neshta | 083b8f1c10a3af5bda7458266c10ab1193cfde785cf625490f79a483ee26cedd

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/07/2026, 23:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
Size 5.1MB
Sample260702-3pykmsds3m
SHA256 083b8f1c10a3af5bda7458266c10ab1193cfde785cf625490f79a483ee26cedd
MD5 d52088c5f66c1cd8efdcf1158c94285f
SHA1 7c2b7ad21f772ef45d59c942c71b81be7d9acacd
SHA512 2267ed2d77f11ae72060acccaf0fb636499d24f37343978627ee1c1cf6d9d3494ed1ee48250a342834af8bfd7866fab65e9073f2f0aa6ba79c0b85509219a3fd
SSDEEP 49152:M7EY75Vhj9As9UVrdxGD9KKqZDTltew1fqeNTwanpSkU0ZfbZa2jVQMRVrJzVoLZ:s74YKRrS4hRQI6Jy4XhvF
TLSH
T164466D03F2EA41D8E0BAD6758BB68232E976BC454B34A2DF065036191E75FE49F3C712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery neshta persistence spyware stealer

Malware Config

Signatures

Family: Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta

Detect Neshta payload 50 IoCs

resource	yara_rule
behavioral1/files/0x000600000002028d-77.dat	family_neshta
behavioral1/files/0x00010000000230ad-446.dat	family_neshta
behavioral1/files/0x00070000000245f8-484.dat	family_neshta
behavioral1/memory/2008-492-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/files/0x00040000000203b2-497.dat	family_neshta
behavioral1/files/0x00010000000202fe-508.dat	family_neshta
behavioral1/files/0x000600000002029c-510.dat	family_neshta
behavioral1/files/0x0004000000020378-509.dat	family_neshta
behavioral1/files/0x00040000000203b7-507.dat	family_neshta
behavioral1/files/0x00010000000234b0-520.dat	family_neshta
behavioral1/files/0x0001000000023097-521.dat	family_neshta
behavioral1/files/0x000100000002153d-518.dat	family_neshta
behavioral1/files/0x000100000002153c-517.dat	family_neshta
behavioral1/files/0x000100000002153b-516.dat	family_neshta
behavioral1/files/0x00010000000227ab-515.dat	family_neshta
behavioral1/files/0x0001000000021596-514.dat	family_neshta
behavioral1/files/0x000200000002037c-513.dat	family_neshta
behavioral1/files/0x00080000000202a6-512.dat	family_neshta
behavioral1/files/0x00060000000202a4-511.dat	family_neshta
behavioral1/files/0x0001000000020316-506.dat	family_neshta
behavioral1/files/0x00040000000203a5-505.dat	family_neshta
behavioral1/files/0x0001000000020303-504.dat	family_neshta
behavioral1/files/0x0001000000020294-503.dat	family_neshta
behavioral1/files/0x00060000000203a3-502.dat	family_neshta
behavioral1/files/0x0006000000020281-501.dat	family_neshta
behavioral1/files/0x0006000000020285-499.dat	family_neshta
behavioral1/files/0x00070000000202ed-498.dat	family_neshta
behavioral1/files/0x0001000000023131-531.dat	family_neshta
behavioral1/files/0x000300000001e833-536.dat	family_neshta
behavioral1/files/0x000300000001e805-535.dat	family_neshta
behavioral1/files/0x000300000001e7fd-534.dat	family_neshta
behavioral1/files/0x0001000000023190-532.dat	family_neshta
behavioral1/files/0x000100000002312a-530.dat	family_neshta
behavioral1/files/0x0001000000023125-529.dat	family_neshta
behavioral1/files/0x000100000002311f-527.dat	family_neshta
behavioral1/files/0x000100000002311d-526.dat	family_neshta
behavioral1/files/0x0001000000023162-525.dat	family_neshta
behavioral1/files/0x00010000000230a8-524.dat	family_neshta
behavioral1/files/0x00010000000230a7-523.dat	family_neshta
behavioral1/files/0x0001000000023099-522.dat	family_neshta
behavioral1/memory/3584-629-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/4624-864-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/2004-897-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/2452-1214-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/3584-1377-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/2452-1410-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/3584-1419-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/2452-1449-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/2452-1453-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/3584-1452-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2452 created 2876	2452	identity_helper.exe	51

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	identity_helper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	setup.exe

Executes dropped EXE 11 IoCs

pid	Process
3040	2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
1764	identity_helper.exe
2452	identity_helper.exe
2008	svchost.com
2872	IDENTI~1.EXE
4624	setup.exe
2004	svchost.com
3336	setup.exe
2476	setup.exe
4312	setup.exe
3576	setup.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3904_282092347\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3904_2067240394\manifest.json	msedge.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe	2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\COOKIE~1.EXE	2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~1.EXE	2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\6bac8401-2aaa-444c-8857-922d527d45f5.tmp	setup.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~2.EXE	2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\Program Files\msedge_installer.log	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\identity_helper.exe	2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	identity_helper.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3904_45835823\manifest.json	msedge.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MI9C33~1.EXE	2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{5625B~1\WINDOW~1.EXE	2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	identity_helper.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3904_1143132155\protocols.json	msedge.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevation_service.exe	2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	identity_helper.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\cookie_exporter.exe	2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge_proxy.exe	2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	identity_helper.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE	2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\pwahelper.exe	2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\Program Files\msedge_installer.log	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\5bbf3b3b-d590-4d55-8eb1-2885e5773f81.tmp	setup.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe	2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\4312_13427509339028505_4312.pma	setup.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevated_tracing_service.exe	2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\INSTAL~1\setup.exe	2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge.exe	2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\notification_click_helper.exe	2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\MSEDGE~2.EXE	2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	identity_helper.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	identity_helper.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	identity_helper.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MIA062~1.EXE	2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svchost.com	2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\svchost.com	setup.exe
File opened for modification	C:\Windows\svchost.com	svchost.com
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\directx.sys	identity_helper.exe
File opened for modification	C:\Windows\svchost.com	identity_helper.exe
File opened for modification	C:\Windows\svchost.com	svchost.com
File opened for modification	C:\Windows\directx.sys	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	identity_helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.com

