floxif | 238fb83c5e4672820ed948ec8d8ac62cef7f02ecce78f56e82bc93ea606baa38

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 16:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_9b9ac620f02f6e64049b4f5c4dadd326_darkgate_elex_floxif_mafia_rhadamanthys_stealc_stop_tofsee.exe
Size 270KB
Sample260813-t4ftpscb47
SHA256 238fb83c5e4672820ed948ec8d8ac62cef7f02ecce78f56e82bc93ea606baa38
MD5 9b9ac620f02f6e64049b4f5c4dadd326
SHA1 30e2cd389d5d90286c9891fe21cc61e9db0ecd0e
SHA512 6e7813d7fedb842d0eb65c9de94422fbb6675e76f3874e1cc29248f84ad92c582379b92951a0ff36a15e811a2ccb571c7385dc0ba86cca2907224a93c2abac6c
SSDEEP 6144:E5mMt3GNTAI8gqeD+A6ra5LhocaDOWR+BV+UdvrEFp7hKbig:wIN/84+A6ra5lRWABjvrEH7a5
TLSH
T110449E213190C3FAD1A3163075F8A6B59DF9B83D4B7A51DBA7A4076D4F2C6E2872430B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery floxif trojan upx

Malware Config

Signatures

Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/files/0x001300000001c4ec-1.dat	floxif

UPX dump on OEP (original entry point) 3 IoCs

resource	yara_rule
behavioral2/files/0x001300000001c4ec-1.dat	UPX
behavioral2/memory/1972-4-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/1972-9-0x0000000010000000-0x0000000010030000-memory.dmp	UPX

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x001300000001c4ec-1.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
1972	2026-08-13_9b9ac620f02f6e64049b4f5c4dadd326_darkgate_elex_floxif_mafia_rhadamanthys_stealc_stop_tofsee.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x001300000001c4ec-1.dat	upx
behavioral2/memory/1972-4-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/1972-9-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	2026-08-13_9b9ac620f02f6e64049b4f5c4dadd326_darkgate_elex_floxif_mafia_rhadamanthys_stealc_stop_tofsee.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5348_1563471852\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5348_1563471852\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5348_305375637\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5348_412460146\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5348_412460146\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5348_2103781140\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5348_2103781140\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5348_1563471852\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5348_1563471852\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_9b9ac620f02f6e64049b4f5c4dadd326_darkgate_elex_floxif_mafia_rhadamanthys_stealc_stop_tofsee.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3808	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311126012357860"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{AD0F5617-796F-4E8F-899B-5D84EF511F7F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2836	msedge.exe
