0140046cbf0c79400d272a22201f4dc7c5761741d835ead1b2763479cc901d24

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/04/2026, 22:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Size 18.5MB
Sample260416-18ldbae17v
SHA256 0140046cbf0c79400d272a22201f4dc7c5761741d835ead1b2763479cc901d24
MD5 dba13c17999bd995001bdf83f8dcc1c6
SHA1 b15b325217b1ed80f5dd8f2fbf3dbdafc75f39ea
SHA512 602d4d27a0cce23a71e924239f719a0078760e9c643beb3a6e4f5b2f117d6bc1d260534ba1edb3f30fa28628257831f77b33bb9ed231a077f9de3ac1b5e832b0
SSDEEP 393216:Q0Uxu5U8z7zhff4E3npAd1LcXHwgieWlF99LURyv/pRZm5Iq:qx/E7P3pS1mQgieWJ9Lky5ryb
TLSH
T14A17331177D68031D1720574E966D72B697BBD311B32C8CBB3D90A9E4A32AD28C39F27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

bootkit discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
25	6128	msedge.exe

Checks for any installed AV software in registry 1 TTPs 5 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\SetupFolders	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avira\Launcher	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Launcher	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\AhnLab\V3IS80	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AhnLab\V3IS80	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3316_1294893990\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3316_1294893990\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3316_1294893990\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3316_1294893990\_metadata\verified_contents.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6128	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134208515731023294"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1456842261-3464001825-2855069093-1000\{5B14BB74-2D1D-4764-BDDB-B6BC9513CE6B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5136	msedge.exe
5136	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Token: SeRestorePrivilege	4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4328 wrote to memory of 3316	4328	2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe	79
PID 3316 wrote to memory of 1264	3316	msedge.exe	80
PID 3316 wrote to memory of 6128	3316	msedge.exe	81
PID 3316 wrote to memory of 6072	3316	msedge.exe	82
PID 3316 wrote to memory of 6072	3316	msedge.exe	82
PID 3316 wrote to memory of 6072	3316	msedge.exe	82
PID 3316 wrote to memory of 3064	3316	msedge.exe	83
PID 3316 wrote to memory of 3064	3316	msedge.exe	83
PID 3316 wrote to memory of 1512	3316	msedge.exe	86
PID 3316 wrote to memory of 1528	3316	msedge.exe	85
PID 3316 wrote to memory of 1512	3316	msedge.exe	86
PID 3316 wrote to memory of 1512	3316	msedge.exe	86
PID 3316 wrote to memory of 1528	3316	msedge.exe	85
PID 3316 wrote to memory of 1528	3316	msedge.exe	85
PID 3316 wrote to memory of 5352	3316	msedge.exe	88
PID 3316 wrote to memory of 1376	3316	msedge.exe	89
PID 3316 wrote to memory of 5352	3316	msedge.exe	88
PID 3316 wrote to memory of 1376	3316	msedge.exe	89
PID 3316 wrote to memory of 1752	3316	msedge.exe	90
PID 3316 wrote to memory of 1100	3316	msedge.exe	91
PID 3316 wrote to memory of 1752	3316	msedge.exe	90
PID 3316 wrote to memory of 1100	3316	msedge.exe	91
PID 3316 wrote to memory of 1100	3316	msedge.exe	91
PID 3316 wrote to memory of 3472	3316	msedge.exe	92
PID 3316 wrote to memory of 1892	3316	msedge.exe	94
PID 3472 wrote to memory of 4816	3472	msedge.exe	95
PID 3316 wrote to memory of 2092	3316	msedge.exe	98
PID 3316 wrote to memory of 4904	3316	msedge.exe	99
PID 3316 wrote to memory of 5220	3316	msedge.exe	100
PID 3316 wrote to memory of 1032	3316	msedge.exe	101
PID 3316 wrote to memory of 1032	3316	msedge.exe	101
PID 3316 wrote to memory of 5136	3316	msedge.exe	104
PID 3316 wrote to memory of 1396	3316	msedge.exe	105
PID 3316 wrote to memory of 1396	3316	msedge.exe	105