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2264	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134275093398370677"	msedge.exe

Modifies registry class 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	identity_helper.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{CB1442FE-5917-43F8-9CEC-FFA92CAA1A46}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	setup.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
768	msedge.exe
768	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3904	msedge.exe
3904	msedge.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 3584 wrote to memory of 3040	3584	2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe	85
PID 3040 wrote to memory of 3904	3040	2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe	86
PID 3904 wrote to memory of 1144	3904	msedge.exe	87
PID 3904 wrote to memory of 2264	3904	msedge.exe	89
PID 3904 wrote to memory of 1428	3904	msedge.exe	90
PID 3904 wrote to memory of 1428	3904	msedge.exe	90
PID 3904 wrote to memory of 1428	3904	msedge.exe	90
PID 3904 wrote to memory of 4428	3904	msedge.exe	91
PID 3904 wrote to memory of 4428	3904	msedge.exe	91
PID 3904 wrote to memory of 4424	3904	msedge.exe	92
PID 3904 wrote to memory of 1452	3904	msedge.exe	93
PID 3904 wrote to memory of 4424	3904	msedge.exe	92
PID 3904 wrote to memory of 4424	3904	msedge.exe	92
PID 3904 wrote to memory of 1452	3904	msedge.exe	93
PID 3904 wrote to memory of 1452	3904	msedge.exe	93
PID 3904 wrote to memory of 2120	3904	msedge.exe	94
PID 3904 wrote to memory of 4856	3904	msedge.exe	95
PID 3904 wrote to memory of 2792	3904	msedge.exe	96
PID 3904 wrote to memory of 4388	3904	msedge.exe	97
PID 3904 wrote to memory of 4388	3904	msedge.exe	97
PID 3904 wrote to memory of 4388	3904	msedge.exe	97
PID 3904 wrote to memory of 3568	3904	msedge.exe	98
PID 3904 wrote to memory of 3568	3904	msedge.exe	98
PID 3904 wrote to memory of 3568	3904	msedge.exe	98
PID 3904 wrote to memory of 2380	3904	msedge.exe	101
PID 3904 wrote to memory of 2380	3904	msedge.exe	101
PID 3904 wrote to memory of 2864	3904	msedge.exe	103
PID 3904 wrote to memory of 2796	3904	msedge.exe	104
PID 3904 wrote to memory of 2864	3904	msedge.exe	103
PID 3904 wrote to memory of 2796	3904	msedge.exe	104
PID 3904 wrote to memory of 4968	3904	msedge.exe	105
PID 3904 wrote to memory of 4968	3904	msedge.exe	105
PID 3904 wrote to memory of 2452	3904	msedge.exe	107
PID 2452 wrote to memory of 2008	2452	identity_helper.exe	108
PID 2008 wrote to memory of 2872	2008	svchost.com	109
PID 3904 wrote to memory of 4852	3904	msedge.exe	118
PID 3904 wrote to memory of 4852	3904	msedge.exe	118
PID 3904 wrote to memory of 4624	3904	msedge.exe	111
PID 4624 wrote to memory of 2004	4624	setup.exe	112
PID 2004 wrote to memory of 3336	2004	svchost.com	113
PID 3336 wrote to memory of 2476	3336	setup.exe	114
PID 3336 wrote to memory of 4312	3336	setup.exe	115
PID 4312 wrote to memory of 3576	4312	setup.exe	116
PID 3904 wrote to memory of 4852	3904	msedge.exe	118
PID 3904 wrote to memory of 4852	3904	msedge.exe	118
PID 3904 wrote to memory of 2996	3904	msedge.exe	119
PID 3904 wrote to memory of 2996	3904	msedge.exe	119
PID 3904 wrote to memory of 724	3904	msedge.exe	120
PID 3904 wrote to memory of 724	3904	msedge.exe	120
PID 3904 wrote to memory of 1712	3904	msedge.exe	121
PID 3904 wrote to memory of 1712	3904	msedge.exe	121
PID 3904 wrote to memory of 4016	3904	msedge.exe	130
PID 3904 wrote to memory of 4016	3904	msedge.exe	130
PID 3904 wrote to memory of 1028	3904	msedge.exe	133
PID 3904 wrote to memory of 1028	3904	msedge.exe	133
PID 3904 wrote to memory of 3604	3904	msedge.exe	134
PID 3904 wrote to memory of 3604	3904	msedge.exe	134
PID 3904 wrote to memory of 5012	3904	msedge.exe	135
PID 3904 wrote to memory of 5012	3904	msedge.exe	135
PID 3904 wrote to memory of 768	3904	msedge.exe	136
PID 3904 wrote to memory of 1068	3904	msedge.exe	137
PID 3904 wrote to memory of 1068	3904	msedge.exe	137

