b13e18b41449f379dff8d3bb9287c597becabf0775997ae9cf55c6a946e65727

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 01:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Size 20.2MB
Sample260601-bpm1csaz3v
SHA256 b13e18b41449f379dff8d3bb9287c597becabf0775997ae9cf55c6a946e65727
MD5 8cec6756a88bf2205d36f65fe11e6205
SHA1 e510cce75e7ba97dbef033fcce9907aaa042f238
SHA512 ae722b152acd3148195c40cf7554c958e6bae9a1c85756fe13cc6fbcd84e204969e08f7677c29062d3e7f616f78143a8ae07372550448e17ee59a7d3185e1a6c
SSDEEP 393216:H0MxLfYIhU8z7zhff4E3npAdO+KLcQHwnPp/QgE+JxcUGxMzAOP3a4HcK:Txj3mE7P3pS7KZQnPtT4Da0Q3a4HcK
TLSH
T19127331277D59431D1621971D6BAD3AA987BFD321732C4CBE3D909AD4A31AC2C83DF22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

bootkit discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
28	2680	msedge.exe

Checks for any installed AV software in registry 1 TTPs 5 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AhnLab\V3IS80	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\SetupFolders	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avira\Launcher	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Launcher	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\AhnLab\V3IS80	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4040_667263961\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4040_667263961\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4040_257585412\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4040_257585412\typosquatting_list.pb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2680	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134247503769053937"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{5E28DEC7-A742-47A4-8106-1ACFB5E114FF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5440	msedge.exe
5440	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Token: SeRestorePrivilege	4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 4040	4284	2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe	80
PID 4040 wrote to memory of 3300	4040	msedge.exe	81
PID 4040 wrote to memory of 6048	4040	msedge.exe	82
PID 4040 wrote to memory of 2680	4040	msedge.exe	83
PID 4040 wrote to memory of 6048	4040	msedge.exe	82
PID 4040 wrote to memory of 6048	4040	msedge.exe	82
PID 4040 wrote to memory of 4496	4040	msedge.exe	84
PID 4040 wrote to memory of 4496	4040	msedge.exe	84
PID 4040 wrote to memory of 2940	4040	msedge.exe	86
PID 4040 wrote to memory of 2940	4040	msedge.exe	86
PID 4040 wrote to memory of 2940	4040	msedge.exe	86
PID 4040 wrote to memory of 2568	4040	msedge.exe	87
PID 4040 wrote to memory of 2568	4040	msedge.exe	87
PID 4040 wrote to memory of 2568	4040	msedge.exe	87
PID 4040 wrote to memory of 3024	4040	msedge.exe	89
PID 4040 wrote to memory of 3024	4040	msedge.exe	89
PID 4040 wrote to memory of 1944	4040	msedge.exe	90
PID 4040 wrote to memory of 1944	4040	msedge.exe	90
PID 4040 wrote to memory of 3148	4040	msedge.exe	91
PID 4040 wrote to memory of 4056	4040	msedge.exe	92
PID 4040 wrote to memory of 3148	4040	msedge.exe	91
PID 4040 wrote to memory of 4056	4040	msedge.exe	92
PID 4040 wrote to memory of 4056	4040	msedge.exe	92
PID 4040 wrote to memory of 5948	4040	msedge.exe	94
PID 4040 wrote to memory of 4260	4040	msedge.exe	95
PID 4260 wrote to memory of 3624	4260	msedge.exe	96
PID 4040 wrote to memory of 4740	4040	msedge.exe	99
PID 4040 wrote to memory of 4380	4040	msedge.exe	100
PID 4040 wrote to memory of 4424	4040	msedge.exe	101
