6bb8c6421894c1cbacb7cab212fd5b16301293818936c2d5d196fa03966c2c5e

Resubmissions

22/08/2026, 17:47

260822-wct85afg928

22/08/2026, 17:26

260822-vz2faaam7w10

22/08/2026, 17:23

260822-vyc2asam518

22/08/2026, 17:19

260822-vv7fqs1zgs8

Analysis

user interaction
yes
max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 17:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Fluxity.exe
Size 10.7MB
Sample260822-wct85afg92
SHA256 6bb8c6421894c1cbacb7cab212fd5b16301293818936c2d5d196fa03966c2c5e
MD5 fefda162004e128738b49544a36cbb41
SHA1 47328255e1fb17f72fdb20b205e727a765f5540d
SHA512 8075f0a3e168c334e8ae29caa344f658b9f118e0955f5de452a71643a17453ebfc8c29760a2247c2be6a56951c2b30ca9c91d90b781002111da03253bb5fc7d3
SSDEEP 98304:/rcudqkgtzvaJrESIGVDlTxAo4zibX7f1DSpIdJDIOG:zc4CvaJrEZQHPfMMJsn
TLSH
T192B6D6516B9B99ACC19BC47083874A62497130DB0F39B9EF449496382F7EBF46F38358
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

bootkit defense_evasion discovery execution persistence ransomware trojan

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3796	powershell.exe
4088	powershell.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Fluxity.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	geometry dash auto speedhack.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_1150214309\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4320_1031557274\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_109_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_806678313\_locales\mn\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geometry dash auto speedhack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geometry dash auto speedhack.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2012	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134318944937061460"	msedge.exe

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\.md	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\㼀\ = "md_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Ậ׺耀	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\md_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\md_auto_file\shell\open	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	geometry dash auto speedhack.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\㼀	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\㼀ẢϺ耀䝀ㅩƮ\ = "md_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ậӺ耀뛠邈翺	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ậӺ耀뛠邈翺\ = "md_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\㼀ắۺ耀	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\md_auto_file\shell\edit\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\md_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\md_auto_file	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\.md\ = "md_auto_file"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ả˺耀\ = "md_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\md_auto_file\shell\edit	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\md_auto_file\shell\open\command	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{8C032580-1F9A-4F13-AD98-6E70D54A7719}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\ả˺耀	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\㼀ẢϺ耀䝀ㅩƮ	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Ậ׺耀\ = "md_auto_file"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\㼀ắۺ耀\ = "md_auto_file"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\md_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4088	powershell.exe
4088	powershell.exe
3796	powershell.exe
3796	powershell.exe
4088	powershell.exe
3796	powershell.exe
6164	geometry dash auto speedhack.exe
6164	geometry dash auto speedhack.exe
6164	geometry dash auto speedhack.exe
6164	geometry dash auto speedhack.exe
6164	geometry dash auto speedhack.exe
6164	geometry dash auto speedhack.exe
6196	geometry dash auto speedhack.exe
6196	geometry dash auto speedhack.exe
6164	geometry dash auto speedhack.exe
6164	geometry dash auto speedhack.exe
6196	geometry dash auto speedhack.exe
6196	geometry dash auto speedhack.exe
7124	geometry dash auto speedhack.exe
6164	geometry dash auto speedhack.exe
6164	geometry dash auto speedhack.exe
7124	geometry dash auto speedhack.exe
7136	geometry dash auto speedhack.exe
7136	geometry dash auto speedhack.exe
3940	geometry dash auto speedhack.exe
3940	geometry dash auto speedhack.exe
6164	geometry dash auto speedhack.exe
6164	geometry dash auto speedhack.exe
7136	geometry dash auto speedhack.exe
7136	geometry dash auto speedhack.exe
7124	geometry dash auto speedhack.exe
7124	geometry dash auto speedhack.exe
6196	geometry dash auto speedhack.exe
6196	geometry dash auto speedhack.exe
6164	geometry dash auto speedhack.exe
6164	geometry dash auto speedhack.exe
7136	geometry dash auto speedhack.exe
7136	geometry dash auto speedhack.exe
6164	geometry dash auto speedhack.exe
6164	geometry dash auto speedhack.exe
3940	geometry dash auto speedhack.exe
3940	geometry dash auto speedhack.exe
6196	geometry dash auto speedhack.exe
6196	geometry dash auto speedhack.exe
7124	geometry dash auto speedhack.exe
7124	geometry dash auto speedhack.exe
6164	geometry dash auto speedhack.exe
6164	geometry dash auto speedhack.exe
3940	geometry dash auto speedhack.exe
3940	geometry dash auto speedhack.exe
7136	geometry dash auto speedhack.exe
7136	geometry dash auto speedhack.exe
6164	geometry dash auto speedhack.exe
6164	geometry dash auto speedhack.exe
7124	geometry dash auto speedhack.exe
7124	geometry dash auto speedhack.exe
6196	geometry dash auto speedhack.exe
3940	geometry dash auto speedhack.exe
3940	geometry dash auto speedhack.exe
6196	geometry dash auto speedhack.exe
6164	geometry dash auto speedhack.exe
6164	geometry dash auto speedhack.exe
7124	geometry dash auto speedhack.exe
7124	geometry dash auto speedhack.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4064	msedgewebview2.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	4088	powershell.exe
Token: SeDebugPrivilege	3796	powershell.exe
Token: SeIncreaseQuotaPrivilege	4088	powershell.exe
Token: SeSecurityPrivilege	4088	powershell.exe
Token: SeTakeOwnershipPrivilege	4088	powershell.exe
Token: SeLoadDriverPrivilege	4088	powershell.exe
Token: SeSystemProfilePrivilege	4088	powershell.exe
Token: SeSystemtimePrivilege	4088	powershell.exe
Token: SeProfSingleProcessPrivilege	4088	powershell.exe
Token: SeIncBasePriorityPrivilege	4088	powershell.exe
Token: SeCreatePagefilePrivilege	4088	powershell.exe
Token: SeBackupPrivilege	4088	powershell.exe
Token: SeRestorePrivilege	4088	powershell.exe
Token: SeShutdownPrivilege	4088	powershell.exe
Token: SeDebugPrivilege	4088	powershell.exe
Token: SeSystemEnvironmentPrivilege	4088	powershell.exe
Token: SeRemoteShutdownPrivilege	4088	powershell.exe
Token: SeUndockPrivilege	4088	powershell.exe
Token: SeManageVolumePrivilege	4088	powershell.exe
Token: 33	4088	powershell.exe
Token: 34	4088	powershell.exe
Token: 35	4088	powershell.exe
Token: 36	4088	powershell.exe