2836	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe
5348	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1972	2026-08-13_9b9ac620f02f6e64049b4f5c4dadd326_darkgate_elex_floxif_mafia_rhadamanthys_stealc_stop_tofsee.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5348	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 5348	1972	2026-08-13_9b9ac620f02f6e64049b4f5c4dadd326_darkgate_elex_floxif_mafia_rhadamanthys_stealc_stop_tofsee.exe	89
PID 5348 wrote to memory of 2920	5348	msedge.exe	90
PID 5348 wrote to memory of 3068	5348	msedge.exe	91
PID 5348 wrote to memory of 3808	5348	msedge.exe	92
PID 5348 wrote to memory of 3068	5348	msedge.exe	91
PID 5348 wrote to memory of 3068	5348	msedge.exe	91
PID 5348 wrote to memory of 708	5348	msedge.exe	93
PID 5348 wrote to memory of 708	5348	msedge.exe	93
PID 5348 wrote to memory of 5228	5348	msedge.exe	95
PID 5348 wrote to memory of 5732	5348	msedge.exe	96
PID 5348 wrote to memory of 5228	5348	msedge.exe	95
PID 5348 wrote to memory of 5228	5348	msedge.exe	95
PID 5348 wrote to memory of 5732	5348	msedge.exe	96
PID 5348 wrote to memory of 5732	5348	msedge.exe	96
PID 5348 wrote to memory of 4076	5348	msedge.exe	97
PID 5348 wrote to memory of 2088	5348	msedge.exe	98
PID 5348 wrote to memory of 4076	5348	msedge.exe	97
PID 5348 wrote to memory of 4076	5348	msedge.exe	97
PID 5348 wrote to memory of 2088	5348	msedge.exe	98
PID 5348 wrote to memory of 2088	5348	msedge.exe	98
PID 5348 wrote to memory of 2384	5348	msedge.exe	99
PID 5348 wrote to memory of 2384	5348	msedge.exe	99
PID 5348 wrote to memory of 4752	5348	msedge.exe	101
PID 5348 wrote to memory of 4876	5348	msedge.exe	102
PID 5348 wrote to memory of 4752	5348	msedge.exe	101
PID 5348 wrote to memory of 4876	5348	msedge.exe	102
PID 5348 wrote to memory of 4116	5348	msedge.exe	104
PID 5348 wrote to memory of 3412	5348	msedge.exe	105
PID 5348 wrote to memory of 3412	5348	msedge.exe	105
PID 5348 wrote to memory of 4836	5348	msedge.exe	108
PID 5348 wrote to memory of 4836	5348	msedge.exe	108
PID 5348 wrote to memory of 5700	5348	msedge.exe	110
PID 5348 wrote to memory of 1440	5348	msedge.exe	111
PID 5348 wrote to memory of 3004	5348	msedge.exe	112
PID 5348 wrote to memory of 4848	5348	msedge.exe	113
PID 5348 wrote to memory of 4848	5348	msedge.exe	113
PID 5348 wrote to memory of 1256	5348	msedge.exe	117
PID 5348 wrote to memory of 1256	5348	msedge.exe	117
PID 5348 wrote to memory of 3008	5348	msedge.exe	118
PID 5348 wrote to memory of 3008	5348	msedge.exe	118
PID 5348 wrote to memory of 3016	5348	msedge.exe	119
PID 5348 wrote to memory of 3016	5348	msedge.exe	119
PID 5348 wrote to memory of 2836	5348	msedge.exe	120
PID 5348 wrote to memory of 4332	5348	msedge.exe	121
PID 5348 wrote to memory of 4332	5348	msedge.exe	121