PID 4040 wrote to memory of 4916	4040	msedge.exe	102
PID 4040 wrote to memory of 4916	4040	msedge.exe	102
PID 4040 wrote to memory of 4376	4040	msedge.exe	105
PID 4040 wrote to memory of 4376	4040	msedge.exe	105
PID 4040 wrote to memory of 2468	4040	msedge.exe	106
PID 4040 wrote to memory of 2468	4040	msedge.exe	106
PID 4040 wrote to memory of 5440	4040	msedge.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-01_8cec6756a88bf2205d36f65fe11e6205_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe"
1⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://down.360safe.com/setupbeta.exe
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x368,0x7fffeabfc188,0x7fffeabfc194,0x7fffeabfc1a0
    3⤵
    PID:3300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,362964466502235573,17016619318119326777,262144 --field-trial-handle=2092,i,17120328993593566505,8840483997572294237,262144 --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:2
    3⤵
    PID:6048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,9070107903860156958,16095065361365998852,524288 --field-trial-handle=2092,i,17120328993593566505,8840483997572294237,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:11
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:2680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,17234322901518155743,4368678095740845316,524288 --field-trial-handle=2092,i,17120328993593566505,8840483997572294237,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:13
    3⤵
    PID:4496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,16855301156390665851,8593856093859756736,2097152 --field-trial-handle=2092,i,17120328993593566505,8840483997572294237,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
    3⤵
    PID:2940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,4731497048165068794,11045914744855503795,2097152 --field-trial-handle=2092,i,17120328993593566505,8840483997572294237,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
    3⤵
    PID:2568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,17070894696098277371,18368783230894426517,524288 --field-trial-handle=2092,i,17120328993593566505,8840483997572294237,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:14
    3⤵
    PID:3024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,3228125226143214471,13672183395169534323,524288 --field-trial-handle=2092,i,17120328993593566505,8840483997572294237,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
    3⤵
    PID:1944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,14539197591420624350,1317357029768177048,524288 --field-trial-handle=2092,i,17120328993593566505,8840483997572294237,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:14
    3⤵
    PID:3148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5664,i,10225582119550967019,17171717411371755052,2097152 --field-trial-handle=2092,i,17120328993593566505,8840483997572294237,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:1
    3⤵
    PID:4056
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,4736086231025134427,15750394181414964501,524288 --field-trial-handle=2092,i,17120328993593566505,8840483997572294237,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
    3⤵
    PID:3444
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,4736086231025134427,15750394181414964501,524288 --field-trial-handle=2092,i,17120328993593566505,8840483997572294237,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
    3⤵