Suspicious use of FindShellTrayWindow 23 IoCs

pid	Process
4144	Fluxity.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6216	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 4064	4144	Fluxity.exe	89
PID 4064 wrote to memory of 1632	4064	msedgewebview2.exe	90
PID 4064 wrote to memory of 2704	4064	msedgewebview2.exe	91
PID 4064 wrote to memory of 2704	4064	msedgewebview2.exe	91
PID 4064 wrote to memory of 2704	4064	msedgewebview2.exe	91
PID 4064 wrote to memory of 2704	4064	msedgewebview2.exe	91
PID 4064 wrote to memory of 2784	4064	msedgewebview2.exe	92
PID 4064 wrote to memory of 4368	4064	msedgewebview2.exe	93
PID 4064 wrote to memory of 4368	4064	msedgewebview2.exe	93
PID 4064 wrote to memory of 4368	4064	msedgewebview2.exe	93
PID 4064 wrote to memory of 264	4064	msedgewebview2.exe	94
PID 4064 wrote to memory of 264	4064	msedgewebview2.exe	94
PID 4064 wrote to memory of 264	4064	msedgewebview2.exe	94
PID 4064 wrote to memory of 264	4064	msedgewebview2.exe	94
PID 4064 wrote to memory of 264	4064	msedgewebview2.exe	94
PID 4144 wrote to memory of 3796	4144	Fluxity.exe	95
PID 4144 wrote to memory of 4088	4144	Fluxity.exe	96
PID 4320 wrote to memory of 1612	4320	msedge.exe	104
PID 4320 wrote to memory of 2012	4320	msedge.exe	105
PID 4320 wrote to memory of 2576	4320	msedge.exe	106
PID 4320 wrote to memory of 5816	4320	msedge.exe	107
PID 4320 wrote to memory of 2576	4320	msedge.exe	106
PID 4320 wrote to memory of 2576	4320	msedge.exe	106
PID 4320 wrote to memory of 5816	4320	msedge.exe	107
PID 4320 wrote to memory of 760	4320	msedge.exe	109
PID 4320 wrote to memory of 760	4320	msedge.exe	109
PID 4320 wrote to memory of 760	4320	msedge.exe	109
PID 4320 wrote to memory of 1452	4320	msedge.exe	110
PID 4320 wrote to memory of 1452	4320	msedge.exe	110
PID 4320 wrote to memory of 1452	4320	msedge.exe	110
PID 4320 wrote to memory of 944	4320	msedge.exe	111
PID 4320 wrote to memory of 944	4320	msedge.exe	111
PID 4320 wrote to memory of 944	4320	msedge.exe	111
PID 4320 wrote to memory of 2552	4320	msedge.exe	112
PID 4320 wrote to memory of 2552	4320	msedge.exe	112
PID 4320 wrote to memory of 2552	4320	msedge.exe	112
PID 4320 wrote to memory of 2532	4320	msedge.exe	113
PID 4320 wrote to memory of 2532	4320	msedge.exe	113
PID 4320 wrote to memory of 3768	4320	msedge.exe	114
PID 4320 wrote to memory of 1844	4320	msedge.exe	115
PID 4320 wrote to memory of 3768	4320	msedge.exe	114
PID 4320 wrote to memory of 1844	4320	msedge.exe	115
PID 4320 wrote to memory of 800	4320	msedge.exe	117
PID 4320 wrote to memory of 6060	4320	msedge.exe	118
PID 4320 wrote to memory of 6060	4320	msedge.exe	118
PID 4320 wrote to memory of 1288	4320	msedge.exe	120
PID 4320 wrote to memory of 1288	4320	msedge.exe	120
PID 4320 wrote to memory of 5760	4320	msedge.exe	122
PID 4320 wrote to memory of 5760	4320	msedge.exe	122
PID 4320 wrote to memory of 3168	4320	msedge.exe	123
PID 4320 wrote to memory of 3168	4320	msedge.exe	123
PID 4320 wrote to memory of 2824	4320	msedge.exe	124
PID 4320 wrote to memory of 2824	4320	msedge.exe	124
PID 4320 wrote to memory of 2824	4320	msedge.exe	124
PID 4320 wrote to memory of 1388	4320	msedge.exe	125
PID 4320 wrote to memory of 1388	4320	msedge.exe	125
PID 4320 wrote to memory of 1388	4320	msedge.exe	125
PID 4320 wrote to memory of 4332	4320	msedge.exe	126
PID 4320 wrote to memory of 4332	4320	msedge.exe	126
PID 4320 wrote to memory of 4332	4320	msedge.exe	126
PID 4320 wrote to memory of 2884	4320	msedge.exe	127
PID 4320 wrote to memory of 2884	4320	msedge.exe	127
PID 4320 wrote to memory of 2884	4320	msedge.exe	127
PID 4320 wrote to memory of 4060	4320	msedge.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Fluxity.exe
"C:\Users\Admin\AppData\Local\Temp\Fluxity.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Fluxity.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.dvrk.fluxity\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4144.4620.7571140532354307925 /pfhostedapp:3f2602ccb0305fea4c5865e5cfc3561888c9d6f6
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4064
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.dvrk.fluxity\EBWebView /prefetch:4 /pfhostedapp:3f2602ccb0305fea4c5865e5cfc3561888c9d6f6 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.dvrk.fluxity\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x148,0x16c,0x7ffa8d8f5fd8,0x7ffa8d8f5fe4,0x7ffa8d8f5ff0
    3⤵
    PID:1632
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.dvrk.fluxity\EBWebView" --webview-exe-name=Fluxity.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1736 --field-trial-handle=1740,i,3695821222157800390,11434099719516248603,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:3f2602ccb0305fea4c5865e5cfc3561888c9d6f6
    3⤵
    PID:2704
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.dvrk.fluxity\EBWebView" --webview-exe-name=Fluxity.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2088 --field-trial-handle=1740,i,3695821222157800390,11434099719516248603,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:3f2602ccb0305fea4c5865e5cfc3561888c9d6f6
    3⤵
    PID:2784
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.dvrk.fluxity\EBWebView" --webview-exe-name=Fluxity.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2256 --field-trial-handle=1740,i,3695821222157800390,11434099719516248603,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:3f2602ccb0305fea4c5865e5cfc3561888c9d6f6
    3⤵
    PID:4368
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.dvrk.fluxity\EBWebView" --webview-exe-name=Fluxity.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3376 --field-trial-handle=1740,i,3695821222157800390,11434099719516248603,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:3f2602ccb0305fea4c5865e5cfc3561888c9d6f6 /prefetch:1
    3⤵
    PID:264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ws = New-Object -ComObject WScript.Shell; $s = $ws.CreateShortcut('C:\Users\Admin\Desktop\Fluxity.lnk'); $s.TargetPath = 'C:\Users\Admin\AppData\Local\Temp\Fluxity.exe'; $s.WorkingDirectory = 'C:\Users\Admin\AppData\Local\Temp'; $s.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3796
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -WindowStyle Hidden -Command "(Get-MpPreference).ExclusionPath | ForEach-Object { $_.ToLower() }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffa77b8c188,0x7ffa77b8c194,0x7ffa77b8c1a0
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2120,i,1112210280759550587,890118145219958927,524288 --field-trial-handle=2360,i,15400548239875447152,5019395969755535085,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1936,i,16436894406782503162,801164265637579462,262144 --field-trial-handle=2360,i,15400548239875447152,5019395969755535085,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:2
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2660,i,5391775267544577971,6887282326224592111,524288 --field-trial-handle=2360,i,15400548239875447152,5019395969755535085,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:13
  2⤵
  PID:5816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,14520027140058258887,5326674570423620739,2097152 --field-trial-handle=2360,i,15400548239875447152,5019395969755535085,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:1
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,4964953818937697683,1353255571880847780,2097152 --field-trial-handle=2360,i,15400548239875447152,5019395969755535085,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4372,i,2519982187890741767,5037347698938197023,2097152 --field-trial-handle=2360,i,15400548239875447152,5019395969755535085,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:1
  2⤵
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4384,i,14967852057870512900,13084854608096259850,2097152 --field-trial-handle=2360,i,15400548239875447152,5019395969755535085,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:9
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,8780585498822708461,6411349140259270110,524288 --field-trial-handle=2360,i,15400548239875447152,5019395969755535085,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,3607310901022436779,14886487125962226463,524288 --field-trial-handle=2360,i,15400548239875447152,5019395969755535085,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,3261117894276108775,447774006316580225,524288 --field-trial-handle=2360,i,15400548239875447152,5019395969755535085,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,8137142150004091296,3258024773915170098,524288 --field-trial-handle=2360,i,15400548239875447152,5019395969755535085,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,8137142150004091296,3258024773915170098,524288 --field-trial-handle=2360,i,15400548239875447152,5019395969755535085,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,5552991286939348494,3514119523828089294,524288 --field-trial-handle=2360,i,15400548239875447152,5019395969755535085,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:14
  2⤵
  PID:6060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,5583868558900471294,16823403730643303745,524288 --field-trial-handle=2360,i,15400548239875447152,5019395969755535085,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:14
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7140,i,13202473931209295046,18000744098082602072,524288 --field-trial-handle=2360,i,15400548239875447152,5019395969755535085,262144 --variations-seed-version --mojo-platform-channel-handle=7152 /prefetch:14
  2⤵
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7076,i,17913558106107664163,9557459121385322712,524288 --field-trial-handle=2360,i,15400548239875447152,5019395969755535085,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:14
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7064,i,13248922311672078990,4991530649683255554,2097152 --field-trial-handle=2360,i,15400548239875447152,5019395969755535085,262144 --variations-seed-version --mojo-platform-channel-handle=7132 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5364,i,11570472869693122838,10530257655597370659,2097152 --field-trial-handle=2360,i,15400548239875447152,5019395969755535085,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5244,i,8342641241877327694,13431743042183982167,2097152 --field-trial-handle=2360,i,15400548239875447152,5019395969755535085,262144 --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4376,i,4460682908078913892,8518209769203866244,2097152 --field-trial-handle=2360,i,15400548239875447152,5019395969755535085,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7180,i,2811192968420128235,17363385100879960795,524288 --field-trial-handle=2360,i,15400548239875447152,5019395969755535085,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:14
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1396,i,2258948853073284202,5900361746904477114,524288 --field-trial-handle=2360,i,15400548239875447152,5019395969755535085,262144 --variations-seed-version --mojo-platform-channel-handle=1276 /prefetch:14
  2⤵
  PID:6328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1404,i,16056466799433476566,13790187232383580703,524288 --field-trial-handle=2360,i,15400548239875447152,5019395969755535085,262144 --variations-seed-version --mojo-platform-channel-handle=7516 /prefetch:14
  2⤵
  PID:6344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1412,i,16160129019813965005,13353570968069487714,524288 --field-trial-handle=2360,i,15400548239875447152,5019395969755535085,262144 --variations-seed-version --mojo-platform-channel-handle=7176 /prefetch:14
  2⤵
  PID:6352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6660,i,16284370948417971488,4955535390843446057,2097152 --field-trial-handle=2360,i,15400548239875447152,5019395969755535085,262144 --variations-seed-version --mojo-platform-channel-handle=7696 /prefetch:1
  2⤵
  PID:6504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8032,i,2679082861457255340,9604709793122358897,524288 --field-trial-handle=2360,i,15400548239875447152,5019395969755535085,262144 --variations-seed-version --mojo-platform-channel-handle=8040 /prefetch:14
  2⤵
  PID:6736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=8032,i,12801787520508660273,14254347093931625953,2097152 --field-trial-handle=2360,i,15400548239875447152,5019395969755535085,262144 --variations-seed-version --mojo-platform-channel-handle=8048 /prefetch:1
  2⤵
  PID:6808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7552,i,672078141614178675,6607110855760937144,524288 --field-trial-handle=2360,i,15400548239875447152,5019395969755535085,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
  2⤵
  PID:6240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,17005722346611794498,14428848724126240839,524288 --field-trial-handle=2360,i,15400548239875447152,5019395969755535085,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:14
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1460,i,13471053881822638220,297038438321199500,524288 --field-trial-handle=2360,i,15400548239875447152,5019395969755535085,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
  2⤵
  PID:4612

