floxif | c8a3c96c237674d9a2e3f7a42fca6db095f0f1c0293edb292246c8b7f430589d

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_55baaf903f7f105a9d065b4ae5dcf845_elex_floxif_maze_rhadamanthys_stealc_stop.exe
Size 300KB
Sample260814-e17qpavcjc
SHA256 c8a3c96c237674d9a2e3f7a42fca6db095f0f1c0293edb292246c8b7f430589d
MD5 55baaf903f7f105a9d065b4ae5dcf845
SHA1 904a6501b8cf34575a7c666c0221d264f56fc2ea
SHA512 1506d162c370ec8cd4c15f7a362bfbd28af46e7d69a8f44ab9393e23d9faae49d9c6a2446387ba3e98115662e3352b468d6630d158ca1bac5521cf3f52c39a03
SSDEEP 6144:zoUjcw+/4r2v5icQUXTAJAy5GNRJAGBV+UdvrEFp7hKSP7w:zjclwuAcQasJAy8JAGBjvrEH75Tw
TLSH
T1C264AE1136D483FAD072023535F8A77055FABC794E7B8A4BB3940B0D4EBCA92A725727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery floxif trojan upx

Malware Config

Signatures

Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/files/0x000700000001b853-1.dat	floxif

UPX dump on OEP (original entry point) 3 IoCs

resource	yara_rule
behavioral2/files/0x000700000001b853-1.dat	UPX
behavioral2/memory/3452-4-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/3452-9-0x0000000010000000-0x0000000010030000-memory.dmp	UPX

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000700000001b853-1.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
3452	2026-08-14_55baaf903f7f105a9d065b4ae5dcf845_elex_floxif_maze_rhadamanthys_stealc_stop.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000700000001b853-1.dat	upx
behavioral2/memory/3452-4-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/3452-9-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	2026-08-14_55baaf903f7f105a9d065b4ae5dcf845_elex_floxif_maze_rhadamanthys_stealc_stop.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6088_1231025611\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6088_1575006736\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6088_1516408388\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6088_693161836\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6088_1231025611\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6088_1231025611\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6088_1516408388\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6088_693161836\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6088_1231025611\llm_user_input_extractor_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_55baaf903f7f105a9d065b4ae5dcf845_elex_floxif_maze_rhadamanthys_stealc_stop.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
252	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311551485227433"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4046655672-1449839301-2197395821-1000\{DAAAAE6F-98D2-44F4-8419-8465AF282457}	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3452	2026-08-14_55baaf903f7f105a9d065b4ae5dcf845_elex_floxif_maze_rhadamanthys_stealc_stop.exe