C:\Users\Admin\AppData\Local\Temp\2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-16_dba13c17999bd995001bdf83f8dcc1c6_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe"
1⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://down.360safe.com/setupbeta.exe
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7ffe33e1c188,0x7ffe33e1c194,0x7ffe33e1c1a0
    3⤵
    PID:1264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,5335276225963944436,12427403010505255463,524288 --field-trial-handle=2284,i,4407367617569823654,17653713883621397656,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:11
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:6128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,11983785051611781405,3290985446120669881,262144 --field-trial-handle=2284,i,4407367617569823654,17653713883621397656,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
    3⤵
    PID:6072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2296,i,2079655722884358120,8116056189735252231,524288 --field-trial-handle=2284,i,4407367617569823654,17653713883621397656,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:13
    3⤵
    PID:3064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,9835887328524076470,12223010926724768773,2097152 --field-trial-handle=2284,i,4407367617569823654,17653713883621397656,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
    3⤵
    PID:1528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,11624123396771622000,11951488070307594419,2097152 --field-trial-handle=2284,i,4407367617569823654,17653713883621397656,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
    3⤵
    PID:1512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,15355228737710636936,1009073960557639524,524288 --field-trial-handle=2284,i,4407367617569823654,17653713883621397656,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:14
    3⤵
    PID:5352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4824,i,9948982805007928893,10825029922511711153,524288 --field-trial-handle=2284,i,4407367617569823654,17653713883621397656,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:14
    3⤵
    PID:1376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,6411849846251722220,10392806781197642232,524288 --field-trial-handle=2284,i,4407367617569823654,17653713883621397656,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
    3⤵
    PID:1752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5268,i,254445747829966979,4211265496417896715,2097152 --field-trial-handle=2284,i,4407367617569823654,17653713883621397656,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:1
    3⤵
    PID:1100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,5918366215935326654,10420583501167583827,524288 --field-trial-handle=2284,i,4407367617569823654,17653713883621397656,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:4816
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,3713183688118356400,4358204557301536533,524288 --field-trial-handle=2284,i,4407367617569823654,17653713883621397656,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
    3⤵
    PID:2872
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,3713183688118356400,4358204557301536533,524288 --field-trial-handle=2284,i,4407367617569823654,17653713883621397656,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
    3⤵
    PID:1892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,12220012426152686543,6706386836154063751,524288 --field-trial-handle=2284,i,4407367617569823654,17653713883621397656,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:14
    3⤵
    PID:2092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,8534632546961176474,16456191954018149668,524288 --field-trial-handle=2284,i,4407367617569823654,17653713883621397656,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:14
    3⤵
    PID:4904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,16957678625619419689,2133060422423502530,524288 --field-trial-handle=2284,i,4407367617569823654,17653713883621397656,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:14
    3⤵
    PID:5220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,11188645120856332029,2741025917954916302,524288 --field-trial-handle=2284,i,4407367617569823654,17653713883621397656,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
    3⤵
    PID:1032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5072,i,694856728365497494,4064222023068101916,262144 --field-trial-handle=2284,i,4407367617569823654,17653713883621397656,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,9040817088519480370,10307464889331415404,524288 --field-trial-handle=2284,i,4407367617569823654,17653713883621397656,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:14
    3⤵
    PID:1396