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5820

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6940

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6216
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\c9bc3aee-8bc1-49c4-8a3a-4cdcd927bb88_malware-master.zip.b88\malware-master\README.md
  2⤵
  PID:6436

C:\Users\Admin\Downloads\malware-master\malware-master\MEMZ\geometry dash auto speedhack.exe
"C:\Users\Admin\Downloads\malware-master\malware-master\MEMZ\geometry dash auto speedhack.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5616
- C:\Users\Admin\Downloads\malware-master\malware-master\MEMZ\geometry dash auto speedhack.exe
  "C:\Users\Admin\Downloads\malware-master\malware-master\MEMZ\geometry dash auto speedhack.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6164
- C:\Users\Admin\Downloads\malware-master\malware-master\MEMZ\geometry dash auto speedhack.exe
  "C:\Users\Admin\Downloads\malware-master\malware-master\MEMZ\geometry dash auto speedhack.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6196
- C:\Users\Admin\Downloads\malware-master\malware-master\MEMZ\geometry dash auto speedhack.exe
  "C:\Users\Admin\Downloads\malware-master\malware-master\MEMZ\geometry dash auto speedhack.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:7124
- C:\Users\Admin\Downloads\malware-master\malware-master\MEMZ\geometry dash auto speedhack.exe
  "C:\Users\Admin\Downloads\malware-master\malware-master\MEMZ\geometry dash auto speedhack.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:7136
- C:\Users\Admin\Downloads\malware-master\malware-master\MEMZ\geometry dash auto speedhack.exe
  "C:\Users\Admin\Downloads\malware-master\malware-master\MEMZ\geometry dash auto speedhack.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3940
- C:\Users\Admin\Downloads\malware-master\malware-master\MEMZ\geometry dash auto speedhack.exe
  "C:\Users\Admin\Downloads\malware-master\malware-master\MEMZ\geometry dash auto speedhack.exe" /main
  2⤵
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  PID:6416
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2812

C:\Users\Admin\Downloads\malware-master\malware-master\BonziBuddy\BonziBuddy432.exe
"C:\Users\Admin\Downloads\malware-master\malware-master\BonziBuddy\BonziBuddy432.exe"
1⤵
PID:4756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ActiveSkin.ocx

Path C:\Program Files (x86)\BonziBuddy432\ActiveSkin.ocx
Size 14KB
SHA256 ed104dc559ec9d674b769df77b0d5ecd8a67719bd95926517f78050864e69d64
MD5 d11527932a3fbd2fd2883f38892d6272
SHA1 87b047d691d45ba2cce1304ad7e87b9fb7be676f
SHA512 c70ae0767de290f9da81b0bbbb32c1aaca494793ef97e0ca21d314d7a6abef3c961561b503dd3810c8510c3908f71b9d2953bbe70f9310a8f0f810602b29fb86
SSDEEP 192:IMxOu3VOK7gMiWdRGoALshjUFFvboSv5mKCwodxmtmgWCYf:JOKVj1ipoAGjUFhoC5tsA8gQ
TLSH
T1AA6208127AD384BEC12390B2DA163A3F33F906025A79D0574BA30C077B66C1B913278F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ActiveSkin.ocx

Path C:\Program Files (x86)\BonziBuddy432\ActiveSkin.ocx
Size 256KB
SHA256 cb66eddcd6701b8c5b5344fce72384b784ebe414a43b5d7dc744475d5bc3a8fb
MD5 bebb56b24dc9643289147c960fbc872c
SHA1 e4a59ae2cb40096a0568834c3e53ab728351ce77
SHA512 7f4112e3b58c82b904437e2b12489a08382c9132496604a6a9b729404d3a701c7afa81d18b00a18887cd9e8f8687021c362d9a8d147252dbc73e96f44bfe53fe
SSDEEP 3072:TVKIgW9TkeIu2Yewxx3aGwz3OzT6pe3EhV665fi5sMfkjjyO0DtQo1fPqdX6:pKIkYPOpeUhV/oCMmjYtRne6
TLSH
T13E448E22FBD3447ED29316314919BF7FB3699B068524818B13BC3D032F71AC5996A36E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BonziBDY_2.EXE

Path C:\Program Files (x86)\BonziBuddy432\BonziBDY_2.EXE
Size 448KB
SHA256 12429fec110aa5788deb51ab018da11eb3a83279c13f7569178e0490c6e528b0
MD5 02eb7d93d7e57a9172ab9653e1df0b59
SHA1 d1d9e933b6d1fbd0ddc77bc3c3704b8caa802e6b
SHA512 4276b8edf20b7925c8632f21a64ed22b119ef30af2f332d754e1b8a5a8da725197c354ea368a1c40eaffbc0783eabff7c1fdd3a92934bd6c6856b822092978aa
SSDEEP 12288:3eVvbv4xVGCPscduI4G7wO7GAlKawj90/J0H90fNYJmbZO2Uzw9HSiXVhgJO6akr:u1bv4xVGCPscduI4G7wO7GAlKawj90/W
TLSH
T109A4C412F3F9900CE5B3ABB06D744369193A7C7298B4CA0FA340561D2975BD3ADB1B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BonziBDY_35.EXE