    PID:5948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,7021036540100999691,10919511788782784906,524288 --field-trial-handle=2092,i,17120328993593566505,8840483997572294237,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:3624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,12289454976357727253,14668740031499861691,524288 --field-trial-handle=2092,i,17120328993593566505,8840483997572294237,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:14
    3⤵
    PID:4740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,2209573031647369500,9065440187032773472,524288 --field-trial-handle=2092,i,17120328993593566505,8840483997572294237,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:14
    3⤵
    PID:4380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,17051788390337167731,204757740765652262,524288 --field-trial-handle=2092,i,17120328993593566505,8840483997572294237,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:14
    3⤵
    PID:4424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,6895758431606287468,12013866763468084381,524288 --field-trial-handle=2092,i,17120328993593566505,8840483997572294237,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:14
    3⤵
    PID:4916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,4076423289386793633,16041779344380842142,524288 --field-trial-handle=2092,i,17120328993593566505,8840483997572294237,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:14
    3⤵
    PID:4376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=868,i,11338292467778095682,11665328548805719749,524288 --field-trial-handle=2092,i,17120328993593566505,8840483997572294237,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:14
    3⤵
    PID:2468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6596,i,3079759482045206771,14475131154830140157,262144 --field-trial-handle=2092,i,17120328993593566505,8840483997572294237,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5440

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 307eccec415f38e99c4365fc4afb2b9d47def6056add02756b6800d566b5ba93
MD5 e3c4c6874eb68949923f117bf9c5c4b2
SHA1 b0734eeb8f758470f45a113cd435ecb451815d5b
SHA512 7c7e0805bd92b0ca47ca8fa7f26a3d213eb323cdeeae52543c3b470bc606c6d88d33f14cd3abb09963f5ab687307bb92089fa8bc1cfa5dc6bd08b8fe7839e490
TLSH
T1B6F0F4ABC920AC3718FD0B2970A95B4AEB91136B2780895B3B3D520C8FF563B468581C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 fc7ae90e1d8e2d517fd214a7774926b5389610d867820733fbe758093e9bc93e
MD5 d91a9256d46039714bd56d7d8a085097
SHA1 582d6f551037e8948a8b13b319e3f3eefda9abce
SHA512 3a2d03cb7a35e14baf9400c9f6b676064def10733e9b2875fd92b6635cac1f8919b9f4d9eb3fdc49e21b5f3098cea41cb9949e6d368626699a962b41e67c21ee
TLSH
T14741ADF3C3E8856D8A0195F0BA187E2FCE2D0914432C3D5A85E4AF1B93E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 fdbe11e4d63067e0165a992091c4f3bb828132f5f8847314ec4a1eed98aa3982
MD5 b152baba5fe50f3d620548d2ccbd0d97
SHA1 ee4cd61ee76f21dfc22476cec05afd42ab9ae7ce
SHA512 4699df120e18a540a33a2c06a0608ef186a74c62b5ad48204b404765e4d6a0cc5b179fc380c30b50b9159c16adaa42269b41ffa930f1d21df561d3055713c042
SSDEEP 192:sxZnROyMqZjK1Ml8UQZlW/fIsRQE0CXUyynDkzodpW/W6+WNGY0dyUQeIg5aYTJ:sxZnNqPW/fIsRP0Ly8XW/bG5pLfF
TLSH
T1B672F716AA3899778CDBD309FA457B63D7F9157392501E44A9FC8B0C04E7AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 f467e24b0b9433a1f99b89d9ca35a9b7f69e35dc64ad3a43167d6147160123c4
MD5 ece6b7843af94df7c709d1ffd97bcabb
SHA1 19731a9dd23f7450dbe6b7d52dcef5b282c80833