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2876
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\IDENTI~1.EXE" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,7398667062830666219,9375129200933848936,524288 --field-trial-handle=2336,i,11724370794910458978,6225100181052590591,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Users\Admin\AppData\Local\Temp\3582-490\IDENTI~1.EXE
    C:\Users\Admin\AppData\Local\Temp\3582-490\IDENTI~1.EXE --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,7398667062830666219,9375129200933848936,524288 --field-trial-handle=2336,i,11724370794910458978,6225100181052590591,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:8
    3⤵
    - Executes dropped EXE
    PID:2872

C:\Users\Admin\AppData\Local\Temp\2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe"
1⤵
- Checks computer location settings
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3584
- C:\Users\Admin\AppData\Local\Temp\3582-490\2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --force-first-run
    3⤵
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ffc0125c188,0x7ffc0125c194,0x7ffc0125c1a0
      4⤵
      PID:1144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,2366237424474422015,11616920955020430906,524288 --field-trial-handle=2336,i,11724370794910458978,6225100181052590591,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:3
      4⤵
      System Time Discovery
      PID:2264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,8945630812560561539,8113217621604871407,262144 --field-trial-handle=2336,i,11724370794910458978,6225100181052590591,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
      4⤵
      PID:1428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2360,i,15399739114751399715,1861362796939167786,524288 --field-trial-handle=2336,i,11724370794910458978,6225100181052590591,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:8
      4⤵
      PID:4428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,3709903995319904510,7122326683359847120,2097152 --field-trial-handle=2336,i,11724370794910458978,6225100181052590591,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
      4⤵
      PID:4424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,10482270143900415747,9497828599213866653,2097152 --field-trial-handle=2336,i,11724370794910458978,6225100181052590591,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
      4⤵
      PID:1452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4156,i,17505002424222730538,6319010656355882832,524288 --field-trial-handle=2336,i,11724370794910458978,6225100181052590591,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:8
      4⤵
      PID:2120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4164,i,17124680677754061640,10970641272805446580,524288 --field-trial-handle=2336,i,11724370794910458978,6225100181052590591,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:8
      4⤵
      PID:4856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4160,i,12115080669797602978,12769634886931912191,524288 --field-trial-handle=2336,i,11724370794910458978,6225100181052590591,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:8
      4⤵
      PID:2792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4264,i,10271033672157721540,940477117675479920,2097152 --field-trial-handle=2336,i,11724370794910458978,6225100181052590591,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:1
      4⤵
      PID:4388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4272,i,622704547172603957,10890892421475265938,2097152 --field-trial-handle=2336,i,11724370794910458978,6225100181052590591,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:2
      4⤵
      PID:3568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,15492124588140127229,638167741270461153,524288 --field-trial-handle=2336,i,11724370794910458978,6225100181052590591,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:8
      4⤵
      PID:2380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4804,i,15498897044710348316,2430639420608557259,524288 --field-trial-handle=2336,i,11724370794910458978,6225100181052590591,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:8
      4⤵
      PID:2864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4160,i,273726207478924496,7573433752004877875,524288 --field-trial-handle=2336,i,11724370794910458978,6225100181052590591,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:8
      4⤵
      PID:2796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,686738474483410789,1083899501644914596,524288 --field-trial-handle=2336,i,11724370794910458978,6225100181052590591,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:8
      4⤵
      PID:4968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,7398667062830666219,9375129200933848936,524288 --field-trial-handle=2336,i,11724370794910458978,6225100181052590591,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:1764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,7398667062830666219,9375129200933848936,524288 --field-trial-handle=2336,i,11724370794910458978,6225100181052590591,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:8
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,6340132918948275502,12124461755607226738,524288 --field-trial-handle=2336,i,11724370794910458978,6225100181052590591,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:8
      4⤵
      PID:4852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4624
    - - C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2004
      - C:\Users\Admin\AppData\Local\Temp\3582-490\setup.exe
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\setup.exe --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\setup.exe
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 --annotation=exe=C:\Users\Admin\AppData\Local\Temp\3582-490\setup.exe --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x20c,0x210,0x214,0x1e8,0x218,0x7ff7a1c204c8,0x7ff7a1c204d4,0x7ff7a1c204e0
        7⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3582-490\setup.exe" --msedge --system-level --verbose-logging --installerdata="C:\Program Files (x86)\Microsoft\Edge\Application\master_preferences" --create-shortcuts=1 --install-level=0
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\setup.exe
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 --annotation=exe=C:\Users\Admin\AppData\Local\Temp\3582-490\setup.exe --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x20c,0x210,0x214,0xcc,0x218,0x7ff7a1c204c8,0x7ff7a1c204d4,0x7ff7a1c204e0
        8⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:3576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,3078769452713229957,15510410236190141964,524288 --field-trial-handle=2336,i,11724370794910458978,6225100181052590591,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:8
      4⤵
      PID:4852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,16166725945637007115,5110971466720911851,524288 --field-trial-handle=2336,i,11724370794910458978,6225100181052590591,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:8
      4⤵
      PID:2996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,6831854757678770823,13559488023341563007,524288 --field-trial-handle=2336,i,11724370794910458978,6225100181052590591,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:8
      4⤵
      PID:724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,15246434864114506294,2605472950634728668,524288 --field-trial-handle=2336,i,11724370794910458978,6225100181052590591,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:8
      4⤵
      PID:1712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,1930732075457310744,16559507209606819320,524288 --field-trial-handle=2336,i,11724370794910458978,6225100181052590591,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:8
      4⤵
      PID:4016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,16766995304522769858,9653757119040419254,524288 --field-trial-handle=2336,i,11724370794910458978,6225100181052590591,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:8
      4⤵
      PID:1028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6864,i,17810308108062384658,17103748268608698129,524288 --field-trial-handle=2336,i,11724370794910458978,6225100181052590591,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:8
      4⤵
      PID:3604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,5066956728411929347,2945001873422283973,524288 --field-trial-handle=2336,i,11724370794910458978,6225100181052590591,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:8
      4⤵
      PID:5012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6712,i,2438524048447791075,13171588256544088306,262144 --field-trial-handle=2336,i,11724370794910458978,6225100181052590591,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,13848978913298359098,464710447548180080,524288 --field-trial-handle=2336,i,11724370794910458978,6225100181052590591,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
      4⤵
      PID:1068