Path C:\Program Files (x86)\BonziBuddy432\BonziBDY_35.EXE
Size 192KB
SHA256 405eb2ef3f4562a64769687445ea25d6ec8ba7bd885b4efaf38d713335bcba12
MD5 8dcc903bab8871fad1f218fcd73e91d4
SHA1 8cf2ebe7070a79be061dbf4c519dba69fddc4765
SHA512 60de90e00eaf7e8968f6ae8b32b578a91478bd9e093f8cc43a19626ec4445fcb3ec6a24e6f9e8b8bbd66684fc011c7504db3fc1170aab0ea86eca2f3b8a285c7
SSDEEP 3072:H4uzBqdT4VruFzSds72J8he0GNo+btwt+q0MA7a68Logi:H4A8FzGs72J8heoan
TLSH
T175147425B688ACD9CC03ECB2C5D7C3B64F1BE5C10649AB23E145B61E5C3B3C5BA1668D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BonziBDY_4.EXE

Path C:\Program Files (x86)\BonziBuddy432\BonziBDY_4.EXE
Size 256KB
SHA256 9d281abd296ccf5fb66d5c4be5eea2adfcc6c89f57a53a4f0d163914a05da6c1
MD5 816d32a0179a6fba1b4f40412d9b1404
SHA1 514ce0d8fb23caf1f324fddf46e27e9aa793cf4d
SHA512 8d9a619ed39660253360a2e577ec210678d64e66e6df1136bf81cf872a5c1a657c17f85918a658f67feaefabfb7dfc4b8dcb06a1abc8908df7166e22951c3fef
SSDEEP 3072:sejxESKBc7crXtgDFDi+ZGWYxmFbF8osHq/rZYhmnWhp1kX928tqFktqO/LO8Ehf:9KvgDM2GYx8Jo9JE
TLSH
T1FB44B61576E9BCC8C84247B54DE5D7B8EB2FA4311BD96337D0456B0E8C377808BA2B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

page17.jpg

Path C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page17.jpg
Size 50KB
SHA256 473a890da22defb3fbd643246b3fa0d6d34939ac469cd4f48054ee2a0bc33d82
MD5 e8f52918072e96bb5f4c573dbb76d74f
SHA1 ba0a89ed469de5e36bd4576591ee94db2c7f8909
SHA512 d57dd0a9686696487d268ef2be2ec2d3b97baedf797a63676da5a8a4165cda89540ec2d3b9e595397cbf53e69dcce76f7249f5eeff041947146ca7bf4099819f
SSDEEP 768:jvSrbEi7f+t2R5Q9mEvXtdTsnHNGlTMmUWmuuh91+CGCso/gnLNeW3iRBrwyW3J9:jcctGaXvPlAmU9uuh+CsM8iR5w7Z9
TLSH
T1C133F1965D094F816DE107CAD0FF1E11F7201EF7E7F96268117A14488A3F5B848EAAE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

page18.jpg

Path C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page18.jpg
Size 45KB
SHA256 03f269cd40809d7ec94f5fa4fff1033a624e849179962693cdc2c37d7904233b
MD5 108fd5475c19f16c28068f67fc80f305
SHA1 4e1980ba338133a6fadd5fda4ffe6d4e8a039033
SHA512 98c8743b5af89ec0072b70de8a0babfb5aff19bafa780d6ce99c83721b65a80ec310a4fe9db29a4bb50c2454c34de62c029a83b70d0a9df9b180159ea6cad83a
SSDEEP 768:3XqTLeimOlN/0wKIvbSN/TtQ0EmMhifv/n73LHZC9tuVLc17s/SruIftS6fEydPQ:+eimOcwT2hLMhifvHZDg7CIVS3Gex
TLSH
T13023F163B7709727A1BE9917E0E3A25EE5F67EFB64037B29B3B97D18075000150E098D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

1a30d114-e8c4-45a7-9d13-51541b3a7363.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1a30d114-e8c4-45a7-9d13-51541b3a7363.tmp
Size 15KB
SHA256 2b05f44adccb86e3523f5f49b589a3878e5db2b0e30d100b1adc03058059161e
MD5 ea5f480cafafebc3104fb0a85c22b3b2
SHA1 6c49262d959e9c5d87fa52d9f78b3823952cf93e
SHA512 71f85e9a632872a04c896dfb4366fba2d3cccbf05f570d6955e70e3fed6a9f5dcba6e12fa7054f4ed12c8b2c065f825f55ab57c044d3ecc7e0b4a5cdaff6270c
SSDEEP 192:sxRWRkGO5/f/s/JQZe4cbB0oD8pJq/g6+WNPWd/YCVluOeGGIgVplxbajh/uzo:sxRWJO5/f/s/JOe4IGg/58/HgSjhWzo
TLSH
T1F962C6165A24D87B8CC7E618AF35BF52D7FD102399911A4CAAFCCA0C14EF6ED121781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 cb378b3d076d43808fce7abd569041556d03334efc69b005219cdbf03c47f419
MD5 f362e602d04b747c8a25f5e66e27c707
SHA1 df1b91c2627c46faa71a25dee6d06d17eb4fb68b
SHA512 1aebad37450aa6b19cddebaa70e6740d78717f0def9c66331d4b2b9bbbb2a7445b1d609b2a8be276f3e4c88de1351ab577731d048a8107dea52d7ab4d83dc2fa
SSDEEP 96:Tw875g0S25kzOx620OJacJV6w55ZtnF9OotU5dhdzDHfT9WhfwoFNouGP:d7qfOx62jaM5ZtnF9Ootqb7T9Mfwo8nP
TLSH
T1100274E853BE6858EFA68CB1E5D4A8403EF7503A575F8E238040393536E3BF199D509B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a7e88.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a7e88.TMP
Size 2KB
SHA256 7c48cdb2a098db0858e36bc08d3e366327da6744b6ec49f1bf5e7d5390ff4e4f
MD5 85acdbb7f519853f201d40a47a77c029
SHA1 287a06458d0f5b1db165d973507a8e2d7175c7dc
SHA512 4efe70e13c0beceac3655dc042cfbeab74dab0ecf6695de00a17acc19e8c695f78763a97c97a691836d4c1e515e912af17d8f9763c4e80a04099b85993dfc102
TLSH
T10651A66D237F36CECB7481B994E4658932F0A45B8AA7EF22C0041D7A59D6F10EDCA853
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