C:\Users\Admin\AppData\Local\Temp\2026-08-13_9b9ac620f02f6e64049b4f5c4dadd326_darkgate_elex_floxif_mafia_rhadamanthys_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_9b9ac620f02f6e64049b4f5c4dadd326_darkgate_elex_floxif_mafia_rhadamanthys_stealc_stop_tofsee.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffb126fc188,0x7ffb126fc194,0x7ffb126fc1a0
    3⤵
    PID:2920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,621243278776569550,5594087101330360483,262144 --field-trial-handle=2424,i,11050563455413843671,4281671665036008161,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:2
    3⤵
    PID:3068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,10441085953711934867,8512455458095397480,524288 --field-trial-handle=2424,i,11050563455413843671,4281671665036008161,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2416,i,938556735263738735,7752725756731195214,524288 --field-trial-handle=2424,i,11050563455413843671,4281671665036008161,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:13
    3⤵
    PID:708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3624,i,3482404347411849564,8954654557091990430,2097152 --field-trial-handle=2424,i,11050563455413843671,4281671665036008161,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
    3⤵
    PID:5228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3640,i,16161424291260257138,17460794302033211199,2097152 --field-trial-handle=2424,i,11050563455413843671,4281671665036008161,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
    3⤵
    PID:5732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4412,i,5802020355682863683,16728984524867144558,2097152 --field-trial-handle=2424,i,11050563455413843671,4281671665036008161,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:1
    3⤵
    PID:4076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4424,i,6357505515602307134,2598340098908368429,2097152 --field-trial-handle=2424,i,11050563455413843671,4281671665036008161,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:9
    3⤵
    PID:2088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3832,i,5386574728627621675,2442876052251492406,524288 --field-trial-handle=2424,i,11050563455413843671,4281671665036008161,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:14
    3⤵
    PID:2384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3844,i,17238191006643768887,6307180502613325998,524288 --field-trial-handle=2424,i,11050563455413843671,4281671665036008161,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:14
    3⤵
    PID:4752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,12242483054911828005,14201320502681773381,524288 --field-trial-handle=2424,i,11050563455413843671,4281671665036008161,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
    3⤵
    PID:4876
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,7516660027510460433,10494090606597130450,524288 --field-trial-handle=2424,i,11050563455413843671,4281671665036008161,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
    3⤵
    PID:2788
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,7516660027510460433,10494090606597130450,524288 --field-trial-handle=2424,i,11050563455413843671,4281671665036008161,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
    3⤵
    PID:4116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,17252094664623094902,4267146333030031847,524288 --field-trial-handle=2424,i,11050563455413843671,4281671665036008161,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:14
    3⤵
    PID:3412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6608,i,17985831972431618478,4828336817740276350,524288 --field-trial-handle=2424,i,11050563455413843671,4281671665036008161,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:14
    3⤵
    PID:4836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,3012379809652117179,12130454300923444513,524288 --field-trial-handle=2424,i,11050563455413843671,4281671665036008161,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:14
    3⤵
    PID:5700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,16073826762391694718,4825693486761831219,524288 --field-trial-handle=2424,i,11050563455413843671,4281671665036008161,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:14
    3⤵
    PID:1440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6912,i,7040503068799155027,11633502363281602920,524288 --field-trial-handle=2424,i,11050563455413843671,4281671665036008161,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:14
    3⤵
    PID:3004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3664,i,10602335713601871623,17142719501789441776,524288 --field-trial-handle=2424,i,11050563455413843671,4281671665036008161,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:14
    3⤵
    PID:4848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,4049766258370460446,13025871787768697760,524288 --field-trial-handle=2424,i,11050563455413843671,4281671665036008161,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:14
    3⤵
    PID:1256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=944,i,15446810067583101299,4528945904197610231,524288 --field-trial-handle=2424,i,11050563455413843671,4281671665036008161,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:14
    3⤵
    PID:3008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,5785485643669614723,6710756104581328828,524288 --field-trial-handle=2424,i,11050563455413843671,4281671665036008161,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:14
    3⤵
    PID:3016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6876,i,3827175776966814955,14731564057421940193,262144 --field-trial-handle=2424,i,11050563455413843671,4281671665036008161,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,5804476840190572965,11609973914479719356,524288 --field-trial-handle=2424,i,11050563455413843671,4281671665036008161,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:14
    3⤵
    PID:4332