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ACROBR~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE
Size 328KB
SHA256 888a1dd0033e5d758a4e731e3e55357de866e80d03b1b194375f714e1fd4351d
MD5 39c8a4c2c3984b64b701b85cb724533b
SHA1 c911f4c4070dfe9a35d9adcb7de6e6fb1482ce00
SHA512 f42ca2962fe60cff1a13dea8b81ff0647b317c785ee4f5159c38487c34d33aecba8478757047d31ab2ee893fbdcb91a21655353456ba6a018fc71b2278db4db2
SSDEEP 6144:k9x6edjvw6L6jAVnhH1Am2ZBU4M528hW8Bi7Q5VYN9:Y6exwI1oB8RZ4Q5VYH
TLSH
T1DC645B017F908EB6F5A2807F5D7A631D5A6ABA221B10E2C373703B5DCD321C59A3E356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ACROTE~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
Size 86KB
SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
MD5 3b73078a714bf61d1c19ebc3afc0e454
SHA1 9abeabd74613a2f533e2244c9ee6f967188e4e7e
SHA512 75959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4
SSDEEP 1536:JxqjQ+P04wsmJCNgh/sE/EkHd0Ci2zkQASqk+H6L2C:sr85CysEM6GC+QA8+HlC
TLSH
T17493AE13FAF18872D1621BF89C29E359C93F7A306E3056A7A3E40D5D5D747C26C2924B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ADOBEC~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE
Size 5.7MB
SHA256 1b5c715d71384f043843ea1785a6873a9f39d2daae112ccdeffcd88b10a3a403
MD5 09acdc5bbec5a47e8ae47f4a348541e2
SHA1 658f64967b2a9372c1c0bdd59c6fb2a18301d891
SHA512 3867bf98e1a0e253114a98b78b047b0d8282b5abf4aaf836f31cc0e26224e2a1b802c65df9d90dc7696a6dbcb9a8e4b900f1d1299e1b11e36f095ebaf8a2e5b8
SSDEEP 49152:DmlI9H9rY654KYroYJqkhWFUBlNwnFq3kXRsPI6BRY20YZAliDgFL2YmXZjU2P38:oiH9MfT3NwMkKhBRr0yAk6qkKvq
TLSH
T1F3567C22B902C139E15102B159ECBFE9C49D99348FB105DFBAC41F6E9A613E33931E67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ADelRCP.exe

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe
Size 175KB
SHA256 3f00404dd591c2856e6f71bd78423ed47199902e0b85f228e6c4de72c59ddffe
MD5 576410de51e63c3b5442540c8fdacbee
SHA1 8de673b679e0fee6e460cbf4f21ab728e41e0973
SHA512 f7761f3878775b30cc3d756fa122e74548dfc0a27e38fa4109e34a59a009df333d074bf14a227549ae347605f271be47984c55148685faac479aeb481f7191db
SSDEEP 3072:sr85CnHb5CZCq5DACsVlNl7HIJ1PcJ7LxnkdA53Pa4sjSTX4:k9n4N5QVrZZ7Lxkmsjj
TLSH
T119045C22BBC09075E69317723EFC79E44BF6BC319AA410ABF318495B197E350963931B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RdrCEF.exe

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe
Size 9.4MB
SHA256 31da9632f5d25806b77b617d48da52a14afc574bbe1653120f97705284ea566c
MD5 322302633e36360a24252f6291cdfc91
SHA1 238ed62353776c646957efefc0174c545c2afa3d
SHA512 5a1f7c44ce7f5036bffc18ebac39e2bf70e6f35fa252617d665b26448f4c4473adfa115467b7e2d9b7068823e448f74410cdcdfef1ac1c09021e051921787373
SSDEEP 98304:FrbT5JhEP+SuC0qyLfPeLDo/uLGM7gbl91hxkPZTA:lXnfW/JLGMcblLheTA
TLSH
T186A6AF1D7BE21036CD732176AF4FA104E739D007A215C6977ADC83981FB1AA152B6FE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcroRd32.exe

