda04752f537d86f11bf8d27aad22d9b6ce16d34f734f9efb883e89ec326cc645506b7b163e429c2b6
SSDEEP 3072:TBPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEpASogqAlrE7FkEBih5:9X1aI5aZoKzMJ07N8gqAlrE7OXv
TLSH
T1D7E3F110CEC41FDCDFA9291C90BD0F0963E1C79E853BAA85EB63FE466F67A045617089
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1897192324\manifest.json
Size 52B
SHA256 98fd5d8bd64136534587ef4cd3f9151defa2a6dae9f0b269a2cbb06433c50336
MD5 4b38fcc473ed6f7c17ddfb82a738f25e
SHA1 ecdc59ae25620ddc8111f05fa358f9bd829ab553
SHA512 8a7b883c0f656ec7bca3c0239dc7f362db0375236f234844d07b4a9639e7c26a3fcefb1b6927e32bda3dfc2ca5cb1872a9b422fa7f8881d56409c33063176a92
TLSH
T114900260042491571AE10E606570F8859395761955950D1D04451548029946CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5956_1976092469\manifest.json
Size 118B
SHA256 1b90c1e9cbd34978ee21dae135f1ea9f51599d19014f9219cd47d730fd914f55
MD5 7cbc275e0cbde8ca623fc70c406367c3
SHA1 2b9fecd47ed8ad353bfdd958e0f5197f20dc370c
SHA512 6966dbc5899213f4b9d0e241409cd834f67ef2df35a5b437cb194893c6c6f7fcd8a33c0f22344a20682a84dabaa2d0f95b9d739e5d0a840a91fc2806e09e0b06
TLSH
T198B092B00C0BA47B22809720ECA166C283FC0218E8466B1A08C036481F9817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1912-288-0x000001C1EDA40000-0x000001C1EEA40000-memory.dmp

Download

memory/5144-30-0x0000000076B80000-0x0000000076BE4000-memory.dmp

Download

memory/5144-28-0x0000000002290000-0x0000000002291000-memory.dmp

Download

memory/5144-27-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/5144-29-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/5144-34-0x0000000076B80000-0x0000000076BE4000-memory.dmp

Download

memory/5144-26-0x0000000076B80000-0x0000000076BE4000-memory.dmp

Download

memory/5144-33-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/5144-21-0x0000000076B93000-0x0000000076B94000-memory.dmp

Download

memory/5144-7-0x0000000002290000-0x0000000002291000-memory.dmp

Download

memory/5144-3-0x0000000010000000-0x0000000010030000-memory.dmp

Download