3452	2026-08-14_55baaf903f7f105a9d065b4ae5dcf845_elex_floxif_maze_rhadamanthys_stealc_stop.exe
2596	msedge.exe
2596	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe
6088	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3452	2026-08-14_55baaf903f7f105a9d065b4ae5dcf845_elex_floxif_maze_rhadamanthys_stealc_stop.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6088	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 6088	3452	2026-08-14_55baaf903f7f105a9d065b4ae5dcf845_elex_floxif_maze_rhadamanthys_stealc_stop.exe	90
PID 6088 wrote to memory of 468	6088	msedge.exe	91
PID 6088 wrote to memory of 204	6088	msedge.exe	92
PID 6088 wrote to memory of 252	6088	msedge.exe	93
PID 6088 wrote to memory of 204	6088	msedge.exe	92
PID 6088 wrote to memory of 204	6088	msedge.exe	92
PID 6088 wrote to memory of 4796	6088	msedge.exe	94
PID 6088 wrote to memory of 4796	6088	msedge.exe	94
PID 6088 wrote to memory of 5520	6088	msedge.exe	95
PID 6088 wrote to memory of 5520	6088	msedge.exe	95
PID 6088 wrote to memory of 5520	6088	msedge.exe	95
PID 6088 wrote to memory of 5184	6088	msedge.exe	96
PID 6088 wrote to memory of 5184	6088	msedge.exe	96
PID 6088 wrote to memory of 5184	6088	msedge.exe	96
PID 6088 wrote to memory of 5616	6088	msedge.exe	98
PID 6088 wrote to memory of 2472	6088	msedge.exe	99
PID 6088 wrote to memory of 5616	6088	msedge.exe	98
PID 6088 wrote to memory of 5616	6088	msedge.exe	98
PID 6088 wrote to memory of 2472	6088	msedge.exe	99
PID 6088 wrote to memory of 2472	6088	msedge.exe	99
PID 6088 wrote to memory of 5740	6088	msedge.exe	100
PID 6088 wrote to memory of 5740	6088	msedge.exe	100
PID 6088 wrote to memory of 4108	6088	msedge.exe	102
PID 6088 wrote to memory of 4108	6088	msedge.exe	102
PID 6088 wrote to memory of 5944	6088	msedge.exe	103
PID 6088 wrote to memory of 5944	6088	msedge.exe	103
PID 6088 wrote to memory of 948	6088	msedge.exe	105
PID 6088 wrote to memory of 3076	6088	msedge.exe	106
PID 6088 wrote to memory of 3076	6088	msedge.exe	106
PID 6088 wrote to memory of 3404	6088	msedge.exe	109
PID 6088 wrote to memory of 3404	6088	msedge.exe	109
PID 6088 wrote to memory of 4888	6088	msedge.exe	112
PID 6088 wrote to memory of 4860	6088	msedge.exe	113
PID 6088 wrote to memory of 2328	6088	msedge.exe	114
PID 6088 wrote to memory of 5272	6088	msedge.exe	115
PID 6088 wrote to memory of 5272	6088	msedge.exe	115
PID 6088 wrote to memory of 3204	6088	msedge.exe	119
PID 6088 wrote to memory of 3204	6088	msedge.exe	119
PID 6088 wrote to memory of 5548	6088	msedge.exe	120
PID 6088 wrote to memory of 5548	6088	msedge.exe	120
PID 6088 wrote to memory of 772	6088	msedge.exe	121
PID 6088 wrote to memory of 772	6088	msedge.exe	121
PID 6088 wrote to memory of 2596	6088	msedge.exe	122
PID 6088 wrote to memory of 4544	6088	msedge.exe	123
PID 6088 wrote to memory of 4544	6088	msedge.exe	123