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
Size 2.4MB
SHA256 8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6
MD5 8ffc3bdf4a1903d9e28b99d1643fc9c7
SHA1 919ba8594db0ae245a8abd80f9f3698826fc6fe5
SHA512 0b94ead97374d74eaee87e7614ddd3911d2cf66d4c49abbfd06b02c03e5dd56fd00993b4947e8a4bcd9d891fa39cab18cc6b61efc7d0812e91eb3aea9cd1a427
SSDEEP 49152:oTfiUEWo6zuEz439z99akTBc4O8b8ITDnlT4NvJX:oTfiG/nzU90T
TLSH
T179C59226A2C8C0EBE5642170CC59BBF900546D78DBA2CDD7BD447E16BA307D29533A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WCCHRO~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE
Size 183KB
SHA256 ecd5e94da88c653e4c34b6ab325e0aca8824247b290336f75c410caa16381bc5
MD5 9dfcdd1ab508b26917bb2461488d8605
SHA1 4ba6342bcf4942ade05fb12db83da89dc8c56a21
SHA512 1afc1b95f160333f1ff2fa14b3f22a28ae33850699c6b5498915a8b6bec1cfc40f33cb69583240aa9206bc2ea7ab14e05e071275b836502a92aa8c529fc1b137
SSDEEP 3072:sr85Cl8pIsfHwCbf9MFdRvyAgnz8n/dfQ7PjFKq23T/h:k9KbfHwCbyFdAafCPc53T/h
TLSH
T177046B51F7C7C9B2E09206704C2AAF6541B9FE381F7105EBF3E87A1E5A713C2182566B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eula.exe

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe
Size 131KB
SHA256 5c3ef3ec7594c040146e908014791dd15201ba58b4d70032770bb661b6a0e394
MD5 5791075058b526842f4601c46abd59f5
SHA1 b2748f7542e2eebcd0353c3720d92bbffad8678f
SHA512 83e303971ed64019fde9e4ba6f6e889f8fb105088490dfa7dcf579a12baff20ef491f563d132d60c7b24a4fd3cac29bd9dc974571cd162000fae8fba4e0e54fb
SSDEEP 3072:sr85Ciq9YnyoRmLisiselSsONt3F7oQGO7M1bp:k9kgLHvld2
TLSH
T19CD37C13BBE0C872D66207785D25F36696AFF6305E74CB677B880B0E9DB46824D0C64A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FULLTR~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE
Size 254KB
SHA256 16d65f2463658a72dba205dcaa18bc3d0bab4453e726233d68bc176e69db0950
MD5 4ddc609ae13a777493f3eeda70a81d40
SHA1 8957c390f9b2c136d37190e32bccae3ae671c80a
SHA512 9d7f90d1529cab20078c2690bf7bffab5a451a41d8993781effe807e619da0e7292f991da2f0c5c131b111d028b3e6084e5648c90816e74dfb664e7f78181bc5
SSDEEP 3072:sr85CYl4dsOc6v2vTzwU+Pho86meq+FaSoB2+vSHr8qcVz5fzsC:k9r3PiY+Fa7BdvG1cT7
TLSH
T128446B307B86C53BE66301718CF8EBBF942EBA150F6851D7B3984B5E5EA05D32E31846
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOGTRA~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE
Size 386KB
SHA256 473eb551101caeaf2d18f811342e21de323c8dd19ed21011997716871defe997
MD5 8c753d6448183dea5269445738486e01
SHA1 ebbbdc0022ca7487cd6294714cd3fbcb70923af9
SHA512 4f6fddefc42455540448eac0b693a4847e21b68467486376a4186776bfe137337733d3075b7b87ed7dac532478dc9afc63883607ec8205df3f155fee64c7a9be
SSDEEP 6144:k9W3n0dK2NP0RHx8D98WTBPW8fF8oABm1nKZ0RsrI:WKhHSDeWTRW8fdebmqI
TLSH
T16A84AE11FB86C172D96602728DAAA35CC4BDB5714F314BD3E3DC6F0D9E601D2A932B86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

READER~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE
Size 92KB
SHA256 2f947e3ca624ce7373080b4a3934e21644fb070a53feeaae442b15b849c2954f
MD5 176436d406fd1aabebae353963b3ebcf
SHA1 9ffdfdb8cc832a0c6501c4c0e85b23a0f7eff57a
SHA512 a2d1a714e0c1e5463260c64048ba8fd5064cfa06d4a43d02fc04a30748102ff5ba86d20a08e611e200dc778e2b7b3ae808da48132a05a61aa09ac424a182a06a
SSDEEP 1536:JxqjQ+P04wsmJC66w8MghW4wNlu9HQIXsW/44:sr85C66w8oFlKwW//
TLSH
T1E1936C13BB928E33D4204AB91C6997B8D4BEF5306F1556E367650A4E8DBC3C22C3925F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WOW_HE~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE
Size 147KB
SHA256 750824b5f75c91a6c2eeb8c5e60ae28d7a81e323d3762c8652255bfea5cba0bb
MD5 3b35b268659965ab93b6ee42f8193395
SHA1 8faefc346e99c9b2488f2414234c9e4740b96d88
SHA512 035259a7598584ddb770db3da4e066b64dc65638501cdd8ff9f8e2646f23b76e3dfffa1fb5ed57c9bd15bb4efa3f7dd33fdc2e769e5cc195c25de0e340eb89ab
SSDEEP 3072:sr85Ce6l8TRpR+EMucyaGoS43IIJNdS3UA:k9e6l8aGo/3VL4kA
TLSH
T15EE38C57B7E134F8E1768A78CC615608EB32B8352A319BAF03A4065A5F273C05E3DF25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arh.exe

