neshta | 12d77593e6e4eb659ac56497eefd7e6b90691bd978224ee471e12d36c48cc150

Analysis

max time kernel
149s
max time network
156s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/04/2026, 04:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
Size 5.0MB
Sample260417-errm4se12m
SHA256 12d77593e6e4eb659ac56497eefd7e6b90691bd978224ee471e12d36c48cc150
MD5 cac66be90f52254c5588f6b2255af239
SHA1 bbd7899c2a5c83e0bb3cd30a206a91d6006d35c8
SHA512 9448b0c96bf07aa1a3064090571268a77a5647630a6f4b2fc6846d891087cd3c0120bc6f150cc97fe64eefe1e53b9aa35c48a1b0fe786b3d72a7bad04cdeb352
SSDEEP 49152:5qIjwPVlTiIdAcDHQM8WSJRY4ne86k9CBZhskt+8+W5gMsViNLKvdlZyuJMPcePi:xSDH18WSjTWWC7xnW7b+PCnt
TLSH
T1AE366C03F2FA41D8E0BAE7759B269232E976BC454B34A1DF065136191E35FE09F38722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery neshta persistence spyware stealer

Malware Config

Signatures

Family: Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta

Detect Neshta payload 51 IoCs

resource	yara_rule
behavioral2/files/0x0006000000027a71-196.dat	family_neshta
behavioral2/files/0x000100000002a67b-394.dat	family_neshta
behavioral2/files/0x001a00000002b4a7-481.dat	family_neshta
behavioral2/memory/4920-502-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/files/0x0006000000027a80-549.dat	family_neshta
behavioral2/files/0x0006000000027a88-555.dat	family_neshta
behavioral2/files/0x000100000002a6fe-575.dat	family_neshta
behavioral2/files/0x00020000000266b0-580.dat	family_neshta
behavioral2/files/0x000200000002666a-579.dat	family_neshta
behavioral2/files/0x0002000000026661-578.dat	family_neshta
behavioral2/files/0x000100000002a75d-576.dat	family_neshta
behavioral2/files/0x000100000002a6f7-574.dat	family_neshta
behavioral2/files/0x000100000002a6f2-573.dat	family_neshta
behavioral2/files/0x000100000002a6ec-571.dat	family_neshta
behavioral2/files/0x000100000002a6ea-570.dat	family_neshta
behavioral2/files/0x000100000002a72f-569.dat	family_neshta
behavioral2/files/0x000100000002a676-568.dat	family_neshta
behavioral2/files/0x000100000002a675-567.dat	family_neshta
behavioral2/files/0x0002000000000478-566.dat	family_neshta
behavioral2/files/0x0002000000000476-565.dat	family_neshta
behavioral2/files/0x000100000002a924-564.dat	family_neshta
behavioral2/memory/3444-592-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/files/0x0001000000028d2f-562.dat	family_neshta
behavioral2/files/0x0001000000028d2e-561.dat	family_neshta
behavioral2/files/0x0001000000028d2d-560.dat	family_neshta
behavioral2/files/0x0001000000029e22-559.dat	family_neshta
behavioral2/files/0x0001000000028d83-558.dat	family_neshta
behavioral2/files/0x0002000000027b60-557.dat	family_neshta
behavioral2/files/0x0008000000027a8a-556.dat	family_neshta
behavioral2/files/0x0004000000027b5c-548.dat	family_neshta
behavioral2/files/0x0001000000027ae2-547.dat	family_neshta
behavioral2/files/0x0004000000027b9b-546.dat	family_neshta
behavioral2/files/0x0001000000027afa-545.dat	family_neshta
behavioral2/files/0x0004000000027b89-544.dat	family_neshta
behavioral2/files/0x0001000000027ae7-543.dat	family_neshta
behavioral2/files/0x0006000000027a69-538.dat	family_neshta
behavioral2/files/0x0001000000027a78-542.dat	family_neshta
behavioral2/files/0x0004000000027b88-541.dat	family_neshta
behavioral2/files/0x0006000000027a65-540.dat	family_neshta
behavioral2/files/0x0007000000027ad1-537.dat	family_neshta
behavioral2/files/0x0004000000027b96-536.dat	family_neshta
behavioral2/memory/3788-794-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/3232-923-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/4112-1205-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/3444-1300-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/4112-1331-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/3444-1341-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/4112-1384-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/3444-1386-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/4112-1407-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/3444-1406-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4112 created 2688	4112	identity_helper.exe	51

Executes dropped EXE 11 IoCs

pid	Process
5232	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
5996	identity_helper.exe
4112	identity_helper.exe
4920	svchost.com
4572	IDENTI~1.EXE
3788	setup.exe
3232	svchost.com
3108	setup.exe
2076	setup.exe
6008	setup.exe
5148	setup.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\ELEVAT~1.EXE	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\IDENTI~1.EXE	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateComRegisterShell64.exe	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	identity_helper.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\pwahelper.exe	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\msedge.exe	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeComRegisterShellARM64.exe	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\MICROS~1.EXE	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13195~1.65\MIA062~1.EXE	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	identity_helper.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	identity_helper.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\074d301a-6342-4d3c-aa0a-b0cc6b3ef258.tmp	setup.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	identity_helper.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\3108_13420872671613325_3108.pma	setup.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13195~1.65\MICROS~4.EXE	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	identity_helper.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	identity_helper.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	identity_helper.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\INSTAL~1\setup.exe	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	identity_helper.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\BHO\IE_TO_~1.EXE	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\cookie_exporter.exe	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\COOKIE~1.EXE	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13195~1.65\MICROS~2.EXE	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\notification_click_helper.exe	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\Application\msedge.exe	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	identity_helper.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13195~1.65\MICROS~1.EXE	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\Application\msedge.exe	identity_helper.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13195~1.65\MI391D~1.EXE	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13195~1.65\MICROS~3.EXE	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe

Drops file in Windows directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svchost.com	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\Windows\svchost.com	svchost.com
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5196_1331709617\nav_config.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\Windows\svchost.com	setup.exe
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5196_922543763\manifest.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5196_405167523\manifest.json	msedge.exe
File opened for modification	C:\Windows\directx.sys	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\svchost.com	svchost.com
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5196_1331709617\manifest.json	msedge.exe
File opened for modification	C:\Windows\svchost.com	identity_helper.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5196_922543763\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	identity_helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4828	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134208726719829059"	msedge.exe

Modifies registry class 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings	identity_helper.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1383858298-2057492509-1726743289-1000\{396BDD51-D462-443E-B0EC-E98DDD626485}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\Local Settings	setup.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4956	msedge.exe
4956	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5196	msedge.exe
5196	msedge.exe
5196	msedge.exe
5196	msedge.exe
5196	msedge.exe
5196	msedge.exe
5196	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5196	msedge.exe
5196	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 5232	3444	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe	81
PID 5232 wrote to memory of 5196	5232	2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe	82
PID 5196 wrote to memory of 5268	5196	msedge.exe	83
PID 5196 wrote to memory of 4828	5196	msedge.exe	84
PID 5196 wrote to memory of 2452	5196	msedge.exe	87
PID 5196 wrote to memory of 2452	5196	msedge.exe	87
PID 5196 wrote to memory of 5576	5196	msedge.exe	85
PID 5196 wrote to memory of 5576	5196	msedge.exe	85
PID 5196 wrote to memory of 5576	5196	msedge.exe	85
PID 5196 wrote to memory of 6040	5196	msedge.exe	88
PID 5196 wrote to memory of 6040	5196	msedge.exe	88
PID 5196 wrote to memory of 6040	5196	msedge.exe	88
PID 5196 wrote to memory of 5828	5196	msedge.exe	89
PID 5196 wrote to memory of 5828	5196	msedge.exe	89
PID 5196 wrote to memory of 5828	5196	msedge.exe	89
PID 5196 wrote to memory of 5480	5196	msedge.exe	90
PID 5196 wrote to memory of 6136	5196	msedge.exe	91
PID 5196 wrote to memory of 5688	5196	msedge.exe	92
PID 5196 wrote to memory of 5136	5196	msedge.exe	93
PID 5196 wrote to memory of 5488	5196	msedge.exe	94
PID 5196 wrote to memory of 2720	5196	msedge.exe	95
PID 5196 wrote to memory of 1928	5196	msedge.exe	96
PID 5196 wrote to memory of 5136	5196	msedge.exe	93
PID 5196 wrote to memory of 5136	5196	msedge.exe	93
PID 5196 wrote to memory of 5488	5196	msedge.exe	94
PID 5196 wrote to memory of 5488	5196	msedge.exe	94
PID 5196 wrote to memory of 2720	5196	msedge.exe	95
PID 5196 wrote to memory of 2720	5196	msedge.exe	95
PID 5196 wrote to memory of 1928	5196	msedge.exe	96
PID 5196 wrote to memory of 1928	5196	msedge.exe	96
PID 5196 wrote to memory of 4288	5196	msedge.exe	98
PID 5196 wrote to memory of 736	5196	msedge.exe	99
PID 5196 wrote to memory of 736	5196	msedge.exe	99
PID 4288 wrote to memory of 2336	4288	msedge.exe	100
PID 5196 wrote to memory of 2772	5196	msedge.exe	102
PID 5196 wrote to memory of 2772	5196	msedge.exe	102
PID 5196 wrote to memory of 4200	5196	msedge.exe	103
PID 5196 wrote to memory of 3392	5196	msedge.exe	104
PID 5196 wrote to memory of 4200	5196	msedge.exe	103
PID 5196 wrote to memory of 3392	5196	msedge.exe	104
PID 5196 wrote to memory of 4112	5196	msedge.exe	106
PID 4112 wrote to memory of 4920	4112	identity_helper.exe	107
PID 4920 wrote to memory of 4572	4920	svchost.com	108
PID 5196 wrote to memory of 1180	5196	msedge.exe	109
PID 5196 wrote to memory of 1180	5196	msedge.exe	109
PID 5196 wrote to memory of 3788	5196	msedge.exe	110
PID 5196 wrote to memory of 5700	5196	msedge.exe	111
PID 5196 wrote to memory of 5700	5196	msedge.exe	111
PID 3788 wrote to memory of 3232	3788	setup.exe	112
PID 3232 wrote to memory of 3108	3232	svchost.com	113
PID 3108 wrote to memory of 2076	3108	setup.exe	114
PID 3108 wrote to memory of 6008	3108	setup.exe	115
PID 6008 wrote to memory of 5148	6008	setup.exe	116
PID 5196 wrote to memory of 5752	5196	msedge.exe	117
PID 5196 wrote to memory of 5752	5196	msedge.exe	117
PID 5196 wrote to memory of 5696	5196	msedge.exe	118
PID 5196 wrote to memory of 5696	5196	msedge.exe	118
PID 5196 wrote to memory of 4928	5196	msedge.exe	119
PID 5196 wrote to memory of 4928	5196	msedge.exe	119
PID 5196 wrote to memory of 1280	5196	msedge.exe	120
PID 5196 wrote to memory of 1280	5196	msedge.exe	120
PID 5196 wrote to memory of 5036	5196	msedge.exe	123
PID 5196 wrote to memory of 5036	5196	msedge.exe	123
PID 5196 wrote to memory of 5900	5196	msedge.exe	124