C:\Users\Admin\AppData\Local\Temp\2026-08-14_55baaf903f7f105a9d065b4ae5dcf845_elex_floxif_maze_rhadamanthys_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_55baaf903f7f105a9d065b4ae5dcf845_elex_floxif_maze_rhadamanthys_stealc_stop.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:6088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x220,0x314,0x7ff98bf8c188,0x7ff98bf8c194,0x7ff98bf8c1a0
    3⤵
    PID:468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,13755164621933635845,9577846408739739158,262144 --field-trial-handle=2684,i,8922975548006146469,16723683182547856449,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:2
    3⤵
    PID:204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,13856389238428903115,2360793071572200100,524288 --field-trial-handle=2684,i,8922975548006146469,16723683182547856449,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:11
    3⤵
    - System Time Discovery
    PID:252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2364,i,6129547640836314904,2571059260766277371,524288 --field-trial-handle=2684,i,8922975548006146469,16723683182547856449,262144 --variations-seed-version --mojo-platform-channel-handle=2852 /prefetch:13
    3⤵
    PID:4796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,15485346964644554357,6908728703049168517,2097152 --field-trial-handle=2684,i,8922975548006146469,16723683182547856449,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
    3⤵
    PID:5520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,14084565411818893112,15382619584598220715,2097152 --field-trial-handle=2684,i,8922975548006146469,16723683182547856449,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
    3⤵
    PID:5184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,447239349878185682,1742849851455440938,2097152 --field-trial-handle=2684,i,8922975548006146469,16723683182547856449,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:1
    3⤵
    PID:5616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,11746110328591675717,4822483680267557204,2097152 --field-trial-handle=2684,i,8922975548006146469,16723683182547856449,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:9
    3⤵
    PID:2472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,17877444832663354955,6180533455698887452,524288 --field-trial-handle=2684,i,8922975548006146469,16723683182547856449,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:14
    3⤵
    PID:5740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,2687609844737763068,4359900398850743501,524288 --field-trial-handle=2684,i,8922975548006146469,16723683182547856449,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:14
    3⤵
    PID:4108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,6063948216074786757,2482185223740355921,524288 --field-trial-handle=2684,i,8922975548006146469,16723683182547856449,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:14
    3⤵
    PID:5944
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,11165703056962787708,7832243752079862127,524288 --field-trial-handle=2684,i,8922975548006146469,16723683182547856449,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
    3⤵
    PID:5132
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,11165703056962787708,7832243752079862127,524288 --field-trial-handle=2684,i,8922975548006146469,16723683182547856449,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
    3⤵
    PID:948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,8619630648255637068,5366601174329200489,524288 --field-trial-handle=2684,i,8922975548006146469,16723683182547856449,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
    3⤵
    PID:3076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,16934546187973925615,3821565542858502471,524288 --field-trial-handle=2684,i,8922975548006146469,16723683182547856449,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
    3⤵
    PID:3404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,17673678243921723581,7918090272027838591,524288 --field-trial-handle=2684,i,8922975548006146469,16723683182547856449,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:14
    3⤵
    PID:4888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,14211626725532689434,18209055561752182505,524288 --field-trial-handle=2684,i,8922975548006146469,16723683182547856449,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
    3⤵
    PID:4860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,4104461142474906023,2583985962198577073,524288 --field-trial-handle=2684,i,8922975548006146469,16723683182547856449,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
    3⤵
    PID:2328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,8083222182245075576,2489854221025193285,524288 --field-trial-handle=2684,i,8922975548006146469,16723683182547856449,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
    3⤵
    PID:5272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,8637363927464658165,2533931643256500375,524288 --field-trial-handle=2684,i,8922975548006146469,16723683182547856449,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:14
    3⤵
    PID:3204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=916,i,8735212369642740208,1061614647286620757,524288 --field-trial-handle=2684,i,8922975548006146469,16723683182547856449,262144 --variations-seed-version --mojo-platform-channel-handle=912 /prefetch:14
    3⤵
    PID:5548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6776,i,1539461677164023300,1841873926617552020,524288 --field-trial-handle=2684,i,8922975548006146469,16723683182547856449,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
    3⤵
    PID:772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6148,i,2911524537941613351,14123553226118026258,262144 --field-trial-handle=2684,i,8922975548006146469,16723683182547856449,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3856,i,1928308998073012321,17140754880613103697,524288 --field-trial-handle=2684,i,8922975548006146469,16723683182547856449,262144 --variations-seed-version --mojo-platform-channel-handle=1200 /prefetch:14
    3⤵
    PID:4544