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe
Size 125KB
SHA256 fe44ca8d5050932851aa54c23133277e66db939501af58e5aeb7b67ec1dde7b5
MD5 cce8964848413b49f18a44da9cb0a79b
SHA1 0b7452100d400acebb1c1887542f322a92cbd7ae
SHA512 bf8fc270229d46a083ced30da6637f3ca510b0ce44624a9b21ec6aacac81666dffd41855053a936aa9e8ea6e745a09b820b506ec7bf1173b6f1837828a35103d
SSDEEP 1536:JxqjQ+P04wsmJCWM2D57Kykf8d/R8Tyr5J5is7MDjrXDyO4zkm8dbHVLokF8iJTp:sr85CCQw/STyr5Jks7MvrMzkm8PL3Eo
TLSH
T127C3AE22F6A1C432D4920D788919C3B18E3F7D3169A99957F7E80B5E9E607C0EA1D31F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32BITM~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE
Size 142KB
SHA256 3e9da97a7106122245e77f13f3f3cc96c055d732ab841eb848d03ac25401c1bc
MD5 92dc0a5b61c98ac6ca3c9e09711e0a5d
SHA1 f809f50cfdfbc469561bced921d0bad343a0d7b4
SHA512 d9eefb19f82e0786d9be0dbe5e339d25473fb3a09682f40c6d190d4c320cca5556abb72b5d97c6b0da4f8faefdc6d39ac9d0415fdf94ebcc90ecdf2e513c6a31
SSDEEP 1536:JxqjQ+P04wsmJC9S7UmwuBLAefbVH8x+FOI31EmkIY2d5J6WUghEuireklhKsikg:sr85Cs7HN9fN8sFOE1Z5Y2966ilU9xL
TLSH
T1F2E38D21F5C188B2E67205B54D2AA79E942CF6340F3194E3B3E84F2D9D342C39F765A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

64BITM~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE
Size 278KB
SHA256 22a585c183e27b3c732028ff193733c2f9d03700a0e95e65c556b0592c43d880
MD5 12c29dd57aa69f45ddd2e47620e0a8d9
SHA1 ba297aa3fe237ca916257bc46370b360a2db2223
SHA512 255176cd1a88dfa2af3838769cc20dc7ad9d969344801f07b9ebb372c12cee3f47f2dba3559f391deab10650875cad245d9724acfa23a42b336bfa96559a5488
SSDEEP 6144:k9P1UKupTu8ffMb0/GxsZfcJtqQ1UBZ6g:jK+HMYcytZh
TLSH
T105546C1A77D84CF5E467C23DCD528642E2B278551B34D7CB6760022AAF637E0AE3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ADOBEA~1.EXE

Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE
Size 454KB
SHA256 bb07d817b8b1b6b4c25e62b6120e51dec10118557d7b6b696ad084a5ba5bfdeb
MD5 bcd0f32f28d3c2ba8f53d1052d05252d
SHA1 c29b4591df930dabc1a4bd0fa2c0ad91500eafb2
SHA512 79f407735853f82f46870c52058ceee4d91857a89db14868ee1169abd5c0fd2e3fa1ed230ab90b5f479a9581b88998643d69b0df498defea29e73b0d487f3b10
SSDEEP 6144:k9sQsSVWSLjX2PxPNMRyfn7LzPdKblt0K+HAfh0v8axsbQuXYvr6yIll6Jf:+VWnxlMSn7nFKbltn+Ch/m6Xl6l
TLSH
T1E1A47C1077D0C036F1B329768A7FE728546DB9715F6881CFE3881A6E4E706E0AA3571B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.exe

Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe
Size 1.2MB
SHA256 b1ec065f71cc40f400e006586d370997102860504fd643b235e8ed9f5607262a
MD5 d47ed8961782d9e27f359447fa86c266
SHA1 d37d3f962c8d302b18ec468b4abe94f792f72a3b
SHA512 3e33f2cdf35024868b183449019de9278035e7966b342ba320a6c601b5629792cbb98a19850d4ca80b906c85d10e8503b0193794d1f1efa849fa33d26cff0669
SSDEEP 12288:M0ZRHkXVfeeO4LMneqyQsWSjGQCfLBlS7guN1AnQ6i12NI+03Sgouvb:M0ZRHkFfenxyQZXS7gZnQh2NIDSgouvb
TLSH
T19D45E50267F94129F1F37B71EEB993645A77BC61AE39C50E5284025E0DB4A90EE31B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaureg.exe

Path C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe
Size 555KB
SHA256 c5a99f42100834599e4995d0a178b32b772a6e774a4050a6bb00438af0a6a1f3
MD5 ce82862ca68d666d7aa47acc514c3e3d
SHA1 f458c7f43372dbcdac8257b1639e0fe51f592e28
SHA512 bca7afd6589c3215c92fdaca552ad3380f53d3db8c4b69329a1fa81528dd952a14bf012321de92ad1d20e5c1888eab3dd512b1ac80a406baccc37ee6ff4a90dc
SSDEEP 12288:PKv89GDYikjjqggz7/PtFxRNWBYrpkQJ7u:PKqjjg/PzNWyr9J7u
TLSH
T1A5C4BF2079A0C032D17311344D6AE794A63EF6700E7249E777D46FBD7E346C1EB28AA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOIN~1.EXE