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2688
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\IDENTI~1.EXE" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,18133739891667242629,8298699957217609895,524288 --field-trial-handle=2376,i,6631874317313933771,7543549624837049021,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4920
- - C:\Users\Admin\AppData\Local\Temp\3582-490\IDENTI~1.EXE
    C:\Users\Admin\AppData\Local\Temp\3582-490\IDENTI~1.EXE --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,18133739891667242629,8298699957217609895,524288 --field-trial-handle=2376,i,6631874317313933771,7543549624837049021,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
    3⤵
    - Executes dropped EXE
    PID:4572

C:\Users\Admin\AppData\Local\Temp\2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe"
1⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Users\Admin\AppData\Local\Temp\3582-490\2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:5232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --force-first-run
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffa5319c188,0x7ffa5319c194,0x7ffa5319c1a0
      4⤵
      PID:5268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1712,i,3858087214619008054,13856235531930621805,524288 --field-trial-handle=2376,i,6631874317313933771,7543549624837049021,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:11
      4⤵
      System Time Discovery
      PID:4828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1572,i,2151573389931791264,36046659522174980,262144 --field-trial-handle=2376,i,6631874317313933771,7543549624837049021,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:2
      4⤵
      PID:5576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2400,i,16021938618986038634,10215842464853228745,524288 --field-trial-handle=2376,i,6631874317313933771,7543549624837049021,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:13
      4⤵
      PID:2452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,5571622290597950704,8465697018206220562,2097152 --field-trial-handle=2376,i,6631874317313933771,7543549624837049021,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
      4⤵
      PID:6040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,10327863871707246756,1249046687165879214,2097152 --field-trial-handle=2376,i,6631874317313933771,7543549624837049021,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
      4⤵
      PID:5828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4068,i,3682875437192420647,12530790923699001154,524288 --field-trial-handle=2376,i,6631874317313933771,7543549624837049021,262144 --variations-seed-version --mojo-platform-channel-handle=4080 /prefetch:14
      4⤵
      PID:5480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4088,i,9746225834940919826,15225770748911279660,524288 --field-trial-handle=2376,i,6631874317313933771,7543549624837049021,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:14
      4⤵
      PID:6136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4104,i,16506309118941238816,936836872089664345,524288 --field-trial-handle=2376,i,6631874317313933771,7543549624837049021,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:14
      4⤵
      PID:5688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4200,i,8532424465979233387,8248798111126401326,2097152 --field-trial-handle=2376,i,6631874317313933771,7543549624837049021,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:1
      4⤵
      PID:5136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4216,i,8924462252836199303,16202775910021537465,2097152 --field-trial-handle=2376,i,6631874317313933771,7543549624837049021,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:9
      4⤵
      PID:5488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4152,i,5153517133577810342,1657143338118586493,2097152 --field-trial-handle=2376,i,6631874317313933771,7543549624837049021,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
      4⤵
      PID:2720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4184,i,8521843857177041486,1540710200607415852,2097152 --field-trial-handle=2376,i,6631874317313933771,7543549624837049021,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:9
      4⤵
      PID:1928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3868,i,2706801199660221065,15531932974182663064,524288 --field-trial-handle=2376,i,6631874317313933771,7543549624837049021,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4288
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1112
        5⤵
        
        PID:2336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,10093953985290528149,962775880056920384,524288 --field-trial-handle=2376,i,6631874317313933771,7543549624837049021,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:14
      4⤵
      PID:736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5596,i,8719054904337214783,10206451947177946830,524288 --field-trial-handle=2376,i,6631874317313933771,7543549624837049021,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
      4⤵
      PID:2772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,13967663870494531583,7274886611334189476,524288 --field-trial-handle=2376,i,6631874317313933771,7543549624837049021,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
      4⤵
      PID:4200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,6141994319952513519,10605318388143358158,524288 --field-trial-handle=2376,i,6631874317313933771,7543549624837049021,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
      4⤵
      PID:3392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,18133739891667242629,8298699957217609895,524288 --field-trial-handle=2376,i,6631874317313933771,7543549624837049021,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
      4⤵
      Executes dropped EXE
      PID:5996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,18133739891667242629,8298699957217609895,524288 --field-trial-handle=2376,i,6631874317313933771,7543549624837049021,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,17374176784343603957,11158630299497915678,524288 --field-trial-handle=2376,i,6631874317313933771,7543549624837049021,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:14
      4⤵
      PID:1180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3788
    - - C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3232
      - C:\Users\Admin\AppData\Local\Temp\3582-490\setup.exe
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\setup.exe --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\setup.exe
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 --annotation=exe=C:\Users\Admin\AppData\Local\Temp\3582-490\setup.exe --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x230,0x234,0x238,0x20c,0x23c,0x7ff6d58e04c8,0x7ff6d58e04d4,0x7ff6d58e04e0
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3582-490\setup.exe" --msedge --system-level --verbose-logging --installerdata="C:\Program Files (x86)\Microsoft\Edge\Application\master_preferences" --create-shortcuts=1 --install-level=0
        7⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\setup.exe
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 --annotation=exe=C:\Users\Admin\AppData\Local\Temp\3582-490\setup.exe --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x230,0x234,0x238,0x20c,0x23c,0x7ff6d58e04c8,0x7ff6d58e04d4,0x7ff6d58e04e0
        8⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6908,i,6771050485050715347,3997010194098333021,524288 --field-trial-handle=2376,i,6631874317313933771,7543549624837049021,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:14
      4⤵
      PID:5700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6824,i,2191221801683995751,15663461632064537910,524288 --field-trial-handle=2376,i,6631874317313933771,7543549624837049021,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:14
      4⤵
      PID:5752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6988,i,2497009549983187449,16433290151539555336,524288 --field-trial-handle=2376,i,6631874317313933771,7543549624837049021,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:14
      4⤵
      PID:5696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,1377167316947336435,10292108838744620591,524288 --field-trial-handle=2376,i,6631874317313933771,7543549624837049021,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:14
      4⤵
      PID:4928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,70817040696219042,2566370356521768611,524288 --field-trial-handle=2376,i,6631874317313933771,7543549624837049021,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:14
      4⤵
      PID:1280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3844,i,3206110383506613261,4891313006409794509,524288 --field-trial-handle=2376,i,6631874317313933771,7543549624837049021,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:14
      4⤵
      PID:5036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,8549791157485442499,102005607068955720,524288 --field-trial-handle=2376,i,6631874317313933771,7543549624837049021,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:14
      4⤵
      PID:5900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6516,i,4426909713577326092,13363009717698175200,262144 --field-trial-handle=2376,i,6631874317313933771,7543549624837049021,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,8541584007549416591,12847258528160986708,524288 --field-trial-handle=2376,i,6631874317313933771,7543549624837049021,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:14
      4⤵
      PID:3956

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ACROBR~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE
Size 328KB
SHA256 888a1dd0033e5d758a4e731e3e55357de866e80d03b1b194375f714e1fd4351d
MD5 39c8a4c2c3984b64b701b85cb724533b
SHA1 c911f4c4070dfe9a35d9adcb7de6e6fb1482ce00
SHA512 f42ca2962fe60cff1a13dea8b81ff0647b317c785ee4f5159c38487c34d33aecba8478757047d31ab2ee893fbdcb91a21655353456ba6a018fc71b2278db4db2
SSDEEP 6144:k9x6edjvw6L6jAVnhH1Am2ZBU4M528hW8Bi7Q5VYN9:Y6exwI1oB8RZ4Q5VYH
TLSH
T1DC645B017F908EB6F5A2807F5D7A631D5A6ABA221B10E2C373703B5DCD321C59A3E356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ACROTE~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
Size 86KB
SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
MD5 3b73078a714bf61d1c19ebc3afc0e454
SHA1 9abeabd74613a2f533e2244c9ee6f967188e4e7e
SHA512 75959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4
SSDEEP 1536:JxqjQ+P04wsmJCNgh/sE/EkHd0Ci2zkQASqk+H6L2C:sr85CysEM6GC+QA8+HlC
TLSH
T17493AE13FAF18872D1621BF89C29E359C93F7A306E3056A7A3E40D5D5D747C26C2924B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ADOBEC~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE
Size 5.7MB
SHA256 1b5c715d71384f043843ea1785a6873a9f39d2daae112ccdeffcd88b10a3a403
MD5 09acdc5bbec5a47e8ae47f4a348541e2
SHA1 658f64967b2a9372c1c0bdd59c6fb2a18301d891
SHA512 3867bf98e1a0e253114a98b78b047b0d8282b5abf4aaf836f31cc0e26224e2a1b802c65df9d90dc7696a6dbcb9a8e4b900f1d1299e1b11e36f095ebaf8a2e5b8
SSDEEP 49152:DmlI9H9rY654KYroYJqkhWFUBlNwnFq3kXRsPI6BRY20YZAliDgFL2YmXZjU2P38:oiH9MfT3NwMkKhBRr0yAk6qkKvq
TLSH
T1F3567C22B902C139E15102B159ECBFE9C49D99348FB105DFBAC41F6E9A613E33931E67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ADelRCP.exe