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

symsrv.dll

Path C:\Program Files\Common Files\System\symsrv.dll
Size 67KB
SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
MD5 7574cf2c64f35161ab1292e2f532aabf
SHA1 14ba3fa927a06224dfe587014299e834def4644f
SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
TLSH
T17863F1372AB5807DDD210D37949F835AB771E5A76C20643FC25907D988B8DD0E3239AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e75f270f1371188bd7f350113eee1f4d141652add7af8e5f7af0ab47dac6d1f2
MD5 e0e7da4c84e8882b494037c575bd294c
SHA1 04d43c383ac5d232ee362aad151519414dc6db2b
SHA512 70d9ca23de3befb782d3d04a586490c626e7c63ad00fac39b0fd9adeae2c1d8413a5d2474e847fabb4f48bbf1384f1fcd10e67765d21ed94ac67795b274b3c2e
TLSH
T122D09294BB60A90CCC81B0322AE66355BA1598A1182D868900A5F07A9CA8AC246179AF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e35119268ad2455b6ec4314361db946ee09b095b28e62d25bbd7542d6be959b9
MD5 5c633da04aeb5bea485c08ea28f57d24
SHA1 1c5287022e764ef0bb6d895cd993be007ab68eba
SHA512 341697613439896bbdc5bae2e067bf2b52fd4ee959460166157f5fcf5f0647d000c9824a7394abad2ea244ee761164649972236a37dd919e413ac011474bb4b7
TLSH
T12DD09B947B50A50CCC41703229E5535579155461581D45450055F0799C646C246175BF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 8960d53eba19c57b71bcb48649f12b5a9fcab0a8c98e7ad7960c3600c2b67ef8
MD5 6540912b4913240e5d0ac15f9e41de50
SHA1 740244de0df3628e27100a4e6aa2f115b05ffba8
SHA512 5852b125a20137cb3b6719f0afeed6fe993a712791102ad0616fd61ae522bb179127af6e2ba44fc2e76f0501bfc6087def9463f273ae583c0ab5fe965f1193a2
SSDEEP 96:V56QBHVJ7F2m7CNRYK1IdHJWSXVIL05sefGdoLp3ituAeCp0sVB3La7Ajb9:7xTJ7JCTn1IdpWSFIL05sefGWLp3FCp7
TLSH
T149A10F65C6F591B9DB05563C249B8E3771E0E84A09436BC34C2D5D389B43FE588D20EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a1464.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a1464.TMP
Size 3KB
SHA256 a1493dbc47f9fcfc4bac82acf584a1907506ce94316996722c5f45ce4033e997
MD5 708aec6f8754100376203d5aebb9db81
SHA1 1dc835630466ca7a20eb006cf394ca713b4e0e94
SHA512 efc0072690b04b1da8b80b1c927f1f266177fa91d76171a60d7deec0ee998ed84d104e87d2da49ea3062f573e0a4848882a64090fff6221af3d74769e5ad9059
TLSH
T1B56186764BF286DAD7A6873A18EB9FB831F4F8464447AE0184645D3CCB47F2A5CE101B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 18a05974dc5874bde737d43752fa95524098cedb48ee041bb9383bbf1cffae2b
MD5 72f008fe69ab9147fc146cc33a26a28d
SHA1 27ad7097391c99b768164e8e000611c6166f8ce6
SHA512 a9e51373518a5e2867fe9ef607512d2166cc29db03ae128ce817b68d2719f24241003f22e4405ee0370d0dd01728f35388d137d5bfea76d448b30cf38e1fce19
SSDEEP 48:YALlNyOCDbNCDUCDPVafo7CCjhhnONzspWQzslOWzBCnOChsGWC7C+s2WgmgCIwq:DsOUN5OVaaZjhGpzBGOJG0itwBHXGLGy
TLSH
T198819AF3C3A5822DDA1195F0AA146F1FCF290456436C7D9A89E4AF1B93F2462E141B8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 ddfa1fa48584475641e675e71383814071c136b840300959c27f23f89e160d57