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

symsrv.dll

Path C:\Program Files\Common Files\System\symsrv.dll
Size 67KB
SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
MD5 7574cf2c64f35161ab1292e2f532aabf
SHA1 14ba3fa927a06224dfe587014299e834def4644f
SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
TLSH
T17863F1372AB5807DDD210D37949F835AB771E5A76C20643FC25907D988B8DD0E3239AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 719f844e62c5a3916fba05dc2f32d02dadec54c424efb41ba161d1fca59227ae
MD5 e633a9ff8da83df3b4dca0ad6f30e5d9
SHA1 610df135117504b2857ee3cc03a5ac9797b10333
SHA512 56404607616c88e3d1268893aa0c748db1db04fe698a8f5d214c6a2a533823ff606c3f2a3f007d08bc16bd8838597597f9fdcfe0f631495c1928104ff11d002f
TLSH
T16BD0C0303948E188C9832172DCA033117310007020B147054031F42CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67b546fed422708faf33930b82ff4826bc323bc64f67af30b02bb9e565fa27ee
MD5 04925ec9b8ab191e010732cba0eeefe1
SHA1 a6847bd1b4e86ab3cf9f2a8e109e78b04f51204d
SHA512 25e65b33281d8c58aaf4bad265d912d01bcadd9284dc1ce818ccc1dcf59200f57de5e8d8f4ce5ef6da06c777b54dd4dbee7a3aad7a16da9542538e92104e9c68
TLSH
T1C7D0C0343948E288C9832172DCA033117320007074B147054031B41CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 f1cb28eb43b238f88d5c1562f883cb14bbb827802d5434c0560188f99932d6d8
MD5 6b8565fa08ee62a7531cb1ef96cdd38f
SHA1 1c9d0ac0056a8ba4bbeff44f04402f0bde755463
SHA512 484a97d6ab8feb7893c7159f6b44e7c394ef085c76c885c71c9a561be1622560e1358459c5759c02a8038afe07566bb191d9c8ece4002b461974fee28e423881
SSDEEP 48:tL9r6v/wVClGuD4ai/NVg6/+FaOja+CKQhvxNsffDAZvlloZ3e1/t:tLIQuGtp/NVg6/+F1EYffDAZno1QF
TLSH
T1D291EEE8BAEFE9F4DB9C187036520CCDAF2C89176F875B1260702DB394371A991D7059
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a0fef.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a0fef.TMP
Size 2KB
SHA256 01a381cf1fcad2c07935cd344b9a6bd0f81f6a461d5db757ce410ae5189366de
MD5 5094e9581fc77e223b800c5adba93f6e
SHA1 9f1cbccea5f62c2074b6244aa09c221bb27517df
SHA512 67b3dedd3a1ee539f94bc4e5b91d58326bc29f658b0a6c6949f2cdbb9c6903fc7d81ad02ff301cdf46fd2e1b7c3ffc854d6871aa67a6177ca37be7511c37d2e9
TLSH
T1B651B8C0A3ADFEF9C7A45C703AD208CD7A7C8C5B678B2E1881706570191A73E42EC0D6
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 b5b7cdd733eefaa50e6c77d920e4369313c6d72dd5700d2a32f89430499e5325
MD5 bba572ab98ee38124c99cfcf2f92e4a1
SHA1 d3fa90abc3e35651763b484313fdc54c099d79a0
SHA512 39ad1437c17d9b4ba9734fa8c83367caff625a547c1b3b4466f6c1259b66983d439f47f017d062f941d7e146116ad78ac640bdac3ce2e13d17d9740e2c8ebddb
SSDEEP 96:DDzO3m4BogVaZWZzBGO52JcTitwBHzHB4y:DDK3m4BogVaZWZ1752JcTitkTHB4y
TLSH
T11B81DCF3C3E5862DDA1195F0AA146F1BCF180452436C3D5A89E4AF1BA3F2871E141B8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 d359eb66fdabf358d90323199815b5fd5c50544edda219b40b27437c29c78323
MD5 c60a365228e060b19dfc8f18aae9992b
SHA1 0f9f8ba460781e34553d88cb03ef30b826394333
SHA512 2b2ae11d96c58dc5162ebad53f6ba575d6b005cfef51bf32c8e15acd0dfb1b1756ce3b70a1836bbfd8117412fb83feb95cd7756ca1a8c831b87bb35fa6094f74