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe
Size 175KB
SHA256 3f00404dd591c2856e6f71bd78423ed47199902e0b85f228e6c4de72c59ddffe
MD5 576410de51e63c3b5442540c8fdacbee
SHA1 8de673b679e0fee6e460cbf4f21ab728e41e0973
SHA512 f7761f3878775b30cc3d756fa122e74548dfc0a27e38fa4109e34a59a009df333d074bf14a227549ae347605f271be47984c55148685faac479aeb481f7191db
SSDEEP 3072:sr85CnHb5CZCq5DACsVlNl7HIJ1PcJ7LxnkdA53Pa4sjSTX4:k9n4N5QVrZZ7Lxkmsjj
TLSH
T119045C22BBC09075E69317723EFC79E44BF6BC319AA410ABF318495B197E350963931B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RdrCEF.exe

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe
Size 9.4MB
SHA256 31da9632f5d25806b77b617d48da52a14afc574bbe1653120f97705284ea566c
MD5 322302633e36360a24252f6291cdfc91
SHA1 238ed62353776c646957efefc0174c545c2afa3d
SHA512 5a1f7c44ce7f5036bffc18ebac39e2bf70e6f35fa252617d665b26448f4c4473adfa115467b7e2d9b7068823e448f74410cdcdfef1ac1c09021e051921787373
SSDEEP 98304:FrbT5JhEP+SuC0qyLfPeLDo/uLGM7gbl91hxkPZTA:lXnfW/JLGMcblLheTA
TLSH
T186A6AF1D7BE21036CD732176AF4FA104E739D007A215C6977ADC83981FB1AA152B6FE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcroRd32.exe

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
Size 2.4MB
SHA256 8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6
MD5 8ffc3bdf4a1903d9e28b99d1643fc9c7
SHA1 919ba8594db0ae245a8abd80f9f3698826fc6fe5
SHA512 0b94ead97374d74eaee87e7614ddd3911d2cf66d4c49abbfd06b02c03e5dd56fd00993b4947e8a4bcd9d891fa39cab18cc6b61efc7d0812e91eb3aea9cd1a427
SSDEEP 49152:oTfiUEWo6zuEz439z99akTBc4O8b8ITDnlT4NvJX:oTfiG/nzU90T
TLSH
T179C59226A2C8C0EBE5642170CC59BBF900546D78DBA2CDD7BD447E16BA307D29533A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WCCHRO~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE
Size 183KB
SHA256 ecd5e94da88c653e4c34b6ab325e0aca8824247b290336f75c410caa16381bc5
MD5 9dfcdd1ab508b26917bb2461488d8605
SHA1 4ba6342bcf4942ade05fb12db83da89dc8c56a21
SHA512 1afc1b95f160333f1ff2fa14b3f22a28ae33850699c6b5498915a8b6bec1cfc40f33cb69583240aa9206bc2ea7ab14e05e071275b836502a92aa8c529fc1b137
SSDEEP 3072:sr85Cl8pIsfHwCbf9MFdRvyAgnz8n/dfQ7PjFKq23T/h:k9KbfHwCbyFdAafCPc53T/h
TLSH
T177046B51F7C7C9B2E09206704C2AAF6541B9FE381F7105EBF3E87A1E5A713C2182566B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eula.exe

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe
Size 131KB
SHA256 5c3ef3ec7594c040146e908014791dd15201ba58b4d70032770bb661b6a0e394
MD5 5791075058b526842f4601c46abd59f5
SHA1 b2748f7542e2eebcd0353c3720d92bbffad8678f
SHA512 83e303971ed64019fde9e4ba6f6e889f8fb105088490dfa7dcf579a12baff20ef491f563d132d60c7b24a4fd3cac29bd9dc974571cd162000fae8fba4e0e54fb
SSDEEP 3072:sr85Ciq9YnyoRmLisiselSsONt3F7oQGO7M1bp:k9kgLHvld2
TLSH
T19CD37C13BBE0C872D66207785D25F36696AFF6305E74CB677B880B0E9DB46824D0C64A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FULLTR~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE
Size 254KB
SHA256 16d65f2463658a72dba205dcaa18bc3d0bab4453e726233d68bc176e69db0950
MD5 4ddc609ae13a777493f3eeda70a81d40
SHA1 8957c390f9b2c136d37190e32bccae3ae671c80a
SHA512 9d7f90d1529cab20078c2690bf7bffab5a451a41d8993781effe807e619da0e7292f991da2f0c5c131b111d028b3e6084e5648c90816e74dfb664e7f78181bc5
SSDEEP 3072:sr85CYl4dsOc6v2vTzwU+Pho86meq+FaSoB2+vSHr8qcVz5fzsC:k9r3PiY+Fa7BdvG1cT7
TLSH
T128446B307B86C53BE66301718CF8EBBF942EBA150F6851D7B3984B5E5EA05D32E31846
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOGTRA~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE
Size 386KB
SHA256 473eb551101caeaf2d18f811342e21de323c8dd19ed21011997716871defe997
MD5 8c753d6448183dea5269445738486e01
SHA1 ebbbdc0022ca7487cd6294714cd3fbcb70923af9
SHA512 4f6fddefc42455540448eac0b693a4847e21b68467486376a4186776bfe137337733d3075b7b87ed7dac532478dc9afc63883607ec8205df3f155fee64c7a9be
SSDEEP 6144:k9W3n0dK2NP0RHx8D98WTBPW8fF8oABm1nKZ0RsrI:WKhHSDeWTRW8fdebmqI
TLSH
T16A84AE11FB86C172D96602728DAAA35CC4BDB5714F314BD3E3DC6F0D9E601D2A932B86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

READER~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE
Size 92KB
SHA256 2f947e3ca624ce7373080b4a3934e21644fb070a53feeaae442b15b849c2954f
MD5 176436d406fd1aabebae353963b3ebcf
SHA1 9ffdfdb8cc832a0c6501c4c0e85b23a0f7eff57a
SHA512 a2d1a714e0c1e5463260c64048ba8fd5064cfa06d4a43d02fc04a30748102ff5ba86d20a08e611e200dc778e2b7b3ae808da48132a05a61aa09ac424a182a06a
SSDEEP 1536:JxqjQ+P04wsmJC66w8MghW4wNlu9HQIXsW/44:sr85C66w8oFlKwW//
TLSH
T1E1936C13BB928E33D4204AB91C6997B8D4BEF5306F1556E367650A4E8DBC3C22C3925F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WOW_HE~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE
Size 147KB
SHA256 750824b5f75c91a6c2eeb8c5e60ae28d7a81e323d3762c8652255bfea5cba0bb
MD5 3b35b268659965ab93b6ee42f8193395
SHA1 8faefc346e99c9b2488f2414234c9e4740b96d88
SHA512 035259a7598584ddb770db3da4e066b64dc65638501cdd8ff9f8e2646f23b76e3dfffa1fb5ed57c9bd15bb4efa3f7dd33fdc2e769e5cc195c25de0e340eb89ab
SSDEEP 3072:sr85Ce6l8TRpR+EMucyaGoS43IIJNdS3UA:k9e6l8aGo/3VL4kA
TLSH
T15EE38C57B7E134F8E1768A78CC615608EB32B8352A319BAF03A4065A5F273C05E3DF25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arh.exe

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe
Size 125KB
SHA256 fe44ca8d5050932851aa54c23133277e66db939501af58e5aeb7b67ec1dde7b5
MD5 cce8964848413b49f18a44da9cb0a79b
SHA1 0b7452100d400acebb1c1887542f322a92cbd7ae
SHA512 bf8fc270229d46a083ced30da6637f3ca510b0ce44624a9b21ec6aacac81666dffd41855053a936aa9e8ea6e745a09b820b506ec7bf1173b6f1837828a35103d
SSDEEP 1536:JxqjQ+P04wsmJCWM2D57Kykf8d/R8Tyr5J5is7MDjrXDyO4zkm8dbHVLokF8iJTp:sr85CCQw/STyr5Jks7MvrMzkm8PL3Eo
TLSH
T127C3AE22F6A1C432D4920D788919C3B18E3F7D3169A99957F7E80B5E9E607C0EA1D31F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32BITM~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE
Size 142KB
SHA256 3e9da97a7106122245e77f13f3f3cc96c055d732ab841eb848d03ac25401c1bc
MD5 92dc0a5b61c98ac6ca3c9e09711e0a5d
SHA1 f809f50cfdfbc469561bced921d0bad343a0d7b4
SHA512 d9eefb19f82e0786d9be0dbe5e339d25473fb3a09682f40c6d190d4c320cca5556abb72b5d97c6b0da4f8faefdc6d39ac9d0415fdf94ebcc90ecdf2e513c6a31
SSDEEP 1536:JxqjQ+P04wsmJC9S7UmwuBLAefbVH8x+FOI31EmkIY2d5J6WUghEuireklhKsikg:sr85Cs7HN9fN8sFOE1Z5Y2966ilU9xL
TLSH
T1F2E38D21F5C188B2E67205B54D2AA79E942CF6340F3194E3B3E84F2D9D342C39F765A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