MD5 01b1aaced7f27f8ec108fd2d1be3b4b5
SHA1 baa05a2b4a47b01034d4856edad055a1799c8158
SHA512 99b8aaf2ba5b4d965b7b82484ebeea9137cff084f886b64cb8b4c69bb7c75f383137d2e52242d176cbdf9a9eb27c40cab7ec0afe4f4a95f24757a53fedc06a39
SSDEEP 192:sxR7R7yM/jK1Ml8wxx/fasKrKrjDzbndoA8pJD/g6+WNPWk/YELAiK3G/4IgVHJ:sxR7xnx/fasKrg0R/51/JmP
TLSH
T1C7720805A9249D7BCCD7D219F9517F93D6F81563D1901E48AAFCDA0C04E6AED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 f987558e7085beb6e4619ed69beaa9c42ea658d92ef8e3c552b9bd88eb2da903
MD5 d62db4a4b26c751077f7d2a4290f4990
SHA1 b5b0e57caa7dd3a4bbbd939cc7c5bc4e924cd3f5
SHA512 429c5ff19036b754209c78386b25bb212fd480699552b93020201c70494708f9e4f1e86c9615e80696fce9a18ac19ffcaffae5c1b4f191e772cd5a1562378ff7
SSDEEP 192:sxRUR7yM/jK1Ml8UQoxx/fascljZshfbndoA8pXD/g6+WNPWk/YEXOiK3G/4IgD+:sxRUxqWx/fasclNk70z/51/jmi
TLSH
T19F720845A924997B8CD7E219F9517F93D7F81463D1901E48AAFCDA0C04E7AED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 d5b0df4579c366f4c130dc20d60fce1290d33f04f699c3aa4e9413db59c5cf29
MD5 886201956dc247b1c96255c63dfafa12
SHA1 cd0dee7e82205c72bea1a88def94d0c8099e2f3c
SHA512 bd82adce5c1261f18ac88c59e5a0a018ab9928cbc731d7e3e7264086a7ab997cd9ee9294b35adf0af51bd86bc3edb26c93d25f45ecc96b9c662ade2a6abc173d
SSDEEP 192:sxRUR7yM/jK1Ml8wxx/fascrjZshfbndoA8pJD/g6+WNPWk/YELAiK3G/4IgDAHJ:sxRUxnx/fascrNk70R/51/JmY
TLSH
T1E7720805A924697B8CDBD219F9517FA3D7F81463D1901E48AAFC9A0C04E7BED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 844d8fb90fa06e9f3f7821f2de20a4b18d0b761682c3c3ae140bea08a52bee7a
MD5 f0385eb171b2879fccd0ad5fe689582b
SHA1 a9b5b8a4d30479ccde70f66309d93de6c0392c38
SHA512 2f0aeb673d6da0035ba334166bd799277e2f64bcae3030a4587a90f22cd3237deb4fc032a91c7fb71280169486c55d9ba83325fd48db11e4e8103cc0227e0d97
SSDEEP 768:0hii6W7pLuL7jaWgH7f3Q8F1+UoAYDCx9Tuqh0VfUC9xbog/OV2OV8RroV6a:0hii62E7jaWgH7f3Qu1ja5I8q5
TLSH
T108E2FC3B680CCB7F4F404ADDEC29BD9AADD801CB56D88D9447EA840C03C67EB551A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d14cf11d-cf09-41be-8796-c61d0d15221a\index-dir\the-real-index
Size 72B
SHA256 bd5b9dbb71f7b5f6a98b3b7ef8a097268334890b7736dce577267c2828affe3e
MD5 1bad5f17779b8bea27b959ccccdf74c6
SHA1 2d7ae86910bd77847748954bee1c61c2bf2cdd36
SHA512 27653fa3e9d3e3b85fdd4a9c3e26827439131250d34616353a3901ab30f7d4bc6b123eca43278c3c5d8a42d9de70c1cc665dbc92ed20558ad2680a142f440c34
TLSH
T138A0021403C01013C00312F07AD70A6632104A50A245938555900359DC5056595534CC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d14cf11d-cf09-41be-8796-c61d0d15221a\index-dir\the-real-index
Size 72B
SHA256 67751a88493d0197b439e9d3db432da164689aeddbf27a2029e0f3142f828f29
MD5 a467cf1be9e801621b966e381e1473e8
SHA1 981b8851ca381511382f3c0c766ed500cd953b5a
SHA512 0b76131593bf8374ad86782c01224b4690360b4033bd520a6460b1a6f9f5ddb59fdba63c916776578a6b4a45226ac68436dbe9ed96a9db72f44f05ba99f80c74
TLSH