842cfab4-4742-490e-9009-b6628b0ab46f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\842cfab4-4742-490e-9009-b6628b0ab46f.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 a51987d60e60bff0176db9f10fc4510c87b3fafe90d2426d0a54363446787b5d
MD5 0f2266893ffcc169195f3c1a545f8b64
SHA1 b4379463c048cedc08fed7e745d1e2443c8a7493
SHA512 dd488226262368ba84e97261c1bd3bcfae9156b644d91c2fcfa8ac146b8f99c213200225ec119231d6388fc5f39420e8518a4a037eec5eb3cf99cb0a8ed385f8
SSDEEP 192:DuY1G1hmeaVZjh43ha5Q0GqGq/j8igJvtmyGm1mDmtmekmzmH:DuY1G1hmeaVZa3ha57GqGq/j8igJvtmZ
TLSH
T150D1ADF783F5866DDA1195F0AA18AF1BCF2C0551436C385A84E4BE1BA3F2871E141B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 1b1f6d0c712b7b6848bd166edb148e754fcacda34d7db94414fcfc1a8cad6f70
MD5 4c0737a4d551706e35cdbd8840c71965
SHA1 e8452decea780dabdc8538995f23649a239e2b3f
SHA512 0519afe6fe9a96f4aa36019bd5c0fdd71481be9b3b0679dd7ea0ebc2bc3e60bde60a34e83763ec7f2308b5b8c546677aec40062303a9ac24aabde331715ea0d0
TLSH
T1FAD02223631170B9A6AC3E8A406BFD9FCB3A40200802EEDB14D5FC99673A8AC470B184
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 216604815e4178ee3440e253e70089010e3f4b002d1e854504441e3483c47951
MD5 68a0bf60593a2e710192d9fdbeeaf28d
SHA1 6b6a5a24cd2138989c1aa1593f2df7186e8dadd1
SHA512 9d552b115ebc6859afe04013bdb0797bcd1dc5efd5f96206a9a52cc2766db3190564c3140571fc183795893307e68fe55e663cad7b9756370613e2b0edc8a1ed
SSDEEP 384:sxR+YmW5/f/s9eDOe4R3H/5idU/ngZjhWzovjhWzF:sKYmW5/fceD4/5lnAjhIovjhIF
TLSH
T13D92A5525520D87B8CCBE558AE35BF22E7FD10239D915E4CAEFCCA1C10EE1ED260681B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 8c0c7f895e2365f225f551b589bfebe93a811216d6436f73fc48b6a6c0bdee96
MD5 79d00cda1d61ca7f2e96ecf720eb64e8
SHA1 cfa261dce412534fd4dda995aba5be4ec6b1d50f
SHA512 5ce19ac6f348adbf0ae34090e1598dc2ede455ba9349209f689983621bc5ee9364a9c64fa3c63cbc1dcb662b61d115c2e12294fe4865cce4cb4038d438574b9d
SSDEEP 384:sxR+Ymz5/f/s9JOe4R3H/5YU/5g7jhWzovjhWzF:sKYmz5/fcJ4/535GjhIovjhIF
TLSH
T1F282B5565520C87B8CCBD518AE35BF22D7FD10229D915E8CAEFCC91D10EE2ED260681B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 40968c31fc7282663f60cd0cf2636cf125d554a399312c67367cf070276f4aa1
MD5 601a14972e113e57e8d54ee33a74c675
SHA1 4094123a4b4dbd6e8d5b1af1e8baf5ecb6efe0f1
SHA512 de1da83a249a8cb5a43f55745ad18603c233ca218b4c7a95e525b04500d1d5de99b2ca0aec10c4abe43f865ef19cdbb4629fc1d83dc94bd7f41cd3d300c402c0
SSDEEP 768:jC+vce7pLuLzDQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OV9f0QqcfroZT:jC+vceEzDQWgQ+f4+u1jaaf0VcMJ
TLSH
T142D2EA7B640DCB7F4F804ADDED197E9B6DA802CB9698CD4047FA841C02C6BEB52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7f876929-6322-4db2-b3dd-bd62016ab3bc\index-dir\the-real-index
Size 72B
SHA256 3df9f48cafe75118eefee2ad629a2e1441ea8768bc8fb56b0b2b14dd549c1494
MD5 995fc98b27c89bab2af5b72475cae5d7
SHA1 9aef78128371ba6e3c6a1d660c3449bbfc68f53f
SHA512 d509444b202eb3ea88a40574ead8426af9bbcf5e25cc6fabdc511250227fd17edfc4a0a168fcd5a3c9b891cc874c3983fa1429b372216a03a458887fbfb155ca
TLSH
T166A0021B03820019D402D2F2A99707613722F9261702530B95D14048DC50765BF7140C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a2d0c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7f876929-6322-4db2-b3dd-bd62016ab3bc\index-dir\the-real-index~RFe5a2d0c.TMP
Size 72B
SHA256 4bb82be3e29f7097bba7496bc5cc2d60bb68b17b95d621121b6a2f2a47f36b00
MD5 970c6a2bc08a5a580026822e0d316445
SHA1 97c6776ceb8b5955993b962aafc923a90405f85b
SHA512 220fc051c10f06f18a97aaef0c902b2365efa0516303ddc83f18fe6d9ac88927f4862330d11b67bf603e24feabf2e29130db59ee1a606219952b7cdadaa616e2
TLSH
T185A0022403C50027D41211B155E202BE53028851F1085216C4A24A48CC90C60898701D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\862ad6fc-d704-44f4-83c9-5dcb250b1cda\index-dir\the-real-index
Size 3KB
SHA256 74fbba0c282494f5a9148ed16c68be41cde94733114361552affe3f2f2b63a14
MD5 2d77998b652736157190010aef07b425
SHA1 b84859f5e5e06c46b4b1a6f3269b4357ebc42ef8
SHA512 7ac77c2c232535b191de238c3b9fc5f017a0e969bc890f6f858e752e58387cf1e53d0be1a1de79633f5abc7c6e53b22b20575480b17a515523648d0c6fcfe130
TLSH
T15751A58F4D4B2E55C96D01F364FA0982337528FD47844A47659CB571B8C33292D2EA5D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\862ad6fc-d704-44f4-83c9-5dcb250b1cda\index-dir\the-real-index
Size 360B
SHA256 8c520596821bbdc3697e7614ba36f6436b89eccdbf4466c1c21d4547d051d1e9
MD5 2b6e545b40ba4f6aebfeee6940d3a8e1
SHA1 d82e7a0550cc6189ab4ab4211c11804df8d75ad7
SHA512 b3a6a192636a30a2dd31de0b798f21a19d90167f3f58db3ff0c57d99b49c9cea496183c940f88d2127c54270cb1a625097d384e24fe90acf7a91d6fd683c764b
TLSH
T142E02B8E5C639D47CE3A683A0573A52A333B09FD160AFF1A30ED1819A65263C9245608
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d3a2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\862ad6fc-d704-44f4-83c9-5dcb250b1cda\index-dir\the-real-index~RFe59d3a2.TMP
Size 384B
SHA256 9e1ce3ccc94dbf17f751acc8db4d478bae0d697bd59702c8b44996a56d3e8385
MD5 6c342021d0fe5855ef104556775a855b
SHA1 3ed743628b0b3d5d64cdcb51050254454736822b
SHA512 bc3fcfe9a2a8babba45a41a3cee5b65478a729112ce9d7e6c20554feb82a3eb3616f7007a2eff40565f5ec61ae088989fb639c8e7c5c72aaccd55ac412efe370
TLSH
T11DE0EBCB8882AE22D92658751807112A333F082A2429EB9B109F281F4831BBC8640A06
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 79a402d5097fffdd928ab9892d8e81dca0d2a4d263331296f546b1b4e13600af
MD5 197f1e2fdf3b727eec5e0fd57f704951
SHA1 63b69256af50e433bcddc0773ce2e1f3d21dc304
SHA512 5b90277088d22907150deaff89d2a21adac2009717d34a4d9a4fb32b66e25d28629f5c9a9c1a28ce3fdf38c49983be8bf40f19ed433cae6ca6e5fd95df87ee30
TLSH
T1F0E068B33CE71808E8AB97E65C70A0A00000BC148941BD1F102B728391A23803405C15
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 0e33e9757d12b800ba72ea10adee938107d4ec4d1aa4b6f7520aada68d6a1797
MD5 dbfd80a18252eac6eff97681dffa2615
SHA1 30f11267a2ebd0d7a4188ec54e234b5bd4a19f27
SHA512 12d15d2f36c7cc42e275296a5e1bfa4025757d90444f90c8666f936a7883108f0963f5c4a77aef1a6c69879cc6eac977c106e277a21fe60a2c2167d3ce9c41f0
TLSH
T1E1A002249B499045C42517B094AE524077544CB901E61725A9A890ACDEE5BD161C9111
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a2d4b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a2d4b.TMP
Size 48B
SHA256 5774d7f3b48dae9fdee6231d50e5e0ac71f6c4dd19a61f2df99b3a9203d63c07
MD5 37473216c67964392eca5b3af401b287
SHA1 0782516b823301c85cc40cf923fc08c663f11b64
SHA512 a74c91535371b7ef005b9ee5c7c4ec0d567ff6d2db753a1e268c3b8d818dd8de037b905b7398d961798df893989713639d5f2d8380f1287dd1145d8a19a6bdd3
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c0cb6cf07899c9a65ff34d32e720040d05e63947ce96a687e8206f8be3b38720
MD5 d8a1e3aa2d54535202ca1548ee15cddc
SHA1 aeeaa8856614d9cbf83f01670a669af6d619cb8d
SHA512 84d64e93f2cf063e5b4a33d6fbf121035140e193af0e2b195b0dbcdb071c6dd69061929fb5f8e28852f5fae58d1c1a23228ede944c423258b702c78669fc075a
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHLURlTp5FWtC4gNFK40gjFcrzKtZ+GFKKh:CbEBVj5JAdSp9/EgTK7j6dJOHLURlTpx
TLSH
T115916410357B0344383E752D80B89C2E978174B3356AB52B3BE842A60F67E465DFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5ab6ed.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5ab6ed.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 d9f6844f2c025501c9555eb4ce0b7002ff2e26f52bc9a3750635353a125081f8
MD5 1aa2a694e21ba4e7de8ed99a3135664d
SHA1 8ebf2efa5126f2a28ef86347f4b61a02724e423b
SHA512 21049c1841e9ec5d5898394716ce3268c32964b0c7103a7eda33f383d58a74e59df68aaee4d691ba20ade8ad92ca70217afec478cbcf5ef13193b9a2676ca2d2
SSDEEP 768:Arv+4UNbdY38Hz5gpptwT0p8+p3bd66j+4BRv86aLIWbfmR:AbsbK3eVC8+p3Z6n4y1fmR
TLSH
T14603BF71F8ACDD338CF5C644B2867B837FB8106395C10DD4D8D9AB5E059A19E270B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 48KB
SHA256 4ada3f14baf08356290db3af88ef271a62fd81ea6d3b9936850c724fcbb58879
MD5 781e2d4dcbd3a2afab56a81252b561ee
SHA1 fcd09c9fa29c8bc54a6096f1dc53bb1326851f74
SHA512 47d70a19c3f071913ec7e59080f6a6eb62ddaa16dc11291bb1d23cecb2e71cb11f716d14fe66a6b314c9ff3449c7b3c96f0709b405964cddf76f2f46aefd4218
SSDEEP 768:BFtrv+4UNbdM3Qwg/HQ5X4ptwfp8+p3bd66j+4BRv86aLIWbfmR:tbsbS3AE8+p3Z6n4y1fmR
TLSH
T1933338F198DB8932D8AD8747A37D6E436EBCD06375844890B7C95E4CCC861BFD70A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 033f411e569aae926a57034a138d5329a17d2ec3395d135c7ad8df6542b563f6
MD5 d562bd2073256088e25db2e4e749e2ac
SHA1 e267fa8592a53319942a206e527cd4090dbe1ecb
SHA512 8a8b12a04b38187f4255083c1b1ae324120ee3ad34bab772a470836a76510ddb3140da662fd5c45749536e2bf23cb3113e931ae275df0d916acbd50a64b65378
SSDEEP 768:Hrv+4UNbdD3gHg5gpptwT0p8+p3bd66j+4BRv86aLIWbfmR:Hbsbp3yIC8+p3Z6n4y1fmR
TLSH
T1C203BF71F8ACDD338CF5C644B2867B837FB8106395C10DD4D8D9AB5E459A19E270B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 4c231daed3f02b1db17929252fb44221924a0f2d1082362e470dab99706cebc8
MD5 17b109c04cb7ce27c31adf71deb0fd1e
SHA1 72445f7da30149a0639bf2d12f8cc26cefee9086
SHA512 7c01c84fe6efb3ef9673c1eafc6a9d4d678d55151af533fa464ec02869eba6a18011a285746968243a83c9281c8779804ab784d8176db7d9cef3b291a151fd16
SSDEEP 768:Brv+4UNbdD3BHzepptwTMp8+p3bd66j+4BRv86aLIWbfmR:Bbsbp3Btq8+p3Z6n4y1fmR
TLSH
T12103BF71F8ACDD338CF5C648B2867B837FB8106395C10ED4D8D9AB5E459A19E270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 4135dde64b5878b995da4dbfa3ff1a4e79417215a54fa56a07aa581d0e9d4ed2
MD5 cd4b3496d7c3c588ba8a52d30945a12f
SHA1 9479c1748ba8766b30319102f4746a4832efff9f
SHA512 36ec9f24c610473da3034fa2f10b8bbb85030e3c3fbab1bd42fe705b741d77546c15a40370d2d8715ff61b5889f03b8b089757467ae1c3cfbec36e7cb17f90a7
SSDEEP 768:Irv+4UNbdD3IcpoNp8+p3bd66j+4BRv86aLIif2bwCl1:Ibsbp3KL8+p3Z6n4y50ww
TLSH
T16F03CF73F9A899739CF6C648B2467B433FF851A396C10AC4D4DD2B4E419A19E230BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 dd017e06e102b3b03a0b6bf825f733a8cbe1cbe765e7c3de78a3dedec927a73a
MD5 849bb00db02df3cbe401140a7cb35516
SHA1 7e7adadfc4b3ae0113b3b97cf75a51ee64d61fcb
SHA512 df8c0c5eefec2f71a97bd40d9988f3ec7da167d8b1132f74c550490645b56ff7e3c61166a1c0adbdf98fc973c75d9a768c0315f277d6f95ad9677e526a331456
SSDEEP 768:Wrv+4UNbdD3HspptwTNp8+p3bd66j+4BRv86aLITb2bwCl1:Wbsbp3DL8+p3Z6n4yK0ww
TLSH
T10E03BF72E56C9D339CF6C644B2867B837FF811A395C10EC4E8D96B4E405A29E270B937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