64BITM~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE
Size 278KB
SHA256 22a585c183e27b3c732028ff193733c2f9d03700a0e95e65c556b0592c43d880
MD5 12c29dd57aa69f45ddd2e47620e0a8d9
SHA1 ba297aa3fe237ca916257bc46370b360a2db2223
SHA512 255176cd1a88dfa2af3838769cc20dc7ad9d969344801f07b9ebb372c12cee3f47f2dba3559f391deab10650875cad245d9724acfa23a42b336bfa96559a5488
SSDEEP 6144:k9P1UKupTu8ffMb0/GxsZfcJtqQ1UBZ6g:jK+HMYcytZh
TLSH
T105546C1A77D84CF5E467C23DCD528642E2B278551B34D7CB6760022AAF637E0AE3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ADOBEA~1.EXE

Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE
Size 454KB
SHA256 bb07d817b8b1b6b4c25e62b6120e51dec10118557d7b6b696ad084a5ba5bfdeb
MD5 bcd0f32f28d3c2ba8f53d1052d05252d
SHA1 c29b4591df930dabc1a4bd0fa2c0ad91500eafb2
SHA512 79f407735853f82f46870c52058ceee4d91857a89db14868ee1169abd5c0fd2e3fa1ed230ab90b5f479a9581b88998643d69b0df498defea29e73b0d487f3b10
SSDEEP 6144:k9sQsSVWSLjX2PxPNMRyfn7LzPdKblt0K+HAfh0v8axsbQuXYvr6yIll6Jf:+VWnxlMSn7nFKbltn+Ch/m6Xl6l
TLSH
T1E1A47C1077D0C036F1B329768A7FE728546DB9715F6881CFE3881A6E4E706E0AA3571B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.exe

Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe
Size 1.2MB
SHA256 b1ec065f71cc40f400e006586d370997102860504fd643b235e8ed9f5607262a
MD5 d47ed8961782d9e27f359447fa86c266
SHA1 d37d3f962c8d302b18ec468b4abe94f792f72a3b
SHA512 3e33f2cdf35024868b183449019de9278035e7966b342ba320a6c601b5629792cbb98a19850d4ca80b906c85d10e8503b0193794d1f1efa849fa33d26cff0669
SSDEEP 12288:M0ZRHkXVfeeO4LMneqyQsWSjGQCfLBlS7guN1AnQ6i12NI+03Sgouvb:M0ZRHkFfenxyQZXS7gZnQh2NIDSgouvb
TLSH
T19D45E50267F94129F1F37B71EEB993645A77BC61AE39C50E5284025E0DB4A90EE31B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaureg.exe

Path C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe
Size 555KB
SHA256 c5a99f42100834599e4995d0a178b32b772a6e774a4050a6bb00438af0a6a1f3
MD5 ce82862ca68d666d7aa47acc514c3e3d
SHA1 f458c7f43372dbcdac8257b1639e0fe51f592e28
SHA512 bca7afd6589c3215c92fdaca552ad3380f53d3db8c4b69329a1fa81528dd952a14bf012321de92ad1d20e5c1888eab3dd512b1ac80a406baccc37ee6ff4a90dc
SSDEEP 12288:PKv89GDYikjjqggz7/PtFxRNWBYrpkQJ7u:PKqjjg/PzNWyr9J7u
TLSH
T1A5C4BF2079A0C032D17311344D6AE794A63EF6700E7249E777D46FBD7E346C1EB28AA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOIN~1.EXE

Path C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE
Size 121KB
SHA256 405b8bd647fa703e233b8b609a18999abe465a8458168f1daf23197bd2ea36aa
MD5 cbd96ba6abe7564cb5980502eec0b5f6
SHA1 74e1fe1429cec3e91f55364e5cb8385a64bb0006
SHA512 a551001853f6b93dfbc6cf6a681820af31330a19d5411076ff3dbce90937b3d92173085a15f29ebf56f2ef12a4e86860ac6723ebc89c98ea31ea7a6c7e3d7cdc
SSDEEP 3072:sr85CqPo10JOSdhuPlur1Vg9uCRFRzsxeZ:k9qg1MOc4iVmRFJs0Z
TLSH
T114C37C22F9E0C032D4A219B88DACD261593E7A721B3589C337A41BDDDDB03C1AE79357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe
Size 325KB
SHA256 5e2e22ead49ce9cc11141dbeebbe5b93a530c966695d8efc2083f00e6be53423
MD5 9a8d683f9f884ddd9160a5912ca06995
SHA1 98dc8682a0c44727ee039298665f5d95b057c854
SHA512 6aecf8c5cb5796d6879f8643e20c653f58bad70820896b0019c39623604d5b3c8a4420562ab051c6685edce60aa068d9c2dbb4413a7b16c6d01a9ac10dc22c12
SSDEEP 6144:k9/jbN5zFEjGkqkAJHyEzYV/PvyeWPZw22b:GjzzFEoS2cPvyeiZwbb
TLSH
T19D649EA5B3901CF4EC63453ECC258916D6B27C2A0B70C65F13A8366A5F733911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe
Size 325KB
SHA256 e2262c798729169f697e6c30e5211cde604fd8b14769311ff4ea81abba8c2781
MD5 892cf4fc5398e07bf652c50ef2aa3b88
SHA1 c399e55756b23938057a0ecae597bd9dbe481866
SHA512 f16a9e4b1150098c5936ec6107c36d47246dafd5a43e9f4ad9a31ecab69cc789c768691fa23a1440fae7f6e93e8e62566b5c86f7ed6bb4cfe26368149ea8c167
SSDEEP 6144:k9/eWYoTOLHIsPPzAdnz0YutYPDvh2AHdwSc:GeWYoaLHF3z0z04PDvh2Cd9c
TLSH
T15A649EA5B3901CF4EC67853ECC258916D6B27C2A0B70C65F13B8366A5F333911D2DB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe
Size 505KB
SHA256 da73b6e071788372702104b9c72b6697e84e7c75e248e964996700b77c6b6f1c
MD5 452c3ce70edba3c6e358fad9fb47eb4c
SHA1 d24ea3b642f385a666159ef4c39714bec2b08636
SHA512 fe8a0b9b1386d6931dc7b646d0dd99c3d1b44bd40698b33077e7eeba877b53e5cb39ff2aa0f6919ccab62953a674577bc1b2516d9cadc0c051009b2083a08085
SSDEEP 6144:k9/4aKTRnXtTkCgwCzUg/HpjN4IBwu7QTLbpqmHdIvWTiYB2n5:GHWRdTfgwCHKy7GLbbdIvWTi4e5
TLSH
T178B43990F3E414F4F0B79A3589764511DAB67C6A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DISABL~1.EXE

Path C:\PROGRA~2\Google\Update\DISABL~1.EXE
Size 5.7MB
SHA256 3acf99624820fd862ac30780021108f0ff2df60db3df351cd17400404f279d3c
MD5 e63e539e0f0393fdea9da0d6ee80ac45
SHA1 027c8609ca7bb42b61256abb3269e1babce0141b
SHA512 f4d0458b8bfe5a66254cb85b8ba3859c9d6a937e6d14f8e15b95b7e131aaeff8a1be39f0eee3939e305901797d98dd2c5aac1837873a49f786cfcac0c9b1e6d6
SSDEEP 98304:Fog5HQ+hDHQTW6Af4fF7KkOuYO6IgF+IAMk/JexMXP8iuHG9XXYXQz7w7:Fog1P9fIlOuz6IgF+I3m2MXP6HG8QzU
TLSH
T133567C23A4E08034E5F732756D2CA73959327BA29F3145CB86946C946FB83D3293936F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IE_TO_~1.EXE

Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\BHO\IE_TO_~1.EXE
Size 557KB
SHA256 6bb357968887ad126579fb157f455e359ea036a4960a9f98f5cec1fe53931c98
MD5 2b03f86c9209825849c716434fb730bf
SHA1 1148f00cf40b0872e08f47b38bbd0c9858802aa3
SHA512 8d9b5be64e9843ec8d05af21a951e8a7501fc8fb1fc4179959ec60ea150810c0db83b7e8cedb32c44b58a0f81d09c13c4d9d8b0536711978accf47709382e71a
SSDEEP 6144:k9gGr2dzO3/lSs3AaNCaBVSa+FvChdrNSuhwK5i43FvGvu6SiZ9aD:ZGr2d29S4AaQtMhdrNSuvt+WDin2
TLSH
T1C7C49D41B3E846F9E06AC534CA438642EA7278560F34E6DF02E492792F37BE55F3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

COOKIE~1.EXE

Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\COOKIE~1.EXE
Size 161KB
SHA256 5fee43e3295682e179d6e10c568aeb640bbbcf0d6b962fd27f5b372a45fc272d
MD5 b67dba91dd68c0c9c7c78899faf33033
SHA1 4374c00761ec34d6416096524eedf439636baa94
SHA512 7065a8c6552d7dff816e288056cc2bb371bbe078798df471369382a6620c0702020102f1c39485e0c57b65279a6f0484385944f7874575d8b4351c9fa03fd8f6
SSDEEP 3072:sr85CRJjEt/g/ptvjGL/PQQpbsZAk/kJHLRdtIJsF4FxFVN:k9RJjEt/gHGrtRtIJD1N
TLSH
T134F38C57B3E430F9E2364A78C8118645EB37B8310B21AFEF07A446591E277C59E3DB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ELEVAT~1.EXE

Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\ELEVAT~1.EXE
Size 1.8MB
SHA256 47eb0dc0cd08f4faa389621c43d6407283e3c315012ef1078a6018c117f195b2
MD5 aeb70455f5c599fd2022ee73ff56bfc4
SHA1 7c3534c7cb80067ab5e6ace67e0ac0d0b8d0cc79
SHA512 5e11a5a9f28aa2e4f1d126f393232673043fffa84fa5280755ec6009e0226961343843cc0721e92d08b3fb7510fade31c118e56a993adffff3bdb4a251e67e13
SSDEEP 24576:MLaHtm12wFpUawX5LPM+bRGRpknL2NLb9Ld25PTOocJuJ/cIsY6Wfvy:yaNm12qpUTzM+bRDLwpZeToMJseC
TLSH
T1CD957B03F29941E9D06ED578C7469236E972BC890B34B6DF0290B2992E77EE45F3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\BHO\ie_to_edge_stub.exe
Size 562KB
SHA256 533d6da98378d3b1bb120b192bc5bd20bbeed6e123fe9fc6c15a4a3504932c71
MD5 dc797b816795fbca95de068b5fe4d089
SHA1 f5ed348926dd8c5b235dcac434bf3d7fba6b32fc
SHA512 e44d5b42d408ba7ad2c8c4b6f7af9f27650ab540afb68bc79f8bce4ad0b2843c67ab050b9d9568e9006756862199a90c6bf28483f889bf09257ed28af665147c
SSDEEP 6144:k9bLO76tlVr1Il5HlrJHU7kfLeeHVlK8SQBJ9LBKJwgdAmKa5rl6C:0S86nHrUA9HVlK8SQBJ9t4f15rR
TLSH
T161C48E41F3E847F8E07AC534CE528646EA7278960B61A6DF03A0527A2F376E55F3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\INSTAL~1\setup.exe
Size 7.1MB
SHA256 70c13c14a682d65fd82ec72f578e160617f8b7c164414bcce613a9b9ebd0c878
MD5 f80dd7e28ac5795b9cff0de19ea24bd3
SHA1 eb68d7d26bd4f849cefe6638bf4a3b73e3ce7a20
SHA512 af6ebd45c716d5c50395705dfa80c94c17fda338db24046051e82515b742cdc4f0503d2726278ba40a3b77e9b358f2b74704c851f28a8539dd77bee34b0e4fd4
SSDEEP 98304:V6CZetahq+WZxcpwCsJB2++fGOOxRj2vJzRN+T6frL:gCZetaEMGIG5xVqzRdDL
TLSH
T1A8766C47E3E600A8E46ED970CF2A9521DA353C8E47B492EF169476E41A32FD47B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cookie_exporter.exe

Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\cookie_exporter.exe
Size 155KB
SHA256 30d26d2f766f716cd6b21cdc15065ee4191760ef0d37de51f67dead898fb8e7c
MD5 ea213110894b1ad78e8e13686ff682c4
SHA1 49ea3bc31236ae9a32c600f7bb5cd66c49dafbdc
SHA512 77ec20210cffff94cf85ea1efb0551bc38000928b2af5f125b0597a281a3489f44d55b97dbbffba4f25e7f996a1d23d8734644f1cbd81ff3f8da42db6c9e64d9
SSDEEP 3072:sr85Co/5vndNI3Kk4+NLlzt4++++YdbeBGnRppeQBMWRywl9:k9ohvndNIaINY++++YtBnRpAFWcwl9
TLSH
T1B3F37B57B2E870F9E1324A78C8118605EB37B8711B21AFEF07A4065A1F277D19E3DB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\elevated_tracing_service.exe
Size 3.8MB
SHA256 c13ce5f473ff68ffdea61e8a4800008f527054f4561f2bf7853f6769d0c02dc5
MD5 b1de16babff63db612506d5dfcdd28f2
SHA1 4615a0df5812fc95be0f836b9d29a454da5bc67a
SHA512 5b3694c0a5f69d7ac74efe66a5b61f0b85cc73127a7805c0e93b8a368e0ee03eb72920d12988731cd9e43d7166e2cbe743deeeff02dc51a18301c14cfd394579
SSDEEP 49152:g6gu3VyrBme/hqvxbmhLbKqm006NPpIupEoEVu+e6NqcXToRzvUqIzYHBigdQBW:N3mMsYvRmCCENUhIUBbF
TLSH
T1A8063903F29900E8E05DD578CB568122EAB2BC854B35B2DF0750B7562E7BEE4AB3D750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\elevation_service.exe
Size 2.2MB
SHA256 8c53985c403e44c0c899c2d1f2a0b8afb1f17fb928ff866271de7952c9ff7c66
MD5 0db104178cbb26201b06ca53a8c18e39
SHA1 36cd76eb3cf04bd3cdf0fc3be4ec84fc52663040
SHA512 7c7871ad15851162facfb71f854f72869c833a68ed26c331d21c7900ac4fd87a5dcd9fc7ea2f494155b51d9b2f7c40a29dcd0cf06215ed7255c376106120dfe2
SSDEEP 49152:pb+632BuPkFKRrdE6oh2stBhuXjfS4LWxn9:/3q6DjBK
TLSH
T1A4B56B03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\msedge.exe
Size 4.0MB
SHA256 18f4157c2dabb39cf84662e17c471f69f679840a70be3a4685e0c4ed8ccc207a
MD5 48d1aea6577f190f1e31b4ce9c2c3a83
SHA1 7bc44982c5a6bf7506d6f2dc4b2630caf0b263ce
SHA512 be71c8f0481b619aceb33b32a9222b0b6909fd07866f01374fc92fa08632ff01b7708166239c284bd1429a6b44f3edc351db346d877f174a369be9edb61dbbd5
SSDEEP 49152:GudQuVyBvNszCnSgVdQM3/+TjER7zExldDwUIDtaZHWRdpev2y/BaK:iijnUdYd+RaAK
TLSH
T121164903B29940D8D059C074CE5AD232EB617C8947F162EF3690B7EA2A73AD47B3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\msedge_pwa_launcher.exe
Size 1.8MB
SHA256 2c31887681976e9691cfed32b98a9f81898beaaee9ea3f7a90fe695b84190511
MD5 650cdf4a369b08768ceaa48a2cfd7fdb
SHA1 d105394f9f806863e3d4a8611c76f291e13fe588
SHA512 4679c6a80bedb2de0d405037277b3c32cf04223e048ca90b79d3d709face5240cc8ad97d9bebd5f53617ce06b551421569a9e5434e68b4d6a5b7b8284155c1b6
SSDEEP 24576:Z5kAGu6McqpA7D9ruO3O7Q7OBLLMdus7CtW7KSdHBxmRkkkkkkklQXBysWAk:ZZGu6qG13O7Q7gLYduZrSdHBAVfk
TLSH
T142957C03F6DA80E5E05DC2B8CB768B35EA717C554F20A6DF0680BA652E77AD04B3D394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\msedgewebview2.exe
Size 3.4MB
SHA256 c0566225b047e50773acde8ada568ef7612809e74f2cc200504e60cf7a917c68
MD5 12403afd3d0b104f1d0f6cf034ed01f7
SHA1 08a9a2c1962f9f522c841dad14a55400a2b9e25b
SHA512 29a14f52b706b966361d9875ef3904560b41924fa959ce90985dd5e694d2ca9d0181509309bcb512563479fd5b5286cbef216e3ed5ed90cc170105f6dd13ec1c
SSDEEP 49152:DuZgk07G0auOj85q7aGScYbb6YErz7z4AkOuaRoBISCaQZCLlrrW:lo/Yhy8OnZ9
TLSH
T16CF54903A29900D8D059D074CF4A9223EBA27C8D47F566EF3690B6D52A77EE47B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_click_helper.exe

Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\notification_click_helper.exe
Size 1.6MB
SHA256 0faa9f1f62a95136d454efa51e6f8e8ff06a08d344fd26dc2216de09f6fbee4e
MD5 3b9687342c1ebc56dfa598bf9f0f8358
SHA1 794bcee37bfdcd2e8df01f9773c277629c5891b0
SHA512 addf3d1844271b0e54e8c665df1f85f521f0f14bd66bbf8fdd00eeee46315c294830d6d95e441cddbe6843b230064759e0d12e70b32690a431afdd45ee3aefbf
SSDEEP 24576:pnh1d46If99L9KA4uaiXJVB6HveuTJb9HxeQuJXlPnyF4mfHU9YawsNk:34hoNiZVB6PeuT5lxeHX04mfHIk
TLSH
T145856903F2D841E8D06DD2B8CB568122EAB27C450B34A6DF0791B65A1F7BEE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\pwahelper.exe
Size 1.4MB
SHA256 df233ebee614cd9117f7e467f16f4c2225aadbc59213a5695913a4a87f792d6a
MD5 67a7c8fa88aa1c40a5715ad4e0f8c4f0
SHA1 3d61b3c5b653549b835cbb5cae396e0e7b435b4e
SHA512 fbce329738386cc1670b58ea7c58d67cef047977d831af84e50cb811dd6cffdda5552156a0e1756d60fde2c67f3cd672bc4b6e12e2728eec70d4288e49f5efbb
SSDEEP 24576:WZGY26UEU3RyRPW+uSmS86IU8Gc7QGsVa4i6h27d3WlE:1Y2fF8FhmS86IUJWQn+6h27d/
TLSH
T152657C03F29940E8D059D1B8CB56853AEAB27C450B34A6EF0B90B7552F7BEE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSEDGE~1.EXE