SSDEEP 192:sxRSRfyM/jK1Ml8wxO/fBsgUzZTilb6boA8pJD/g6+WNPg8/YZ75qzs8G5IgV4J:sxRSlnO/fBsgU9TiQGh/57/WNG
TLSH
T17372E7156924597B8CDBD209FA417F93E7F814B3E5901E48AAFCCA0C04F6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 b5fd766ec5e027d568054cbe13b48a90cfbb2c4ce174ea9866db3abc0bd06fe4
MD5 d681fd7baf92b7078f345c073c76f46f
SHA1 0601a5dc7e621623160d641ff81240f461fc1d05
SHA512 b00dba1579130d3ccc68e14a147699249086561dcf6378c5aa512a6687cf082b3377030716c72b195c04295c08b0601e22a2064d1e02c5fb868e7c794039a90e
SSDEEP 192:sxR1RfyM/jK1Ml8wxO/fBsgUzZTilb6boA8pJD/g6+WNPg8/YZ75q7s8G5IgDy4J:sxR1lnO/fBsgU9TiQGh/57/aN/
TLSH
T16772D815B924597B8CDBD209FA417F93E7F814A3E5901E48AAFCDA0C04F6ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 b7de80e39b99ba9e65039472f1d224141132260894e25abaeb038de584505ca9
MD5 6e024b93a8194459a26496e01d66326d
SHA1 310ca064d736244b1ce3cbbdaf933da0b0fea4ec
SHA512 505dd9e45417d48fdeb0b399fb475cc8237d2444ef1812535a9b7545de4a3edd4c87a97a0385d4e8701dc3e3ead2907243d6cf7bbc72b40f0cbfd72e38b2a1de
SSDEEP 192:sxR1RfyM/jK1Ml8UQ5/xO/fBsgyzZTilb6boA8pXD/g6+WNPg8/YZ75ZQNs8G5Ic:sxR1lqLO/fBsgy9TiQGz/57/kNh
TLSH
T1E172D815A524597B9CD7E219FA417F53E7F814B3A5901E48AAFCCA0C04F7ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 a627bbc2e887a80fd84f48fb32e00dcf2463ee02368ebbb3aacb8d1c1beb9d43
MD5 92875d7cbe97b3eb42066f40be1aec7c
SHA1 8099326b0c40c20fce4558ac71577325e35f030a
SHA512 6f3aae779055f489b7197bba075914a3978422e1aba5dd39ef615457032ef29a17edf2e5a18c941d3b5ea95eb248667307e96dd3ccf1bc9b8bcde0c69d9da5a2
SSDEEP 768:kfISlS7pLuL7CvWgd5fWb8F1+UoAYDCx9Tuqh0VfUC9xbog/OVMRGSV2rroHh0xj:kfISlqE7CvWgd5fWbu1jaXRGU2YHh0xj
TLSH
T1FAE2DC3B680CCB7F4F8049DCE8297E9EADA801CF96D8C99447FA850C03C66EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1ea4c317-f588-434b-b2ee-af07c2becc76\index-dir\the-real-index
Size 72B
SHA256 d525aeb5d5eb901d748df3c4998f820c9a32f5e188ec224a64112ed6c2bc0aaa
MD5 e4fc02dbf2b7aad6f0296c75668856eb
SHA1 aa34b9234426ab0a34062fff8f27504408014421
SHA512 66307569dde7110ed3edf48a97b2e42f50dd2416ad49f6a6e7244181dfbf013a983b2dab21f1f8eab5c9a4af2227899ae7aae15a3e84e096ccd9b6f0fd1682dc
TLSH
T14EA0021813A43403C052E2B0779602452A955B501307175ED5A007D5E86064A554621D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f6d9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1ea4c317-f588-434b-b2ee-af07c2becc76\index-dir\the-real-index~RFe59f6d9.TMP
Size 72B
SHA256 b7a0e5bdc7b5028346e8d5dcf0a8f1fe8d3462b0eb3463530bdc3d9c34a7d8e8
MD5 e3985d02045f654b5c25ac339ffbb2b4
SHA1 fcafa2cc3abcb443d548efce796cb479b5460297
SHA512 2d5317b1262f7a6dec52b601787d0379d78a5b87039680c31125fac6ab8bf78c5aec0db0cf75570ad0195083fbef1c05afa16eccf6d809d3861c83658ae92942
TLSH
T185A00224438440B7C13711B13A920781B21188901290160758910C46CC51494C68704C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4bc08aaa-6fcb-475c-b058-dbfe78634a31\index-dir\the-real-index
Size 3KB
SHA256 dcc89df071cf0732c1a7aa81bf8190eee28e4cb02f4704e86c88e2774e4e4c1f
MD5 411303a146cf5cb5bfb6e34d21f6f979