SHA512 f12f2ec3b50f3d6da581831b6ff9f3247b51bd4cd599f37ca0b96a9ddf574252083eadeeafbd5e477a61bb585f2dd421992d1187254e693495c11fdcf0adafc0
SSDEEP 192:sxZnROyMqZjK1Ml8MlW/fIs8EnxE0CXUyynDkzodpW/W6+WNGY0deUQeIgjxJ:sxZnNtW/fIs8En60Ly8XW/bG5lLj7
TLSH
T1A362E616AA38997B8CDBD309FA457F63D3F9153392505E44A9FC8B0C04E6ADD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 581d5f90e36bc68dcfaba54bde411a71598b4a4f048babf0665d7ec29ba306f7
MD5 2adaf5f96eccbac90bf393053694ef9f
SHA1 ccf5fceaabcc4c2d74ece2ff29f0e8671e2c8d58
SHA512 e01533cb13d41a0b0440e2f5dff2700bc5b9c3e5047db0162eac39cb50ce9e58839f361c7f015198d3a0c156fa1e5500b9ddefc7594bf5f35ed7d15061b7611a
SSDEEP 768:ciWKy8Eq2A17pLuLn5dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV363pQLla:ciWKy8Eq2ADEn5dWRm5rQW7u1jaK63p1
TLSH
T156031B3B680CCB7E4F804E9CED266F9A6EE8018B6698895447FA444C03C76EF551B4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 26KB
SHA256 6bfec9bc14be072444e511344158d942871c80d78737a2e94eb5476b1cfdd7d4
MD5 2fb7d2a4b09d9815fa4d1b8a57f20632
SHA1 e9b47697a7b216374bc85435b69e9e42299e96e4
SHA512 5c4bfa397f19288e0a7c993bad138a45ccd2ae72e04c10d0f2a291509273da6b51e34783603dde6146a262179c9b3ff3cacc906a46865d1a9e9c00d7a4465e08
SSDEEP 768:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv7Ofd3o:AFBHhTofhno2mBeaOfd3o
TLSH
T12BC29E57717B12023C3E291CA6A29B770E4272A33558A57F7BB800B64E67E215DFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 483a411773402ef4f1a559368c9231ae24f5b051d3bece042159712fde907c8a
MD5 70e9068f4c4ab248c1bca9a407697a42
SHA1 df299c7a6fd7f2896bcef02436624c5e5f27940e
SHA512 f812c73985b3dd5cdee2886be5f8549a61b344523fcbe9458ca3ae8c20a0a153795f013c84f04a7f38439f1310786acbb5e7ef157abe0b02d25e395258c5cbad
SSDEEP 384:yUiF1tNnNnb9w8Nf8TUNTUlIRuyq9IjGfbwoUytO65ym5FNfjssI0GNulJZEq2H9:aF1jZbuAwgiwox065ZjssqNulJZEqGf
TLSH
T114D22A32EC68DAB7EDF75F99B70E3A03AEE411A3849859D4D9D94E4D00C719D230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 234b8d7e74e970e904d483be7a2213245411256a4e104cf9db904994a7fd06bd
MD5 c6397d5965f45bb55dca1b9a70940678
SHA1 32ed7b9f47be8357d0fc85a2f19da54de45173e4
SHA512 362e93137fd9c293cca9e35348d04e978d718be10345b19c94a17c9da4d7285fa695e23e10f759974e4ffeacfc606382d3f3518f1f9d10f1ab70d6101dede8ba
SSDEEP 384:y5liF1tNnNnb9O8Nf8TUNTUlIRuyq9IjGfbwoUytO65ym5FNfOssI0GNulJZEq2d:fF1jZb4Awgiwox065ZOssqNulJZEqGf
TLSH
T113D23B32EC68DAB7EDF75F99B30E7A03AEE411A3849859D4D9D95E0D00C719D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 4878907879f9c02f5fbdfeb7e736b185fd05ba821b80af5866273b99067e813a
MD5 f93ae38b1831e8ac9e797c1d041469bb
SHA1 3c2918cf51174af8ee9cb3801a6955462766b3ba
SHA512 03a03461161c82a89c7fb8a860acf4a788f978961c4a2fc76bb5a8ffd7b8d412cdf489155471ce23e039716c3d1f92a9f2b277d6ee5de111abdb694ba3a483bd
SSDEEP 384:n5siF9CcmyWCs38Ng8TUNTUlIxBydv7o6ajGfbwoUytO65ym5s/hkP+lFYS/jfHA:dFccps3Hwgqniox065q/hkoFYS/k
TLSH
T157B25C36EC58CAB7ECEA5F99E74E7A02EEE01163859899D4CAD91E1C00CB1DD1707C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 4997b4584105c0c9f56be83bec336ca843f8ba36c44d69e6eefcbd4bf3a53eef
MD5 0fbe714b10113d4796697cb077892eb8
SHA1 70b7ef428d7da13c93495d5ae6715624144b0e06
SHA512 daeae1f30b980c56f09620ebf1e43452cec3ad845b8af2e9580bc5e75799572ec55d447b4e44f1af779cf47e45a544b067ca5c2fbeb73bab0d3d13382223549a
SSDEEP 384:yMiF1tNnNnb9O8Nf8TUNTUlIRuyq9IjGfbwoUytO65ym5FNfOssI0GNulJZEq2H9:qF1jZb4Awgiwox065ZOssqNulJZEqGf
TLSH
T121D23B32EC68DAB7EDF75F99B30E7A03AEE411A3849859D4D9D94E4D00C719D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 40d00bf719f30597490f0aedadd9ed9b9ff5d5e75d5fa9aea105ff589bd54fec