Path C:\PROGRA~2\MICROS~1\Edge\Application\MSEDGE~1.EXE
Size 1.5MB
SHA256 b4bdab2b2c7731923854f254ba1494c25a11331293c0ee4939afd10ba1e2b575
MD5 8042d50db625ec28b95ecd7911222ac0
SHA1 a485755c8216c717a446bce8f2a7644328c59d1c
SHA512 8a0e4a53bb43933937d588fe6bf4754245136995d2603c4e3fcb8dd66cc8714b80255a52e75a31aac09223ed7b2f8d49594c20288aa2beeb802136f0f5f9b799
SSDEEP 24576:ryoteh6euUHmEhK7eTuNdfxINakEtv9kWG2L1oaedpEukUoygGmq/SJ:rfehjvHHKTdfxINPEt99G2Bo7EukU16
TLSH
T14C657B03F2D801E8D069D1B8C7568536E9B2BC450B24AAEF0B90B6591F7BFE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
Size 1.4MB
SHA256 cd0adfcf43373e05fcf8836cc998cb17e3aaade9f8b190e28ce4331bd026f23c
MD5 aeb91dca670fae787b272163af7828ca
SHA1 a40927cc53e24d516f86042279684973fc85b77a
SHA512 f7a6aac88fcc029cd551cb4f336fb860d06b4f0094fea7a38a70aa8f25aa1f17300fda60a989ae89e558be15dc4e31dd74365e53ed44d3a3a41126e191297833
SSDEEP 24576:YmjDvw6qZ04SuTjPn68TQuD3g9gZLfChjyosZ9HT1zYeHNrk9NrfZ3:BDvwZ2XuTjPb33g9gZLfCdW9HTlXrk9T
TLSH
T113657B03F29900E9D059D1B8C7568536EAB2BC450B34A6EF0B90B7552E3BFE46B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf6c7c1e310b8b7658a6486f9e0ec1988af55c64b0088c5e106c251843317694
MD5 6bb43aa8140737557979467fe7639310
SHA1 5d97e47df415ba67e13786711fbced4e9a750018
SHA512 8fb6570faf81d07a766da4536ff22a42ad13e3b00e64c6a1957397e3e55beaa3c40660967c718a520b4ce2092c1a8ae7388506160f6ae5fbf696f9efa13a4bd8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7K:fwUQC5VwBIiElEd2K57P7K
TLSH
T1F1B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bf89531d0e3eaeb6193d0eb94b0bec959bbc3dbf51f4b1135a0c78cf16adaa46
MD5 38938711ef0446937338851ec79a0894
SHA1 179778fce333dbfd0c0e890d77eef83f40e68189
SHA512 f43a9b63b4232462afb2de768f45ce89cf129900c80bd1d32946f956e184aba1b903c62f63f5ff2ed8fb9fb615cb1ac6ddffb909f174000b4a41a45f7daef6fc
TLSH
T104D0805C33B15C74CC968E71140DBF063699C4B2545553333C332C691C471811ED5297
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b3fe3c1f53c120f20ea643b0dc7ed8623f9d208eb1c4d7232edcc97f0b69b6
MD5 7c01ab9b4147641f5e78fe413048da53
SHA1 8e1e36c184f8a953d84d6bcf9a23a2aeccf11785
SHA512 f42cfb7a46a1c4450f02942035de8f5b217382c91026f29ea332e7a448ba0045eb1f7a5acb7c8eddde74daa258d80f1a8ba7fcf32be1c93b64cbb997ca2c55ef
TLSH
T1E7D0805C33715C74C8968E71140DBF063699C4B2545553333C332C691C471411ED5297
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 67b4e8c56346d479565256f43c838e9e87d63bbbb1260f00e2a48f277327057e
MD5 6c1f4ebe4c3555657946cf592c0aade1
SHA1 a1ac079c57beaf3d2b350a9694cf7d3a84f43aa1
SHA512 701b61671b6181ee889d752634e3f5caef52ee69473e8ba064eae96f37523e2cd5638e6126892f38c859e6c84a450771dbfb4abc9396e12f9cebc3a97bd3bf1d
SSDEEP 96:PmKvZMjKPjh5E7Uh24vEWXcN7icmaPSLIxIBj7AdgqD2VQGNhzQu:PmKv+jKPjhm7Uh+N+cmHLBj7ORwQGvl
TLSH
T19AC1C91987B2F410EBD30176D7D0987AF5F03ABA12CE9F6693CC516D290E7BE8088659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5894c9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5894c9.TMP
Size 3KB
SHA256 9f5dd0a9c4622fde1f0a72c54e268ca3652b6785639eeabdf2b685fce43cbe45
MD5 46ddb9fa632c2d2629a0fcb17c98cc2f
SHA1 8bf13b39367412b6e7568108b48cd15e3271b141
SHA512 25e0068215885294fbe8d4df8c706529ccf2ed16be9222ec85339bd71936301a29cc3e1faeb6c7cabec1748d9928bac5b380b0e26550d997c79d39c879de6cf4
TLSH
T14861C44C90B4B464E7E0017A27D1D0BAFAF0767803CBCF5AE2DCA5BE5A0E73C9144825
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