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3025eff1-1c85-4511-b7ff-3cea8a7e0cab.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3025eff1-1c85-4511-b7ff-3cea8a7e0cab.tmp
Size 27KB
SHA256 18a381c791d73577310c84a9e402fecbed43b14ac73e5db8dc8a13ffa78613d2
MD5 a4ddf2a4926277f424cb7ce8055c38cc
SHA1 f9e8b6acd3787e1afe8643e6825bf27ef7a4c2cc
SHA512 0909bb8e176a60add363d9a6969c60f879f213bfb768c0387570547b8d5705f9dd5755a728ab4b8c1c0ca3acc909e818464de544ec23c75997854407a610ae35
SSDEEP 384:n+iFJjccCs+Bt0S3b8Nk8TUNTUlIRE64dkKou14fDKPhHmn1oMaXBf+jGjCfSBFa:VFJccQ7HwgsOKPhHm1oJpMUCfSnaLz
TLSH
T163C25A3298A4CDB7ECE68AD9B74A7753EEE00163D98C4ED4DAD84E5C00871DD174BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9cf5acc3a4797f1d8e969ab1970c2330530e33f7dac25d2b42a810961a67ea68
MD5 6bbadb85852ef58796e988ee6bd3abc6
SHA1 f87a8c99cc4052067a5b532f97bd1ccc92f6a0b9
SHA512 a3813b64d663d976b681f2ced98d428dc47f49c99219d4a147277e7c8375b07692a5a14501eee0df77c86f9da6e3205c49e89510005d4f3b21e3afff243fb088
TLSH
T13CD080155FF27C70D014E8F694187B41392DACA68D43A6115471EA7E4C224D48BD0FE7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ea750b8ccfa8d7c7a393cdf6c9c8a3be0f2f086fb814bb44905a02c83d9af71f
MD5 697a394c9a3ff43b8925489b648b073c
SHA1 5828315de0bd17378051f664204bff07d8659dea
SHA512 37519d78554ef3947030bf7fc74d2660bf2dc752f04de85daef8079fdce335d2e6ad77071de5a938f7422ad0bdd2acad3963260b61149fc0d91381c007a2514f
TLSH
T173D080115FF27C70D014E8F694187B413A3DA8A68D43A61154B1EA7E4C624D48FD0FE7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 7874add702f765edf1bbae9067cca632aa86620a73efa4078278b763f26388c2
MD5 ec99acbcfeb68a6c08f45c94a450f96f
SHA1 6dc08bba1ecb179a40386b4a9519950aec0598e0
SHA512 4f2232085db62ebc0e310f911f21a8276d0a25664ffd8ea3350324c48bc4308afba9eb73810195cfb0c7202c4b9d81f673b2e434e33d18fcec6a64ce14b50d7c
TLSH
T1B6E02BAAC820AC3749FD871810884385E750135B5790584B7A3CD20D8FB573B5586C6C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 6f69c122b275773060be287e5ecbed87b2f55c476bd3b78055ed3ecca96c5346
MD5 84e9bc9a1c538ac0760745ca995b7bb8
SHA1 23988f8e2343fbaba9971e7ababd5206bca978f9
SHA512 85f3b2cca09d98b6a6642e78cf542bc2798b0986814756cbedbe92b469b792343779fe6587d9d9d7401fd36d46a8fba609455ed8cd8787907b5efad83d328521
TLSH
T12B41BDF7C3E4856E8A1196F0AA187E2BCE2D0514432C7C5AC5E4AF1BA3E3460E101A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 89db710823131fca23011bf622d94dac54ad4dac418177eacbbf5cdcaca4f7ae
MD5 22e461cfc9de28edc85a90830fd23829
SHA1 b36c69c8785d4eb93f17130aeccb4fbc5f5dffec
SHA512 75f39430282094f478361c8865b0e8d5f4f307ac6e1f143e4f7a2747a869a46b5130dcc4dc602724c34bf34c7b855c8f214fc8bf0430ba73071ee7e0f0b11385
SSDEEP 192:sxZRRxtyMqZ/K1Ml8UQolN/fZs+dK47lVILcczodpW/W6+WNGY0lXia4bpIg5yrr:sxZRjIq6N/fZsCKS3/W/bG5Uor
TLSH
T18972E816AA2899778CD7D219FA45BF93DAF91563D2401D4499FCCB0C04E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 dbbe856213d5964f084ec162e0ef73af442e360e1bdeb867ebb2bd6fd6e41296
MD5 6051404ee5ff341a37dd9e6dc0bcc92b
SHA1 4697ba907bb19ad9183d0943ae884356922bcb46
SHA512 7cac5dcda071ea5293c5ea7c6a11085f4517f9ad516ef1f22c3471d6f6dd8760b6416d472b97fef657d481dd8160606031181db77b6aa0deb8e6483aef36d32c
SSDEEP 192:sxZRRxtyMqZ/K1Ml8MlN/fZsSx47lVILcczodpW/W6+WNGY0lka4fpIgjRJ:sxZRjItN/fZsSxS3/W/bG5Sjb
TLSH
T17962E8166A28597B8CD7D209FA46BF63D6F95573D2404D44A9FCCB0C04E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 8059d2329d8c69bfba274bd9bfc173df0474bf58a0cf23115c343360826d1864
MD5 479a190d0089c18939f4b55e6660cdf2
SHA1 0bc42fa86b939275a509ab5bcedf7e931dd638c1
SHA512 a19b4a3239cf9ee616712e6e8058437ac6ed4c94e930a6f58e04a0d446677db79c5e3aec322f4a2cd0b76aa47568be2e1ddbf0341b0a522a53919f09640a85f9
SSDEEP 384:cdOlNbMrgcmS2paFgkI1keB0k1+ojSSjroduZFtK:cdOlNXJjSSjroduZFtK
TLSH
T1C8B26D15713B13903ABD258A8594B4EF42C231633018E43B7BB954AE4F67E58DDFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