T16FA0041003C00047D01311F375D343715750CC5CF1045F0740D10344CD51D7055C704F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ea0d575b-3472-4b75-b3a7-02aecd4232f6\index-dir\the-real-index
Size 3KB
SHA256 803510cda326bfd00d6fd46e16f0344d1dd2d404d4eedceb4359593aa06aca5c
MD5 8209d38cadb0044926a794be98158e09
SHA1 5b489c75275354e2576fe7d77db9d4018ae09538
SHA512 137a5490315185726aa21fd24ebadbf5ad49a12aeb12c7c24937c93420828b6c3fe4ad3a1a16f1a02942089eb380457c08abbf50ff41e707197cfc9d4338bac2
TLSH
T1B851F88F4C451D6DC96D50721CFA0881737A2CEE6BC989072AACD230BCC333A2D4825A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ea0d575b-3472-4b75-b3a7-02aecd4232f6\index-dir\the-real-index
Size 672B
SHA256 edbae368f8d5754851d8df3dd665586a1af367a166f8b8118bf4eb2546b0431b
MD5 28c0bd33a7b970cb5dd38058cb590367
SHA1 cb7c589bf248d3ec77f7d43d17c24a09982f7259
SHA512 60eb99ac981ab4633c04121b3a38545d8efbc96ea406ab9fe18137d8565b9fb12990cb8175fc8744370ffbc04953243a3ae8380156d85e78b4ffebf5e094f7d5
TLSH
T198010E8B8CD1680BCC32757B2A39358D373804ED22069D8B105D7135AD636348685260
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a260.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ea0d575b-3472-4b75-b3a7-02aecd4232f6\index-dir\the-real-index~RFe59a260.TMP
Size 672B
SHA256 b7f71456f28502e4b59c2986eb089f45fc137044c8d180a94d0ad9779522f8d1
MD5 fd201acca56262310d473774c90a45f1
SHA1 12b2226e2bb247106b6f2acee6b2296a56bfbf0d
SHA512 ab754d6a6a07e137c2a76bdecd50829a22aee0f244c0b885d6be3cb6696662d94694cd893e203fb6bf464922705678731a7d7637b1893e095ee41d2860c934eb
TLSH
T124012BD700D1FC07DD5665F53215E115733E0C303225DD4B21D7747E497133482C1652
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 6d4a131c13cd38831cfabc4bb278eea77f50020e54860a9e2a744a062ae43a7b
MD5 529fb55021723e7f10fb72ab39ca7f51
SHA1 6577f4929b0cfa2054995dbdbf2e112ec48f893e
SHA512 434808450afa7fdfd01ff9154190c07b3e3b2a0b37982fe402880c7359aad005242806658d550e8fd472fc3f8382649d1a4ed6a6c7ce91f537017d6ada72dac5
TLSH
T13DE068BB3DE71C50A85BC7D610748190001839D48A45EC8E861AE2CB51723013806C32
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 acc7304e547b7d0c51d7344414bdd97fecb9e2a71f323abf7a89bb967ff3510d
MD5 e37fbc0f740b416f182e1bbc5704c7a3
SHA1 81436e8851215e3572815621bd85f34fa948af38
SHA512 a0522286af5f8b5917316f858a51603b2ed35971bb64598c9782d30409cfdd26e4afc8112e4191666658f475d1c73737a2c0e8c5572ee5af2cbd617f635696f6
TLSH
T1FEA002559D65B075E0410270E4E601CD32A08DDC060922555AAC10B88C5054081E25A4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59fbbb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59fbbb.TMP
Size 48B
SHA256 74b12bc807be9767f6e8f55ca0deb84064b0a93ab6d5b3fa04bbae1a416c058b
MD5 04660db8963fd903d9de191f211ddc4b
SHA1 2492ae3168340122ef2fb412face75265c5c3c3b
SHA512 310ba0bd5c062694d5110cf940f9b3cb052c810e35409a94c4b2f19aef05cde86cb5d37a55d0f13de27c6fc3d45df12d93bdf2578fe3e758fa4d7832c7db2264
MD5 SHA1 SHA512