58612041-8842-4de8-90cb-68e5dd54708d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\58612041-8842-4de8-90cb-68e5dd54708d.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 4018ab1df1bf16ecb346eee084b8ac4150565252b520d92451ba42ca9933c9f8
MD5 7053cbfee08f5bba43c92efcf7ad1f4f
SHA1 c7247fbb69ff15aebf2f2e22cc26f1a38825a331
SHA512 8f98cd4c3299d13a88bbb255597b5cd6bebc5ca51a80ed247e9a035afa7780aec3763ec805be60366b2e3c5bcac0b3f1a750090c38a5ee918373fe0f05b35db4
SSDEEP 48:YALlNOOCDtCDS0iCDegy9CsPRsezEsufo7C2CnOChsNC7CYCsqCwsjCjsjCYCYhJ:DwOWgirNFzKarGOxGHEQD/jwBj6VcMl
TLSH
T1FB81BBF3C3E6816DDA1195F0AE146F1BCE290555436C3D4A85E4AF4BA3F28B1F141B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ce829fdc547667475843780c842677a30ec4c513e608507cca26394889aac090
MD5 f3f2506c47554ec425f4923a59db426b
SHA1 61228f0806788b1ae66d91409f6787d32a9c4302
SHA512 c0cf18dce004dab42fe3d174fd760445194b9589a76fc86f0c67ea44a2484cd99ab0c62898982077f9f038338dd892a74ef0f9835388e2a9e88e448ee946e12c
SSDEEP 192:zZyQUn7RHyM//K1Ml8M47/fts7y7XQxbC5dpjs/W6+WNBDc/Y0xkGiWeZIg4J:zZUn7Ng7/fts7yj/9A/bS/5yc
TLSH
T1C362F9166A34593BCDD7D219F916BB63D9F81162D6940E48E9FCCA0C08F6ADD2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 4e2ca3a823bfd7765f75ddd97c5a569aafbcacc1dc9cd2751af928c0d54c3eaa
MD5 3ace7d09a6df558b7be0115ce9023430
SHA1 8b38de28143cd8028f6fc2f67b02185a78e5a7e0
SHA512 3f298343b64addf59078e43faeb8581f19504d5c5ff847321151c6cad68bf22665c95678b1012b83da61f36ab6f52ed07884eaadf1a405cdbc9a3fcb2efdd4dc
SSDEEP 192:sxZyQUn7RHyM//K1Ml8UQ+H7/fts3VY7KwWQXQxbCHdp9s/W6+WNBDc/Y0xkNilF:sxZUn7Nqo7/fts3V8W4/z2/bS/5FqG
TLSH
T1C672FA16A534593BCCEBD11AF9067B63DAF41162D6944E48A5FCCE0C08F6ADD2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 19129678e9ddd90450a689561a4b055f3f24048a2f5302039fc1906de0e0205d
MD5 4a551c8294091bb6aa97867ae9e0ee68
SHA1 13d247e9283bd0031cd90290bd0d115f13306b3b
SHA512 04ec0214f63f557db4dd3b1fc8e9f7f88390e4989cf8f1ee9937dde48dd5275c4599f700a6b85ac97b1ec4dc0dbe84f5132f38d0fb1bcfabd0e878458afd7877
SSDEEP 192:sxZyQUn7RHyM//K1Ml8MH7/fts3yY7KwWQXQxbCHdpjs/W6+WNBDc/Y0xkGikPZI:sxZUn7N/7/fts3y8W4/zA/bS/5ZI
TLSH
T14672FB16AA34597BCCDBD11AF9067B63D9F81162D6944E48E5FCCA0C08F6ADD2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 6398a37718b12cfc638afaed9c2470ab9a78eece9c6ffcdc1e96bef6a126584f
MD5 ff6cfa6b077e0cf85c29c29d9fe76cb6
SHA1 4e81849b22937ba167264beecf68c079eaa7f170
SHA512 4f5f8c057d7be225c3e2b02342974046949f9c1992cf8945eaaee361a84638105f28c06478ebad9e8aedd86848cb0cad2e0db60ec966f38ddc6a59f5c7bce321
SSDEEP 768:YuK2G8g+2fJWRmdnQaP8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3F8Ll/JL0oCXrorD:YuK2G8g+2fJWRmdnQaPu1jaKF8LpJ4oh
TLSH
T197E21B3F240CCB7E4F841E5CEC26AF966ED801CBA6588D9447EA894C03C67EF561649F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\42bd06e4-6a50-4592-b551-7fcf1f2e5ca1\index-dir\the-real-index
Size 72B
SHA256 8b6bb21bd18ec433fa16816bb090f23376d7bc26aecd4fbe0169ae42c30515d4
MD5 d18a26c727e6425b8cee90caf6688026
SHA1 06a202b6c0e65049f16e5966710ee1da8874436b
SHA512 7735e36900e7de1cf5ec4d74c70effc9e7cd08ef4c91fac50e775d29ce76c26c0b55a9998262af734c2b8d3c1ca8d92bcd32cdde9596b0cdd1d87eca50c4e17f
TLSH
T137A002324764414DC01706F0514211513316DC1D0309471590ACA47DCC531584E25185
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9bcacea6-6543-4fa8-92d6-91e6836de9a1\index-dir\the-real-index
Size 2KB
SHA256 e49c4c2f85176d06211875c0bd736c205f4eb33d4b7dc759adb885cd78de3fda
MD5 f6696a131744b3b8fed7f5ace7b72294
SHA1 23a398acb8550c8a8181f9092a5b0cc579d35f81
SHA512 33a5c64abd3fe30cdfbe71cc8528393c6ce20dad67c16404162c1593313439bd59b1d6a1aa45ae823daacbafe875dce3a75b00702147fc0122e3850890e3b2cf
TLSH
T1B351CA0E8C4A5F65CA9945B209FB28553B78A4CE27F80D13A5EC593578533391E5813A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a2d3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\9bcacea6-6543-4fa8-92d6-91e6836de9a1\index-dir\the-real-index~RFe58a2d3.TMP
Size 2KB
SHA256 eaf52eceadd2de1b247d7070feb8cefe980e44d592601ba915fe2f8a534b33e0
MD5 4495a7bbf36ce0dc30a8847564a5f3ae
SHA1 13f55e6f7443553b966d350b32fd31f0b876bf35
SHA512 75431bd0f394fa82b31262b3363f97149dac2ace68306d652befb69042cf12bb166a552c464825160e92148865cf2ac426babab2cf8ed2aefeed9ac3ed7d7a0e
TLSH
T1A951D55EAC430A32C9A095B359CA6468333D68958A49AF0735FCCA33ACC37AD3C56344
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e63197f7-9d8d-4c26-b1cb-274f8a218994\index-dir\the-real-index
Size 72B
SHA256 e1717501d207d1c37d353e8a3df41cdd53507e510f26d56b93f7d01f8f8bdcb5
MD5 66a1050890e70fdc536cd7f522b7fdb1
SHA1 ed3d23d210c903e7105cc4ccfee8965e5dd1e1f5
SHA512 b38da4d0ea8fbf113c5f4082f547fc2a6ff6c92a408b197c1ed2264e0b5717f21c189e210a8be26f136a82fef26f6a99895272fbd74cc8a750d4c62b67dcfce0
TLSH
T17DA002532780540ADC6372B135A245956213CB199249120661959054C951680496140C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5877db.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e63197f7-9d8d-4c26-b1cb-274f8a218994\index-dir\the-real-index~RFe5877db.TMP
Size 72B
SHA256 86b7843a36c69c7a3d465dd505b0ff0c50275fd5a18bb1873713a5c913638a31
MD5 0f59d4530512e9ac64d434d0331ae501
SHA1 d04d08700242a1bcf6c96aa1ac35476178b21f6c
SHA512 caa285e460ebd1cdd6bca56e3de6f45eba3239cf6debb02cd8e9f565e33db31930b4567bd5838eb2a622b1f29a0aa567f2aff4efddf94fed3a94f2d0c2b2d1e1
TLSH
T137A0021003E0A005C13E26F21F5302951300D91023411206C0D11458DD5CC43454568C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f8d2103b-bae9-4f03-b400-a744dd02e364\index-dir\the-real-index
Size 72B
SHA256 f7a46d69aa13cd37047f219626ea0ff7a4dd424dc8d437507c84473d784df3b8
MD5 64bbdc76343002d6273e07d331a652f6
SHA1 c7d4fbc47f3cc4db1d13c4e2f97a014aedf065df
SHA512 62eb95d451f183d2e79add51d4f5a12d4ff60b71b8810342c1f4e52c2d1bef60413ecf3cdc271a4296aeddad8ed3579f78b441b400ff458110eb5ab2f1ceaf52
TLSH
T1E0A00224D342910AC1C94FB0105A03713F6CCA62B50B538151AB12949F511895309825
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5876a2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f8d2103b-bae9-4f03-b400-a744dd02e364\index-dir\the-real-index~RFe5876a2.TMP
Size 48B
SHA256 3fdbf792c414e8493a25ae4ca6996cd6de92b03a2f414ab4e5cd24bcd37f52f3
MD5 765a9a46655333e669824a8699a3a5fa
SHA1 b4c87dc86a6201ea923a82632bd44623a9123e43
SHA512 2b99967f2dd75765ad3e6015ed9c51a38499e4e5fa54deb6f59d39b8eed1243e107b4956499e1b9e5305a9b0faaea93a8e86c3740d8da84e58d9a0b9a8c39c3c
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 49e729e80f0cd9116d5b22ae8c4bd1355bdecff7d08361bd354138ebc867e709
MD5 96eafceb7449ab7fab394ec116500dbe
SHA1 fd84014155ef8656d7f1607144c09b1cd7cea831
SHA512 ab22a3d57d925c39e6fc7e1ad749c1a844e3840141a0b3c5bb6357cd33c48a2ab0403d0d27258ffe5e174c818ff74c1c42f253a14097ad538f423a6d26a01253
TLSH
T11AF027777FF71944B9AFC3CB147254A840127C50C6A1FC9F20377193A1F1316155AC62
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 b2e31c7b9f0d2bd225b288b4add03aadc8a540f4b29c6a3dddf9573e59d754bb
MD5 2393478f4a34224d33f8dc8984c31e4b
SHA1 a1b008633bcd5b6a64d482d7feb3d1f26423191d
SHA512 aaf6900b386eddd276239577e1420d8152244b81f5cc81f0d5351655810f58b527aa7c000ecf42511810976eba51a7b4529bd1e18473f16295260ca084cc33ff
TLSH
T1E7F097772FF72800B8AFC3CA147260A80002785082A5FC9F2036619350F13151519C22
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 e2165e84dd60cc5427271ec591a5d37dd207aa37e9b4c643a4d8f69e80a143b5
MD5 1e371e35b6c56558f05d757aa10ec616
SHA1 6accd0a0a9c6d84084b47c6a913f3c9847b429e7
SHA512 d476db2ef384f0979951ee64f782e386d64e8faffd77a141c774fcf1c8500c1a7ac5ac8bc63722a4ee7073c7ebef1602d228c3861b57cd4a54ccabe719535bc2
TLSH
T131A0026187DAE045E01802B0A09511D533908B750715231D41E4405CA9503A065AB10E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589fd5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589fd5.TMP
Size 72B
SHA256 15030ab837c7ef49629b9414011404d1f0dc80032e1e75a85557120bd80f5284
MD5 bf0ad83a32324fc5f118684e28b1eb4d
SHA1 9765e58377272ceb470757aef2d41db09d32e714
SHA512 f29860b566595e42c1b836e9d21fa0036014a1965176a81dd2e7661137113226952209e640c7b1c716ba48ce0eca026d24063503ef261cd7358e54ee5eff4da9
TLSH
T158A0025087B95514C8080EB821C9534427218C9904882603449490DCAE962445EC1523
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 a7b9a3ea5666351d0a57abd81b75ccb14d2c2e09e89aceeeecd6c20ad4bfddc3
MD5 20df37f97da2bacea7ee3585fca6d2a8
SHA1 4d058051341091fd5c7153e5fd264eb6dd89c360
SHA512 358c7eaf911bf06afae2d09bbfdbb8a37549e93bcb6b97f16a98361883c9aaf8adb1a38bd7876f21482e055b97497e0fb469c7d5f28e47bd7c0dc439cde9ac9e
SSDEEP 96:KAhyKisSm9SK2AaOhuKSIpUgKN+uSO4KfaO545p5i5e5I:olVp1ZXvN545p5i5e5I
TLSH
T16CE10655703757813ABD2A8E8594B4AE52C234633418B46B7BF9006A4F67E24CDFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