MD5 c2512733664c98f820fe4db38f075a32
SHA1 2dd8eb73329c8ba372180c248d926a44e265f173
SHA512 b3d8d3f79b3ab1c02f5c4f0bf3a24423a7d3819771c24ece15b6642a3c62936625902ee8a08a94e13929eaa0f9af91f36c7a9593c062290a5021c6213f7d39f7
SSDEEP 384:y5liF9CcmyWCV38Nf8TUNTUlIRcyy9IjGfbwoUytO65ym5FNfOssI0GNulJZEq2I:fFccpV3AwgIwox065ZOssqNulJZEq/
TLSH
T1ACD23B32EC68CAB7E9E65F89B74E3A03EEE411A385D859D4D9D94E0D00DB19D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.28.1\typosquatting_list.pb
Size 507KB
SHA256 b34c96309ee41ff6d06dea8e605991b9b8c4d67fb4885cde883350c3b5ad674d
MD5 60b2b141019ad9ca0918db29dce42c12
SHA1 574e04a0a62023df2271a4633378f57320d33c8c
SHA512 918e6ea325b74876026691a37440441ffd3be78736595127ce77288e0bf3ab8597d52c62f94956f5567d1f985c2d38fa82f288ee330f8282f0e804ec2dc06b14
SSDEEP 3072:diBzZPXsIPv9aayls9OPzItqVCLWtQAMDvUlDetL81QFh9QGFFXaYllJzCWCD43s:ozZsIPv9akA0WuIDo/FhJFXNfFw43s
TLSH
T189B4C5B9DFC00194DB78112D20BE71D8181412A580E9DFEAFE7D855F2BC2AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 e0cbee17981c47c4ff5d6ccefcc45841c6665c8a8af382f122a7dc7e5e587def
MD5 d0af3b96407a1e9245632e323aaa7443
SHA1 d905e4eb14f8130d684aa20d4a87cdae63e9b6aa
SHA512 053aa6d190cc21d1f5871fdc5b8bf13a68077e86955e3e6b3ef1096b872aa325ab2f0ed2d46c4b8ef62e6960eff1c75ae050564ffe18ed441c6bae0edbe84918
TLSH
T1884130E15C7C2AC1D4BE0E6F648B38FC81EC8725F4A035396854EE94197921D608587F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 fcdabcc8a467aa9de2b45ee7e81bb24e2e2ebaab9fdc6cf85acd30d977c0df9f
MD5 a992b2ca230bdb8e3cdb9bc03f4e14be
SHA1 8587f4f8de9654d701677a5f96416092ae491d27
SHA512 bd400f4ca74fb016b4dc4f18a6279df9bf078c5a4cac5d31e62a56ef535bd5c206ada8dc2bd66ead628a318b30615414b59d70fe5c89d9ac6e0102bb9c0919b6
TLSH
T1004141E11C7C2AC1E0BE1A6F608B38FC91ECC726F4A034796854DED91A7961D658487F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4040_257585412\manifest.json
Size 118B
SHA256 1b90c1e9cbd34978ee21dae135f1ea9f51599d19014f9219cd47d730fd914f55
MD5 7cbc275e0cbde8ca623fc70c406367c3
SHA1 2b9fecd47ed8ad353bfdd958e0f5197f20dc370c
SHA512 6966dbc5899213f4b9d0e241409cd834f67ef2df35a5b437cb194893c6c6f7fcd8a33c0f22344a20682a84dabaa2d0f95b9d739e5d0a840a91fc2806e09e0b06
TLSH
T198B092B00C0BA47B22809720ECA166C283FC0218E8466B1A08C036481F9817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4040_667263961\data.txt
Size 146KB
SHA256 bcf1a17189b6ae7371429804a2df2ba36c798b142dbc4f7f06a7332834405408
MD5 7a8bee21ef52bf7f962551770605aace
SHA1 8f205bb793c0269f210f7e8cbfdf594f089c7d0f
SHA512 8a2706485d3408e09242d59cd72ad367eeeccc948d7c3a74b3c7f8c7a2b22ad44b94ba426a341da606dbc53c4d8c519df921e879347018ca809d1ee63d13e7fe
SSDEEP 3072:cPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYErqsZo+Eog7TAMy3nBt5rd:wX1aI5aZoKzMJ07NrpoTZ8My3nld
TLSH
T1A3E3F1218EC01FDDDFA8261C50BF0B1DA7D0878D443A6686EB63BD4EBF9B50856274C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4040_667263961\manifest.json
Size 52B
SHA256 5a708ec5a10762801001cca55997ce9813d9c312a009b3c4fa197426c752fe90
MD5 4fb639ca1de22fb121f954c14c414349
SHA1 a6a124dbf473075e287557494d3a0375e8d42c2a
SHA512 c5cf5e55ce9ce6c86d0d346afffee7ecabee609ff6c4303c3fcf21f3d46fe2f770636ecfac5fe165b777bc93ecc90e55992254fadefe8b8f2e5b17a2bab6a643
TLSH
T1C2900260442491171AC10E506670F8C59391661955850D1D04451548029546CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4284-0-0x00000000047E0000-0x00000000047E1000-memory.dmp

Download

memory/5948-170-0x0000020225F90000-0x0000020226F90000-memory.dmp

Download