SHA1 53f3cb2669a9b347a610fc75fbf8935a6567ef1d
SHA512 c9d79832e3ee384e3364105b05cb4305d72cfb71162095c71a5f50cba7f8240d9d358459f17e5bc33afff84ffdb4feb4a51553458e9155512d8f5d3784eb05c4
TLSH
T1C451C74E0C4A7E69CC5D11B228BA0C83733634FD96C45B07659CE934B8C33263C6A61A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4bc08aaa-6fcb-475c-b058-dbfe78634a31\index-dir\the-real-index
Size 144B
SHA256 dc891a68c52cb7c384ce480e0e05de9904e2dad5d7de739e950aa6d44a84b58b
MD5 42b154a5e07e384a85c3c811a75975af
SHA1 b3b34e5a8b2d6e271f4f4c58a2d0832c44ebb47e
SHA512 3716592a79447f57f30ca04788c21129578fcd158d4f570ae2667c8573e1fb3b6d5b87166248f21f2105f8266918d6f48d8f212937d93f99f4a8f180caf821de
TLSH
T1C5C09254CD5A88B9C90E493211BB306E2E290ADD4922272620DC2A16BCAA04D918A400
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a0ca.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4bc08aaa-6fcb-475c-b058-dbfe78634a31\index-dir\the-real-index~RFe59a0ca.TMP
Size 144B
SHA256 36655253f850bdc7cd68d1479a4ab0f123ba80de00d8934bebffe5b9bdca0bb3
MD5 6131452200deed4037202d11b6bcd857
SHA1 7fae80a48370f403390199b4e23e9f5e23defc18
SHA512 edc2e713df7647069b4f00801a0264fe7b1071d21de3350c150654adfd104e241e6cdddb818317286189eab6458ce93baa4b41c20f1736549d2edee1041ad67b
TLSH
T126C0122289858CF0CC1F0E702047D3482FAB0C111035531720DC4D8FD8F108C80CA540
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 f4c94e2ef8f1c9ef3e4a4c828925a12ba2e9bffb0b046736dc2da5b0b439eb61
MD5 1471c1a2595c15e0d8feeeb2ed3911b2
SHA1 27388624423cb4086eddb45a5b83f52590dba615
SHA512 3a84854eb2ab84498428b61ac55ab5d0ee05da9643c703f8b6d8d19b8b6e35a4366aa455ca83f77a4fc123c65f76e710b411c2556efd55cbd3644886c1756717
TLSH
T1A8A00221DF548141C0800F709372068C73988DA84B0B271951AC0469987817745A3D0C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f708.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59f708.TMP
Size 48B
SHA256 e18cf2cf9a9a2f0ccf42b55b68941db59dfe577cf8d6db3bdf559073dd19606d
MD5 8a8725dc903fa42513b533a5f69fb414
SHA1 ad4b5b3a77aacb0a380a364efb60121419f24fef
SHA512 e80801ab6ac0907b9da031b959f98c652b4bed0297f6ccef4791203f2d4eb08d21138936668b2a51e279523af2e57c0add593c3ed2546431de4d85ca6b3311c6
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 9f6e2b83bd2a23535d8e3afbdb89cd8f314f579800b9b66845eac53b9f8700bc
MD5 5423f2d5d831b8a293d00aa64a1ca2c9
SHA1 af537b11fdb08d0124bf7a2698ce97df9286f911
SHA512 730f231fc09c6d0e74d3f05f8fece5a7004d3898f5297474c04953952c30146bbc1af8444a7495b4f86f55c601484ee44819a4e2a62ce52db6e016a580cabb49
SSDEEP 96:KwDaKMEemvCKIkzLuKQs6y8IKZeyu7YMGG:cJh5VTi
TLSH
T1BFC1F447B17A426028BF251990A5C657DAC270B3321CE43BBBE904B64F2AF511EFDDC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a8500.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a8500.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 109cde2a737bd29d501e30831e973104ca057fac0cfa2cfad79a1e9542d7eeb6
MD5 51f6e622456bf2e6c47600b6d9e6db30
SHA1 3b790ef9b1534b69dddc3ac3741bcdd860c6cfb0