c4127502-fe83-40dd-b3cf-62f186e021f9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c4127502-fe83-40dd-b3cf-62f186e021f9.tmp
Size 36KB
SHA256 554a32dfa55ad239ca2185fbe0b389b51437f357df0fbd7162dcccc694d0d938
MD5 9a795d242bb4a35c7e69619f553d32e3
SHA1 85dea40a8d8397cd37604637c90923a0cf401cfd
SHA512 daf294a49fc15b66e4ffac7ba95f0cfa1048783d952666ee80b13e157fbde577a9fcbcd335eb65bfafd07c5b63a9f75b49b3c04084d6e974acd6f54169a681b2
SSDEEP 768:EZN9b8PT24f7pLuL/CuWRmCCQx68F1+UoAYDCx9Tuqh0VfUC9xbog/OV3o7yZLle:EZN9b8PT24ZE/CuWRmCCQx6u1jaKo7ya
TLSH
T102031C3B680CCB7F4F804E9CDD26AE8E7DE801CB9698898447FA844C03D66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 c8b0eb75c94dd95b8d4e9120660e179899a1cb864bba1fb8011f0a75442a4d34
MD5 1fa3e4e30d2e76b6dabc355c48b054ec
SHA1 6af2fb739deb28961c7d760bf5adaad20207d5e4
SHA512 558f66f29893cb4a982515d04ad951d8d3f4c027e1bb7271669d2fbcaddffa596b7a879b46e5e20ff8ef2dbfbfd7e4c75dcb563b85b87e70c5af89318a25ffac
SSDEEP 384:nsiFavqMg38NJ8TUNTUlIxB4d45lGK14fDKPhHmn1fTRYV/Vw1mRp7ierN1k+5v1:XFayv3KwgLrGzKPhHm1fTRYk1mD77F
TLSH
T148C25C36E868D9B7EDEA4FC9EB0A7A03EEE00167D99C4AD4D6D41D1D10D709E230BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 32e1fd55315abbe444c4cfeb7ec7a508fe4b5af67fa92b692027b5b26e0fcdc5
MD5 207b36d07be68fc20d8888bafc025ff9
SHA1 695e24a67a94fbaa2944dc1fb0da84027612aa97
SHA512 ba6ecab35cd3ed536ea058c84af003c6a49fb5056a589c22b92a414dc6c01732945025a7ea2628f511f2ace8bc82365886c8dbe9d00cbdc69f30c50131f33e35
SSDEEP 768:LFayv3XwgOrKPhHm1oJpMdCfRYk1mD77F:oyv3RJLrnfmkED7h
TLSH
T1A2C25B36E865CD67EDEA4FD9E74A7A43EEE00163C98C4AD4E6D40E1D00D719E270BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 0f6a1fef94740dabc8a6a0cd26511b92f45eafdb3f238b58f1595fdb33d93fc2
MD5 ee91c4507120c5a96a05f231e8b918f9
SHA1 bf94e60b9ca0c577913831a4db5c426138458381
SHA512 f1672febf8911a7f8076a159aee267a81c13e46530220a0503238c232c7dff1b0a827db80d245d38a05a8812719b93954d7881119a2f2f47e82f8217f171a8ad
SSDEEP 384:nsiFJjccCs+Bt0S3T8Nk8TUNTUlIRE64dkKou14fDKPhHmn1oMaXBf+jGyCfSBFa:XFJccQzHwgsOKPhHm1oJpMbCfSnaLz