51abaf25-33f1-4319-a685-95cc62bc6779.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\51abaf25-33f1-4319-a685-95cc62bc6779.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 71dc4f65d33d5c32658f68e612adc3aeae7cb2804f345880ee62d51684089ff1
MD5 61044fdfcf2f24fcbb8ecf69d632e096
SHA1 cc0a7dcdcb2a093e8a6dba6539d5be880ab5c55a
SHA512 acb057030fd6a9b0bb64ddc47c3ded2974deb940ec1f9aacc1765130e7180b04d48d3f5c25e4348d94e3957a2a4b14e55f89d56920ed25bd20d69321262883d2
SSDEEP 384:nvjccCs+Bt0S3R8N2D0/eS4RQvAwxMlpyul99EjgLVBFp8f3m:7ccQxvaPxMloulUgLVRom
TLSH
T1D7826D3268B46C7A9DB3D44AB14637175EF8416BABC42F94D9DC6B0D04DF298130EA2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 d76a28da298e16d10e441be0304c631b990670ce1a4fb8c5e0407e7812a81f74
MD5 a6b3a972e4d8e92efb7d3d0e5cd7653a
SHA1 e26cc182bdd1d6dc70344452542a3611cb78064b
SHA512 038d265f26d276404ce0e82f2a26db03abdae0cedc52fcfae4292b5f9960147cff8931850a9664f72f44e60969db273a630e6f3158fc8c8398180be7c261418a
SSDEEP 384:n2jccCs+Bt0S3R8N280/eS4RQvAwxMlpyul99EkgLVBFp8f3m:wccQxiaPxMloultgLVRom
TLSH
T13E826C3268B46C7A9DB3D44AB14637175EF8416BABC42F94D9DC6B0D04DF298130FA2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0a132771101f17f1a69cb54af6605f6efb95e7b004f5d8601520156797a8c86d
MD5 a05131365432b06b5b9d85c2ef48e20c
SHA1 32408e2e60816ca2e145fe65d5bc87fd1977e4c7
SHA512 ccbe510aab046831f38a8613d5317b9fa5631604393f13a4525b8b20af1d39da54229a74332f10e90429f3f3f5da8a925822d2d6937aa1d06bf5e4fd8e4d36a5
SSDEEP 192:bGNf6EajOQmiUyH1jRvAwx7wlb9Yful9TJEtup2qcLU6:bGNf6EtUjRvAwxMlpyul99ESgLU6
TLSH
T175120D32B8787C6B5EE3A856B08336175DE5421BEAC87B44D9EC2B0C45EF35C230B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 7542b905b82079d60cb6cc45aa2d4f9440210d089263e5daca8cb05dcd7888da
MD5 585d668a6d7265bdc1736d8cbbe9a695
SHA1 db0d01818a64b1f9734d0fe29c8f51cf0b5da1c2
SHA512 9ef7745938db27f34da58caeb16c33848a2bc67dc826ecb48c346b46f7071ee08b28472ce37e6667b8765a7e8df170c22f1437a5325c0853257656a8f4a82db8
SSDEEP 384:npiFNjccCs+Bt0S368N28TUNTUlIl80/eS4RVDfc4vAwxMlpyul99EkgLVBFp8f2:AFNccQaDwges4PxMloultgLVRom
TLSH
T1EBB21932D8A4DD3BADF38786B24676579EF401679AC86AD4D9CC6E0C00DB2DC130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 f5621c2050fab898e666406b175d3dd6702fbc30d1aa8b834a081ec2cc46d575
MD5 d67e2ee68d7166a990ce7cac4a4cc957
SHA1 8a33fde0a2e0966671c1e131d25a7b6a052e3ca7
SHA512 2bebf21b328d60752604792bb9970ae2f6ebdb6c95ea15af77b7588cbf75ff99ade1efa6d9511554e8c3d17b75a45331bcbb67281d3b09f6dd2719ae4d8d96a9
SSDEEP 192:uu7L8N2LTQTGUajLfCqmiU1kMO4QvAwx7wlb9Yful9TJEAlw2qcL1q98n:nn8N2P0/eSFRQvAwxMlpyul99ExgLIA
TLSH
T169421B32A8786C365DF39446F0473A175EF84157AAC82F54D9EC6B0D45EF2AC130B91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

e409ffeb-f9a5-46a6-88dc-aa4e339e9671.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e409ffeb-f9a5-46a6-88dc-aa4e339e9671.tmp
Size 8KB
SHA256 1058afc8b25f9127793c07d0ca77a6abb4bd42ecc3ed01ddf96edc345425c119
MD5 bc18df60fdc080bf4bb7c9113101ea6d
SHA1 ac3761657a39c9eb21c5c514f68a4b68b9e62f24
SHA512 4030afa8b074e35b0f7b3f66eb58b70fbf42bbb4834823dbd5593cd091cbe1f885ec96e083e660bb589efb4dd30ad4c2b7248199a635a006550b86b0bfb1fb2a
SSDEEP 192:VGNC6EajeQmiUyxw/1nRvAwx7wlb9Yf7q6tXbU6:VGNC6ENaw9nRvAwxMlpyTRbU6
TLSH
T1D802DA35797C7CBA8EB3AD46B4873B276FE5112FE5942B84D9E81B0D40DB34C2306526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c01b350f-55af-4e24-b006-2b5dd543cc60.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c01b350f-55af-4e24-b006-2b5dd543cc60.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

1bc6857b-badd-431a-a17d-e09dbfb683ac.tmp

Path C:\Users\Admin\AppData\Local\Temp\1bc6857b-badd-431a-a17d-e09dbfb683ac.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe

Path C:\Users\Admin\AppData\Local\Temp\3582-490\2026-04-17_cac66be90f52254c5588f6b2255af239_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
Size 4.9MB
SHA256 4013f05ada9465850fda614897b678b84ffd51bd488b90e568096199a1b80a6e
MD5 2c0ee61ef1a3e49908dd7dc61ded8127
SHA1 a46f8cb7d42189e05bb83c96dac4e5674021ac6b
SHA512 7ada9789541a90a150f70ddaa6e4daaaa32240cb94969c9e5a120064801a5e27396bae6d63f7305c6d33790ff3592c5659af1fb5f8229cd8a76c31092457549c
SSDEEP 49152:aqIjwPVlTiIdAcDHQM8WSJRY4ne86k9CBZhskt+8+W5gMsViNLKvdlZyuJMPcePj:mSDH18WSjTWWC7xnW7b+PCn0
TLSH
T1D3366C03F2FA41D8E0BAE7759B269232E976BC454B34A1DF065136191E35FE09F38722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Users\Admin\AppData\Local\Temp\3582-490\identity_helper.exe
Size 1.4MB
SHA256 4cd3e95e38df0cfb094ceedc26a43312d71f71e1361b3f8498f4996fdef2c73a
MD5 e9eff67e5bcb8b27e3109516d470fc56
SHA1 56a3e9b944260a05f25eacf55ac49af1aadf55b3
SHA512 85832d93f4354a63e39428f7cd80413aa5b094fbb933f84a2f5bcbe8e971b6fe9b38aab0013860d4fc061a769e5c29ff7fb4b488446b7a7984afddc8affa624a
SSDEEP 24576:JmjDvw6qZ04SuTjPn68TQuD3g9gZLfChjyosZ9HT1zYeHNrk9NrfZB:KDvwZ2XuTjPb33g9gZLfCdW9HTlXrk9l
TLSH
T126656B03F29900E9D059D1B8C7568536EAB2BC450B34A6EF0B90B6552F3BFE46B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\3582-490\setup.exe
Size 7.0MB
SHA256 26cb956ab6e70438d9e2d82ded0db3294148ae689d2a1e29d3d1eee7b90b87e0
MD5 79739842d0875865064b6f3880b7f04b
SHA1 f2b4f9e8c53359ea6fccd3d883ea4b57d4d1ff87
SHA512 e06d24e4ce83afbde9406fa612a4955ffca1b5b486cd7777f280280bf439b6833fd3f4ca51ed3ef0792bb4ca3d83ad659ca856905d6fdd1614f5b7c9f9f3d4e1
SSDEEP 98304:r6CZetahq+WZxcpwCsJB2++fGOOxRj2vJzRN+T6frX:uCZetaEMGIG5xVqzRdDX
TLSH
T153766C47E3E600A8E46ED970CF2A9521DA353C8E47B492EF169476E41A32FD47B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d114e1eb-b60d-46c9-bb96-99760566f214.tmp

Path C:\Users\Admin\AppData\Local\Temp\d114e1eb-b60d-46c9-bb96-99760566f214.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5196_1289043749\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0cedb3f8-6b27-411b-8630-02b6f3ec896a.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5196_1872827318\0cedb3f8-6b27-411b-8630-02b6f3ec896a.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5196_1331709617\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5196_405167523\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5196_922543763\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

directx.sys

Path C:\Windows\directx.sys
Size 54B
SHA256 92b0ff861c5e878db40272c1c8bcb96a18741590f4681d7ba628f07ec596a7b4
MD5 caebe60046472fd243097b00afbcd4b5
SHA1 6c212890aef76796310957521924b4db98b9fd2f
SHA512 ac3554112ea2aec95e5b451672d3c59203d7f5829a2763194521b74f60c6ae7ea84ec99951aec4e67e4719e03a61df335ed19b7243155caa38083e91e37793f2
TLSH
T18990020485C78629059451570ABA624DD8A1085C3E4967504651A518114180AAE81201
MD5 SHA1 SHA512 TLSH

Submit Download

svchost.com

Path C:\Windows\svchost.com
Size 40KB
SHA256 18ac91904c0ad479259e714029e22741b98fd232bba86932f89fc9921473e604
MD5 954a9af1b5a3ab2aabfa185e778c712b
SHA1 2e56bc05a093e7d4490d9a79a1b735b030b55d7b
SHA512 67752bb46e034efe24ec3f4f700b0aacfccf4956d7d974caf09423e2cab967b871b17df6bb8e5985856b770e7e6ccba3b3f84bc06d0036e7b3e067a4b72ef425
SSDEEP 768:eyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJ:JxqjQ+P04wsmJC
TLSH
T154130A51FDADC8B1D02009BCCF1A9FF4843A3D22B92516A3A7B53DBEEC79781680C549
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3232-923-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3232-924-0x0000000000830000-0x00000000008EB000-memory.dmp

Download

memory/3444-1300-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3444-1386-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3444-593-0x00000000009F0000-0x0000000000AAB000-memory.dmp

Download

memory/3444-592-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3444-1408-0x00000000009F0000-0x0000000000AAB000-memory.dmp

Download

memory/3444-1406-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3444-1342-0x00000000009F0000-0x0000000000AAB000-memory.dmp

Download

memory/3444-1341-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3788-800-0x0000000000600000-0x00000000006BB000-memory.dmp

Download

memory/3788-794-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4112-1206-0x0000000000D90000-0x0000000000E4B000-memory.dmp

Download

memory/4112-1407-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4112-1409-0x0000000000D90000-0x0000000000E4B000-memory.dmp

Download

memory/4112-1385-0x0000000000D90000-0x0000000000E4B000-memory.dmp

Download

memory/4112-1384-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4112-1331-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4112-1205-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4920-503-0x0000000000890000-0x000000000094B000-memory.dmp

Download

memory/4920-502-0x0000000000400000-0x000000000041B000-memory.dmp

Download