Submit Download

87ad183a-9c8f-40ec-87e2-5e1918686b35.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\87ad183a-9c8f-40ec-87e2-5e1918686b35.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 bc472487d40699d1ecf9db992d3d4160af2cdac0e84ae7f9efc4a16318484e00
MD5 849059f483fd4865023705685171153c
SHA1 9a178f1328b8979ec55e1113b6b350f0ddbeef67
SHA512 b03bcc1ce9a4061958c1d068d7a447fd72e52265e4a764c0351e95c307ac2314ae53673b25b0561dc0735838b4d89da653335c71e29c96daa0a6e5c29d31a257
SSDEEP 768:5g3MJqGwMDTK48dHeByERRFzjK3Y0SPi9PTk:5g3rGH248dHSyw/qSPz
TLSH
T102F2BFF0A8A9AD734CEBE249B6923757FFF0016394C45A58D5DCEB0E45C219D0B0BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 78d476bd022e927f46db7d10e5e89c9b76d03a90906f44d33ba30d6db619d5e8
MD5 13f26393adcf7d8393a15b914334487e
SHA1 0ce0ee9df34b6e1e12b17be07b6949f71836f8d9
SHA512 8a704fd48fe6dd14d90c968ce1fa757b86abf90e3d9f751a427d8d4600834b1cf1fe217b1869bfc78ede8db7c862235e33576c662f2c403958414dff9208859d
SSDEEP 768:crv+4UNbdH3nJqGGMD7K48dHeByERRFzjK3Y0SeVH1SCX:cbsbx3cGhu48dHSyw/qSEH11
TLSH
T1B613CF7068A9AD734CEBE249B2837797BFF0016384C40B64D9D9AB4E45861DC170FD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 1e238800f5ea92d85798f7370e1bca0d900091d5d33a8291f294c39fb1c64867
MD5 3fe7566b4a60090edeb57c65ff5381ff
SHA1 09b9475a848846541a4ca5cf478a73cd4f46dc69
SHA512 729c15fa571441ac2e03f199f0193627cb79a08ec0a25096424443b7f84df7a46450130fb33f5657bbe2b98c2f4cf1b214481db2983d795c16c79bd696314798
SSDEEP 768:Qrv+4UNbdf3fqG0/DxK48dHeByERRFzjK3Y8eVH1SCj:QbsbJ3SGg448dHSyw/SEH1Z
TLSH
T1EF03BE71A8A85E774CE792897683B657BFF4411382C41BA4C4DD6F4E868B4DC130BE2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 b0610f4965e50d15cd1bf41f5862405f002126db19ee1fd66a09e0a885740a0d
MD5 c3b0596f81c959c36bd68cc0d47b9fea
SHA1 8df2ea1d70cd8bfff1cd01d4c7f8c72b9f88c6b7
SHA512 5ff8ccdb910bdfc5d014a6a3753ec7b2681ee4b11257aa8280df9a326219e8fcc2dae842147e64de8b1e1ba9fb96ffcf8f48da41b56dd9f43aef7408a93d31bd
SSDEEP 768:Jrv+4UNbdf3pqGI2DSK48dHeByERRFzjK3J0SeVH1SCj:JbsbJ38GF748dHSyw/nSEH1Z
TLSH
T19503BE70A4A89E734CEBE249B193B797BFF4016385C44B64D4C9AB4E858A0DD170FD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 91ff7fad89d9928e017c4506d4437b7834a24370fadb183b9e0c74df3a6d2769
MD5 94fea0cd35e100de5cee71c6caf71b1b
SHA1 f0b6ad411cbf3484bb231b7d65d007b2af5b6c73
SHA512 fadbc8c6dffe81b0da6de7626b9b105f5535b2100413caf7ed1bb9571ffa130ce2e79f166d20adcdd7daaae52ce76ff51decfc2d133305bf489b3b208af32baf
SSDEEP 768:kFjW3fwgMJqGwgJK48dHeByERRFzjK3Y0SPi9PTk:GW3xGo48dHSyw/qSPz
TLSH
T14A037CB1D8A4DE679CE7D78AB7527747EEF0016385C8A994DAC8AE4D00C71DD070BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

553e82af-793f-4b9e-8554-5dedf3c1d02a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\553e82af-793f-4b9e-8554-5dedf3c1d02a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6088_1833062202\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3452-9-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/3452-7-0x0000000000920000-0x000000000095C000-memory.dmp

Download

memory/3452-4-0x0000000010000000-0x0000000010030000-memory.dmp

Download