Path C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE
Size 121KB
SHA256 405b8bd647fa703e233b8b609a18999abe465a8458168f1daf23197bd2ea36aa
MD5 cbd96ba6abe7564cb5980502eec0b5f6
SHA1 74e1fe1429cec3e91f55364e5cb8385a64bb0006
SHA512 a551001853f6b93dfbc6cf6a681820af31330a19d5411076ff3dbce90937b3d92173085a15f29ebf56f2ef12a4e86860ac6723ebc89c98ea31ea7a6c7e3d7cdc
SSDEEP 3072:sr85CqPo10JOSdhuPlur1Vg9uCRFRzsxeZ:k9qg1MOc4iVmRFJs0Z
TLSH
T114C37C22F9E0C032D4A219B88DACD261593E7A721B3589C337A41BDDDDB03C1AE79357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe
Size 325KB
SHA256 5e2e22ead49ce9cc11141dbeebbe5b93a530c966695d8efc2083f00e6be53423
MD5 9a8d683f9f884ddd9160a5912ca06995
SHA1 98dc8682a0c44727ee039298665f5d95b057c854
SHA512 6aecf8c5cb5796d6879f8643e20c653f58bad70820896b0019c39623604d5b3c8a4420562ab051c6685edce60aa068d9c2dbb4413a7b16c6d01a9ac10dc22c12
SSDEEP 6144:k9/jbN5zFEjGkqkAJHyEzYV/PvyeWPZw22b:GjzzFEoS2cPvyeiZwbb
TLSH
T19D649EA5B3901CF4EC63453ECC258916D6B27C2A0B70C65F13A8366A5F733911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe
Size 325KB
SHA256 e2262c798729169f697e6c30e5211cde604fd8b14769311ff4ea81abba8c2781
MD5 892cf4fc5398e07bf652c50ef2aa3b88
SHA1 c399e55756b23938057a0ecae597bd9dbe481866
SHA512 f16a9e4b1150098c5936ec6107c36d47246dafd5a43e9f4ad9a31ecab69cc789c768691fa23a1440fae7f6e93e8e62566b5c86f7ed6bb4cfe26368149ea8c167
SSDEEP 6144:k9/eWYoTOLHIsPPzAdnz0YutYPDvh2AHdwSc:GeWYoaLHF3z0z04PDvh2Cd9c
TLSH
T15A649EA5B3901CF4EC67853ECC258916D6B27C2A0B70C65F13B8366A5F333911D2DB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe
Size 505KB
SHA256 da73b6e071788372702104b9c72b6697e84e7c75e248e964996700b77c6b6f1c
MD5 452c3ce70edba3c6e358fad9fb47eb4c
SHA1 d24ea3b642f385a666159ef4c39714bec2b08636
SHA512 fe8a0b9b1386d6931dc7b646d0dd99c3d1b44bd40698b33077e7eeba877b53e5cb39ff2aa0f6919ccab62953a674577bc1b2516d9cadc0c051009b2083a08085
SSDEEP 6144:k9/4aKTRnXtTkCgwCzUg/HpjN4IBwu7QTLbpqmHdIvWTiYB2n5:GHWRdTfgwCHKy7GLbbdIvWTi4e5
TLSH
T178B43990F3E414F4F0B79A3589764511DAB67C6A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DISABL~1.EXE

Path C:\PROGRA~2\Google\Update\DISABL~1.EXE
Size 5.7MB
SHA256 3acf99624820fd862ac30780021108f0ff2df60db3df351cd17400404f279d3c
MD5 e63e539e0f0393fdea9da0d6ee80ac45
SHA1 027c8609ca7bb42b61256abb3269e1babce0141b
SHA512 f4d0458b8bfe5a66254cb85b8ba3859c9d6a937e6d14f8e15b95b7e131aaeff8a1be39f0eee3939e305901797d98dd2c5aac1837873a49f786cfcac0c9b1e6d6
SSDEEP 98304:Fog5HQ+hDHQTW6Af4fF7KkOuYO6IgF+IAMk/JexMXP8iuHG9XXYXQz7w7:Fog1P9fIlOuz6IgF+I3m2MXP6HG8QzU
TLSH
T133567C23A4E08034E5F732756D2CA73959327BA29F3145CB86946C946FB83D3293936F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IE_TO_~1.EXE

Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\BHO\IE_TO_~1.EXE
Size 557KB
SHA256 6bb357968887ad126579fb157f455e359ea036a4960a9f98f5cec1fe53931c98
MD5 2b03f86c9209825849c716434fb730bf
SHA1 1148f00cf40b0872e08f47b38bbd0c9858802aa3
SHA512 8d9b5be64e9843ec8d05af21a951e8a7501fc8fb1fc4179959ec60ea150810c0db83b7e8cedb32c44b58a0f81d09c13c4d9d8b0536711978accf47709382e71a
SSDEEP 6144:k9gGr2dzO3/lSs3AaNCaBVSa+FvChdrNSuhwK5i43FvGvu6SiZ9aD:ZGr2d29S4AaQtMhdrNSuvt+WDin2
TLSH
T1C7C49D41B3E846F9E06AC534CA438642EA7278560F34E6DF02E492792F37BE55F3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