TLSH
T1A5D24A3298A4CDB7ECE68AD9B74A7753EEE00163D98C4ED4D6D84E5C00C719D174BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 ce5002e0954ae5f0445715913f198036dfdf9d181adfa268af121c56870f1165
MD5 54610fc38efa39e3c890efefeeb9500e
SHA1 ba657ab25f7e154838d2fd85aa21447478b64287
SHA512 e83fed1c25d162fd3641a4c69ed9340cc0b261009ecbfc54650dacd5ea0b3429a4eceeb47a68216f6d406bde38620513fa2189cf6881522559034ba0a38e115f
SSDEEP 384:nxiFavqMV38Nk8TUNTUlIR64dCKou14fDKPhHmn1oMaXBf+jGjCfzDOArN1k+5vL:YFaya3HwgpOKPhHm1oJpMUCfzqE7
TLSH
T11BC23936D8A8CD67ECEA4B89B74A7643EEE001A3D98C4FD4E6D85D1D00D719D270BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 1b4ca5003556ed3a2633df878821f4b136974e9e586e2677bbfb4ec1ae36dcbd
MD5 c04833df40eebfa1a78e182f18302e40
SHA1 327c238fc2411d0ef2be0b4285e6ff5b66833694
SHA512 013db399bfa68243dfd54a3d32dacaee8f85cd26dd18f07310f1f1ae1dca4c82a3e4f6ccf605f2f4aacb6c353d7360c7a2e70ce872d898f39f768033ca9dd336
SSDEEP 384:nxiFJjccCs+Bt0S3b8Nk8TUNTUlIRE64dkKou14fDKPhHmn1oMaXBf+jGjCfSBFa:YFJccQ7HwgsOKPhHm1oJpMUCfSnaLz
TLSH
T140C25A3298A4CDB7ECE68AD9B74A7753EEE00163D98C4ED4DAD84E5C00871DD174BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 265f973437a74550f0c30381751a4f0f7d213749a0f577bc45e283fb51a94f96
MD5 c2b390104a44982afef3bb0b6fe6d3e5
SHA1 b206a8bd4b4b75bc793c7ce1a0257ffb8ae39fc2
SHA512 c6a3b5eb814b9984b58fa60a0e3e8d3f2c81b23b6b417e8926cbd5ddae05a9fc3daad14c21be81330bcb5844e3b667843d800cdccd22c94670844fd67cd3b2ab
TLSH
T1AD4161D18C3D26D1D8BD1A3E648B38FC95DCD72AF4A4357D6824EAD8063A61CB08443F
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3316_1294893990\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3316_1294893990\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1892-204-0x000001BAAFD20000-0x000001BAAFD51000-memory.dmp

Download

memory/4328-0-0x0000000004A90000-0x0000000004A91000-memory.dmp

Download

memory/4328-11-0x0000000001FD0000-0x000000000240B000-memory.dmp

Download

memory/4816-67-0x0000017EB8D70000-0x0000017EB8DA1000-memory.dmp

Download