9008d166-e6fa-46ce-a4f9-f34c56dcc1a5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9008d166-e6fa-46ce-a4f9-f34c56dcc1a5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json~RFe59f14c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe59f14c.TMP
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

0001.tmp

Path C:\Users\Admin\AppData\Local\Temp\$inst\0001.tmp
Size 8.0MB
SHA256 803f930cdd94198bdd2e9a51aa962cc864748067373f11b2e9215404bd662cee
MD5 8e15b605349e149d4385675afff04ebf
SHA1 f346a886dd4cb0fbbd2dff1a43d9dfde7fce348b
SHA512 8bf957ef72465fe103dbf83411df9082433eead022f0beccab59c9e406bbd1e4edb701fd0bc91f195312943ad1890fee34b4e734578298bb60bb81ed6fa9a46d
SSDEEP 196608:V0O2jYJ3lwVjDq+mROCHWGZAXzbwEbW7Zksdphk:xlJ1NAG2DbCtksd0
TLSH
T1BD8633862E0EDD7DC9F86F5AC56AF9B7942042531CA73EEC226146162731EDBD230F09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0002.tmp

Path C:\Users\Admin\AppData\Local\Temp\$inst\0002.tmp
Size 8.0MB
SHA256 e1c89d9348aea185b0b0e80263c9e0bf14aa462294a5d13009363140a88df3ff
MD5 596cb5d019dec2c57cda897287895614
SHA1 6b12ea8427fdbee9a510160ff77d5e9d6fa99dfa
SHA512 8f5fc432fd2fc75e2f84d4c7d21c23dd1f78475214c761418cf13b0e043ba1e0fc28df52afd9149332a2134fe5d54abc7e8676916100e10f374ef6cdecff7a20
SSDEEP 196608:jU6VHTUkm3iwFb+BB5ch1SamqIz/Z+nxnfOUvKDb:jUwHgkm3PFb+dcjSam/AxOSu
TLSH
T1068633F7E545E1C68AD5691A07C25BB531B2AAEE63700AD4A1F0BD03872789B077FCC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0003.tmp