SHA512 9f93604e89ad277a1e98c739f690673563f3458680d775fb706c2264add69526d07e856f3562335fed56a9b38bdf6bb0ac662ee93c49d89ba0dc5f0fa5499860
SSDEEP 768:9rv+4UNbdq3s3qb0Aam6aQMGdjWca4Ghfw0PeU/:9bsbc3hWmaME6p7H
TLSH
T15FF2BF31A868D9739CB7A695F25B7A87BEB421B388C40E80D9D95B0D43970CE370BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 c72dd33dae05e42954b7af3f8af068764fdea31134419be1a8539cddbce47595
MD5 2695e6e1cd93caebdbf8b33864d7b678
SHA1 8f74ee40b670465fbe863016d9f1415041622606
SHA512 b5b206bb4dda89ad6cb75b6a58bb1d2d1638093c12dd6301e26f4caf288400aa780259fd47de9d10f80b674c64b64dc89687e8b47eb88196c81e21524d9469d8
SSDEEP 768:Zrv+4UNbdg3fF4pqbwAam6aQMGdjWca4Ghf908i:ZbsbW3fl6maME6p07
TLSH
T18F03BF30A868D9739CB7A695F21B3A87BEB411B388C44E44D9DA5B0D43971CE370BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 6340fc66fa36ac3f860a48feec871dbf562147be4857c917e194bd13315c799f
MD5 e365e69b516a7868b9433ec87f04b877
SHA1 788ddbc139e8c9d3eb17608a9282e633bad08b39
SHA512 1bb00ed43552f70e874dc5e7942f38059e967efdd8849438571736e327f27f4eca395630f5381b4c70bae7c82c851644bc29d9e01d37186af662a170a2d05d92
SSDEEP 768:8rv+4UNbdg3/FApqbu8Aam6aQMGdjWca4Ghf908i:8bsbW3/RLmaME6p07
TLSH
T14003AF31A868D9739CF7A195F21B3A87BFB411A348C40E44D9DA5A0D43971CE370BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 120e50b7c9b27efb3a09a1bc3ba395b964bb41ad0c6d7793a37cbdcdc1833f94
MD5 d6a1ac24742c9a14c80a8485b35adb3a
SHA1 0c2f310e36a26f0b416848230907e58a23f01630
SHA512 0d33e1d514065295a115cf899e5343f15fd01dba0446d43fdebc2d38ebfd07038e23ee2a45514019be9083bcf382191867f5d80fce4e3eda9987b20bf63accfa
SSDEEP 768:/rv+4UNbdq3ceqxAAam6aQMGdjWca4GhfBJ6PeU/:/bsbc34KmaME6pAH
TLSH
T11FF2AE31A8689973DDB79A99F21B6787BEB421A384D40E80D9D92B0D43974CE3307D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 2f99bad75a582197d510d7af8c71b6a2d8581fbe757bd6938a4431f59c55a081
MD5 ffb4a989f2c05ba7cf510a6f738aa602
SHA1 68bd3fc5040f9094d7d7632d6f2f834c2f0b532a
SHA512 e801a142a353ae2efd95b510eafcfb462381bd14aaeb2fecf5123609b35047abdc55706e8d183fe1e49097e76509eeb5b2df7ebcc5f31a688b72807ea1fe3a1d
SSDEEP 768:mrv+4UNbdg3EFApqbu8Aam6aQMGdjWca4Ghf908i:mbsbW3ERLmaME6p07
TLSH
T15C03AF30A868D9739CF7A595F21B3A87BFB411A348C44E84D9DA5A0D43971CE370BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 245ef247d6238b16c29f0c999e3217a69b3fda10f397306e44b5ba17ad7f2a6a
MD5 4743a040a70ec0b8757a44645645d63e
SHA1 330b0ee1d6be826bd2769f4c917f16fc4325ed7a
SHA512 ac6a48084837c2c1c67eea08fa38ac85ee7ac84f1b15c91259bb3cfdb40742d12e8b3c422ad3a5e0b88ad1aea8c638f73af9d767792e775b0727831249a03232
SSDEEP 768:AFXrv+4UNbdI3zwgoFA9XgAam6aQMGdjWca4Ghf908i:Absbm3a9maME6p07
TLSH
T196137D31E868DA77ACE79785F31A7A87FEF011A388C84DD4D9D95E0902970CE270BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5348_1319079171\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1972-4-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/1972-6-0x00000000000D1000-0x00000000000D2000-memory.dmp

Download

memory/1972-9-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/1972-7-0x00000000000D0000-0x0000000000105000-memory.dmp

Download