Path C:\Users\Admin\AppData\Local\Temp\$inst\0003.tmp
Size 8.0MB
SHA256 5eec15c6ed08995e4aaffa9beeeaf3d1d3a3d19f7f4890a63ddc5845930016cc
MD5 7c8328586cdff4481b7f3d14659150ae
SHA1 b55ffa83c7d4323a08ea5fabf5e1c93666fead5c
SHA512 aa4220217d3af263352f8b7d34bd8f27d3e2c219c673889bc759a019e3e77a313b0713fd7b88700d57913e2564d097e15ffc47e5cf8f4899ba0de75d215f661d
SSDEEP 196608:j+c9TBb1iOMVP6i/MBrvqFua+2f384Hr5cadt1oDbmEmAn:ycrmCVriFL8i2XHn
TLSH
T12E863333008FD4BE61A5B6ABF9AA6856914A3105075A7CDBC33A18EDD0E3D3C4CDC5E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0004.tmp

Path C:\Users\Admin\AppData\Local\Temp\$inst\0004.tmp
Size 8.0MB
SHA256 fee4d861c7302f378e7ce58f4e2ead1f2143168b7ca50205952e032c451d68f2
MD5 4f398982d0c53a7b4d12ae83d5955cce
SHA1 09dc6b6b6290a3352bd39f16f2df3b03fb8a85dc
SHA512 73d9f7c22cf2502654e9cd6cd5d749e85ea41ce49fd022378df1e9d07e36ae2dde81f0b9fc25210a9860032ecda64320ec0aaf431bcd6cefba286328efcfb913
SSDEEP 196608:+Bfk4zng863A0M5cgvWQDyZHg7Kg3uP9Sgh1Hip5c82qNV:+Bs4Lg8qRM2iWIyNiN34SghNip59H
TLSH
T1968633281E1A0F244EDBF31BA2CAC522CB9DDBC81D554556B663AA40CDF8B124F1D7CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0005.tmp

Path C:\Users\Admin\AppData\Local\Temp\$inst\0005.tmp
Size 3.9MB
SHA256 d709eca3f06449b4af1ae78348a83833c872fe1c9409920e1131368dcb599c8a
MD5 224d94d0faa352100b3f840d94b1b5c6
SHA1 8811e0acfdda02854ae645646739b16ca3114566
SHA512 e559836d3762df4383b3cf1ac414ef01c008a5c68104d34e08865d3396b9150215d3b888b604aad6c01cee2f0562d201b29d5d16a0589f86c68ab31ef438ca17
SSDEEP 98304:Og2TL44o+h23721/ONuCtoz1E8ZWk91d6+9wGF0M5cgqGWmH7S:1gqa1/Oczng863A0M5cgvWQO
TLSH
T14B1633484C15D694D8FDF265B3E28048DA8ACBDD2D7154FDE2032681CBB9B558F1F38A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0006.tmp

Path C:\Users\Admin\AppData\Local\Temp\$inst\0006.tmp
Size 1.8MB
SHA256 7fb63fca12ef039ad446482e3ce38abe79bdf8fc6987763fe337e63a1e29b30b
MD5 b3b7f6b0fb38fc4aa08f0559e42305a2
SHA1 a66542f84ece3b2481c43cd4c08484dc32688eaf
SHA512 0f4156f90e34a4c26e1314fc0c43367ad61d64c8d286e25629d56823d7466f413956962e2075756a4334914d47d69e20bb9b5a5b50c46eca4ef8173c27824e6c
SSDEEP 49152:8QJpj9To8B6CJ0BSZ45XkK3qVj4jFGeANjf:39To8YC2cKIj4jFHq
TLSH
T1D7853301D36931278AA2C517671D520CB52AE3CCBEAFA3BEDF4CD9B3F5A09610707526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_gvt3ysrg.zmq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gvt3ysrg.zmq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

b451ad42-2256-4286-ae52-ccd8e210e152.tmp

Path C:\Users\Admin\AppData\Local\Temp\b451ad42-2256-4286-ae52-ccd8e210e152.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4320_541438178\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.dvrk.fluxity\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 a35822fe2e4157de00f12fcd7548e7621b1309e6cb3874201ee8f121b85c4e64
MD5 398874de3ae37a3ad699fa5a27266ada
SHA1 746e52f25e98621f5553f57cc930bf3ee1055059
SHA512 1842cf46b6f3f11fd3a1fb2deb5c5ae5c7a2823faeae4e5b1b95de1aceb6423507717d461ac2c91598022c1b689e520683822d3ff10abb27cdf7a46ad30a6b8d
TLSH
T118D012263A010134C0102473101272480580C55B400D40046528C56EDB248544903882
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.dvrk.fluxity\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 eb6b200584ef1ca8d672ba08ffb19ff12a430dba63bb7b6f34cdc73090a65fc9
MD5 db6721bea127617ddf0e02f099be3ee8
SHA1 630cabd8f273774b832d1f317d11ae78c517c6a6
SHA512 897eac0867972fab08048abd2d26708eef4fca9762333914f3cf1d5621c78c28d4f81d1406625632b8cb8a085d33edec925db2a3fc7fc3dd03257132e1840c29
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.dvrk.fluxity\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.dvrk.fluxity\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 016a10a0d3801d3b7575145264f16f176c8c03730234423c1f91c239db7dabf7
MD5 504c8d763b68e8df7ad967e36f3e5c5a
SHA1 96b99374a799534d10f48d774dab09a412aadf80
SHA512 1335b1aeae1e4c86bb04c57b6ba11a0d7fd4d750dfce771a558603cb36b1b5144eb963fd3a1ad8a10838b06d9054f8d14ff14d6fbc743287dc978d906a99593b
TLSH
T1CBB0122C110C0441DB050FF4BDCA01B33131CC0012470EC380C0F47440133BAC1DC100
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a0ab.TMP

Path C:\Users\Admin\AppData\Local\com.dvrk.fluxity\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59a0ab.TMP
Size 48B
SHA256 7df250e08c172c7c1e6ee814bbce4f86e16275baf9bccaea2f15d17478102a3e
MD5 7d0aeff7354f25fce75a7bd46e4b1dbd
SHA1 c0f586902f672f99553c166976582a9ca22dcab9
SHA512 c48b8b1a3128e4a644290ff14f0c7f79c239b1546919284ef8b4d3521149a08a7cab226ae568dc20886444166b91bb8fdbc2ca0ea95535af0941614d0fcaf74d
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.dvrk.fluxity\EBWebView\Default\Extension Scripts\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.dvrk.fluxity\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59a84c.TMP

Path C:\Users\Admin\AppData\Local\com.dvrk.fluxity\EBWebView\Default\Network\Network Persistent State~RFe59a84c.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.dvrk.fluxity\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.dvrk.fluxity\EBWebView\Default\Preferences
Size 6KB
SHA256 39bb3b1e3f5145e7240e228193db906482d74809cc7b0bc462ef5f2067119d1a
MD5 1a8e316096a769f99d03967dbb80d837
SHA1 61b8560cf3274b5248e15dd00386e541a650e9f9
SHA512 95edf1eb8f0b5c112692f84eca75c2df82184884db5b33069ffd91b2406d37799fa1ed5f6bfaee87c5a7103cb7a558c7e1be0010f48fae74b03fb57eaf2f62ba
SSDEEP 96:stx/dBVeN07b9bk+IYTo5h16Z0bs7/x+6MhmuecJGGj0jejK+g66qI8XM1C7K:stlpe88YTonbsV+FdGG4jZGg6K
TLSH
T1D3D193016E34B97B4CCAF519BB75BA13E2F9502274D51E48EBF8892C08DB6DC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59a80e.TMP

Path C:\Users\Admin\AppData\Local\com.dvrk.fluxity\EBWebView\Default\Preferences~RFe59a80e.TMP
Size 6KB
SHA256 d73b1f476eed1a7f94afe890ca80dab227bc623392e5e92126ce7b1984128816
MD5 4def46e0a5c15f5224ddc72f7765721e
SHA1 7b9ef91668d5d4f763eabddc502552d032931cdd
SHA512 e8dcfde67fe519f5af76ae72dd509adf364d4c40bfabe92a22a31943e550952c9701d1b0c44b644bb8a48140300304698594b670723e4242a57b64dc2a6b6a1a
SSDEEP 96:stx/dBVeN07b9bkjTo5h16Z0bs7/x+6MhmuecJnH1ejejK+g6428XM1C7K:stlpe8STonbsV+FdnHQjZhG6K
TLSH
T102D173016E24797B4CCAF519BB79BB17E2F9506264D11E58EBF8862C08DA6CC6307D0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.dvrk.fluxity\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.dvrk.fluxity\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.dvrk.fluxity\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.dvrk.fluxity\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.dvrk.fluxity\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.dvrk.fluxity\EBWebView\Local State
Size 2KB
SHA256 51fcadd3b0ac4d8d11f6f02424c45c5d456695a3ccb476e796bd40c5bf7d4f00
MD5 0ff83b141ec037727dcad6810f7810f0
SHA1 e4d93e6acb43e8bff3389eb4665f5ac5e9085b94
SHA512 a5fbe6cd1c23319e6ad34d4d736cb675e43754eb92c5101a87f12ab655b11e5eaccf4f1c6d19dc4e999a47a40a881f572658872ba4a9888f6d81f9739d7177eb
TLSH
T1745157336974AB378DF696097A9B3E33CF7950A296511F509EDD0B0801D725D2342C7B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.dvrk.fluxity\EBWebView\Local State
Size 15KB
SHA256 a7651c99afa925b971d013b189ee9f7ae587a1d9f7b5a38e8dc0cf82fe8748a4
MD5 85d260a73f5a40afa91813a249110b52
SHA1 ee546b69218ccc35cd97c5d4f5a18ba836dbd975
SHA512 850475cfec616789ddfc321accc2ec737eda73be1fa983f58f2aa198d08b40e7aa690403940eda1f2d82bef2217787da7eb54cbc938896ca4ab827cd7da9eab6
SSDEEP 384:O+aQikB+z/xvxjg/qhEVNBSFc3BAgAVdpKc9z1:Z/UxvxjgC+bygUzF1
TLSH
T14472AE2755797E27A9F7FA04799D1B5BCBB884B290C12EA84EBD5F0D06C73D81302C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.dvrk.fluxity\EBWebView\Local State
Size 3KB
SHA256 e300881025b6a17c61266e31a2267308930719b2e164a861ef98c90b0e8b80d7
MD5 3e27bd5fdb403b76383eb601d92758f9
SHA1 3ef04ed0725af99a83d2f48d97a09f527f3b69ba
SHA512 432e65400564d475a527617946bfeb08c9123e8153d0ff34bc995029bcd67da006fb78284a46efdc2431bab258dee6c9342a31efc4471a49e387559cecf2a7a9
TLSH
T13E61673659B4AA374DF7DA05B9C73B26A7A95063D5813F54DAEC0F0C01D73881341C1B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.dvrk.fluxity\EBWebView\Local State
Size 16KB
SHA256 b09674d2c67a153010972e8cc23732058b9d21c3e41b78da7577ae55e2e3c7c9
MD5 164df3ba95a3b75b9d86951841399e7f
SHA1 ffdb0f89ceb919b9bd682993649d3f68beab2f2b
SHA512 f9131435557f4bd1d15824c809eee6af8b2a00a81bdccff4fcec814cbab91de5318a2e98a4065a46d0c9bf1be6b4921a11059031aa10c6817b174c8c9b4972f3
SSDEEP 384:2+aQikB+z/xvxjg/qhES3NBSFcqBADAVdpKc9z1:B/UxvxjgC+ScyDUzF1
TLSH
T1FA72AE2759797E27A9F7FA05799D0B5BCBB884B290C12EA44EBD5F0D06C73D81302C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe594fdb.TMP

Path C:\Users\Admin\AppData\Local\com.dvrk.fluxity\EBWebView\Local State~RFe594fdb.TMP
Size 1KB
SHA256 35009c34568e3456977b1f7d55e0da44319bb407b748ee6cba3e8cb1eef95f63
MD5 a60830206babfe4452e9ccfc68ed1b4c
SHA1 de8d6d0c256863873cc403f4193168135b931f28
SHA512 fc191bae16c9996ceee170202e904b6bd29fbd5f3a83af68d08222adfec584cd64aa637b638a034f6f2f414d0afd44ef7e1196a84fea2140616cbf53025e206f
TLSH
T15F21B732D5B8AB33ACF9760A32A77E274F74006382404F0069DD4B08169224D711BC3B
MD5 SHA1 SHA512 TLSH

Submit Download

Fluxity.lnk

Path C:\Users\Admin\Desktop\Fluxity.lnk
Size 1KB
SHA256 67087f2ab7289a4465138523bb2eb93481d40879f49517fe52815972347726ee
MD5 888cad6bd747f2632284bd588f844e8a
SHA1 aaa29294cefc51ea6c4e0362de934d1f79e95907
SHA512 df24e7dfd718db6144242e75ffcc1c126602e3ae439b66850b45ae692472497c406d757fa8912d6cca654bbf3df809069a662c0e443158d8490934fe898dd659
TLSH
T1F311E10869D72A12C3EFD57195EF3614E274F425AF813F5E0444C30D1856A52EE05B0E
MD5 SHA1 SHA512 TLSH

Submit Download

Bonzi.acs

Path C:\Windows\msagent\chars\Bonzi.acs
Size 5.0MB
SHA256 f3d4425238b5f68b4d41ed5be271d2f4118a245baf808a62dc1a9e6e619b2f95
MD5 1fd2907e2c74c9a908e2af5f948006b5
SHA1 a390e9133bfd0d55ffda07d4714af538b6d50d3d
SHA512 8eede3e5e52209b8703706a3e3e63230ba01975348dcdc94ef87f91d7c833a505b177139683ca7a22d8082e72e961e823bc3ad1a84ab9c371f5111f530807171
SSDEEP 98304:KdAMaWetTel1Q9ypfl1ydxUa751yGEFbnHEpAbY+/ERW3lc6u7/jtzVJdcbJ:KdAMaWetTeAkLIdx751qFTkub//73lcM
TLSH
T1FE361252FB82A840C420D6372D6AE9E17626FF945F53570E2F1B7E3C2672175E62B203
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Peedy.acs

Path C:\Windows\msagent\chars\Peedy.acs
Size 4.0MB
SHA256 b8112187525051bfade06cb678390d52c79555c960202cc5bbf5901fbc0853c5
MD5 49654a47fadfd39414ddc654da7e3879
SHA1 9248c10cef8b54a1d8665dfc6067253b507b73ad
SHA512 fa9cab60fadd13118bf8cb2005d186eb8fa43707cb983267a314116129371d1400b95d03fbf14dfdaba8266950a90224192e40555d910cf8a3afa4aaf4a8a32f
SSDEEP 98304:3RgeCo7/u08ypDpzduZcdZOZQDyMvgk302Dm2yqJK9:hgnf0ppbZOZ0y6309
TLSH
T16316122069C0B840DD9496375F6DE1E47620BF8CACA7AB463A4F7EB9143246FD47BD20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

note.txt

Path C:\note.txt
Size 218B
SHA256 8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
MD5 afa6955439b8d516721231029fb9ca1b
SHA1 087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA512 5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
TLSH
T1C3D0A719040784251C7052D17145A5A09B70562D77F626EB74DC690C212700F0B37C9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/264-80-0x00007FFA9C200000-0x00007FFA9C201000-memory.dmp

Download

memory/2704-26-0x00007FFA9C200000-0x00007FFA9C201000-memory.dmp

Download

memory/2704-216-0x0000024D825A0000-0x0000024D826F9000-memory.dmp

Download

memory/4088-183-0x00000256F4FE0000-0x00000256F4FEA000-memory.dmp

Download

memory/4088-182-0x00000256F4F20000-0x00000256F4FD2000-memory.dmp

Download

memory/4088-181-0x00000256F4CF0000-0x00000256F4D0E000-memory.dmp

Download

memory/4088-176-0x00000256F4C40000-0x00000256F4C62000-memory.dmp

Download