COOKIE~1.EXE

Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\COOKIE~1.EXE
Size 161KB
SHA256 5fee43e3295682e179d6e10c568aeb640bbbcf0d6b962fd27f5b372a45fc272d
MD5 b67dba91dd68c0c9c7c78899faf33033
SHA1 4374c00761ec34d6416096524eedf439636baa94
SHA512 7065a8c6552d7dff816e288056cc2bb371bbe078798df471369382a6620c0702020102f1c39485e0c57b65279a6f0484385944f7874575d8b4351c9fa03fd8f6
SSDEEP 3072:sr85CRJjEt/g/ptvjGL/PQQpbsZAk/kJHLRdtIJsF4FxFVN:k9RJjEt/gHGrtRtIJD1N
TLSH
T134F38C57B3E430F9E2364A78C8118645EB37B8310B21AFEF07A446591E277C59E3DB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ELEVAT~1.EXE

Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\ELEVAT~1.EXE
Size 1.8MB
SHA256 47eb0dc0cd08f4faa389621c43d6407283e3c315012ef1078a6018c117f195b2
MD5 aeb70455f5c599fd2022ee73ff56bfc4
SHA1 7c3534c7cb80067ab5e6ace67e0ac0d0b8d0cc79
SHA512 5e11a5a9f28aa2e4f1d126f393232673043fffa84fa5280755ec6009e0226961343843cc0721e92d08b3fb7510fade31c118e56a993adffff3bdb4a251e67e13
SSDEEP 24576:MLaHtm12wFpUawX5LPM+bRGRpknL2NLb9Ld25PTOocJuJ/cIsY6Wfvy:yaNm12qpUTzM+bRDLwpZeToMJseC
TLSH
T1CD957B03F29941E9D06ED578C7469236E972BC890B34B6DF0290B2992E77EE45F3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\BHO\ie_to_edge_stub.exe
Size 562KB
SHA256 533d6da98378d3b1bb120b192bc5bd20bbeed6e123fe9fc6c15a4a3504932c71
MD5 dc797b816795fbca95de068b5fe4d089
SHA1 f5ed348926dd8c5b235dcac434bf3d7fba6b32fc
SHA512 e44d5b42d408ba7ad2c8c4b6f7af9f27650ab540afb68bc79f8bce4ad0b2843c67ab050b9d9568e9006756862199a90c6bf28483f889bf09257ed28af665147c
SSDEEP 6144:k9bLO76tlVr1Il5HlrJHU7kfLeeHVlK8SQBJ9LBKJwgdAmKa5rl6C:0S86nHrUA9HVlK8SQBJ9t4f15rR
TLSH
T161C48E41F3E847F8E07AC534CE528646EA7278960B61A6DF03A0527A2F376E55F3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\INSTAL~1\setup.exe
Size 7.1MB
SHA256 70c13c14a682d65fd82ec72f578e160617f8b7c164414bcce613a9b9ebd0c878
MD5 f80dd7e28ac5795b9cff0de19ea24bd3
SHA1 eb68d7d26bd4f849cefe6638bf4a3b73e3ce7a20
SHA512 af6ebd45c716d5c50395705dfa80c94c17fda338db24046051e82515b742cdc4f0503d2726278ba40a3b77e9b358f2b74704c851f28a8539dd77bee34b0e4fd4
SSDEEP 98304:V6CZetahq+WZxcpwCsJB2++fGOOxRj2vJzRN+T6frL:gCZetaEMGIG5xVqzRdDL
TLSH
T1A8766C47E3E600A8E46ED970CF2A9521DA353C8E47B492EF169476E41A32FD47B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cookie_exporter.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\cookie_exporter.exe
Size 155KB
SHA256 30d26d2f766f716cd6b21cdc15065ee4191760ef0d37de51f67dead898fb8e7c
MD5 ea213110894b1ad78e8e13686ff682c4
SHA1 49ea3bc31236ae9a32c600f7bb5cd66c49dafbdc
SHA512 77ec20210cffff94cf85ea1efb0551bc38000928b2af5f125b0597a281a3489f44d55b97dbbffba4f25e7f996a1d23d8734644f1cbd81ff3f8da42db6c9e64d9
SSDEEP 3072:sr85Co/5vndNI3Kk4+NLlzt4++++YdbeBGnRppeQBMWRywl9:k9ohvndNIaINY++++YtBnRpAFWcwl9
TLSH
T1B3F37B57B2E870F9E1324A78C8118605EB37B8711B21AFEF07A4065A1F277D19E3DB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevated_tracing_service.exe
Size 3.8MB
SHA256 c13ce5f473ff68ffdea61e8a4800008f527054f4561f2bf7853f6769d0c02dc5
MD5 b1de16babff63db612506d5dfcdd28f2
SHA1 4615a0df5812fc95be0f836b9d29a454da5bc67a
SHA512 5b3694c0a5f69d7ac74efe66a5b61f0b85cc73127a7805c0e93b8a368e0ee03eb72920d12988731cd9e43d7166e2cbe743deeeff02dc51a18301c14cfd394579
SSDEEP 49152:g6gu3VyrBme/hqvxbmhLbKqm006NPpIupEoEVu+e6NqcXToRzvUqIzYHBigdQBW:N3mMsYvRmCCENUhIUBbF
TLSH
T1A8063903F29900E8E05DD578CB568122EAB2BC854B35B2DF0750B7562E7BEE4AB3D750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevation_service.exe
Size 2.2MB
SHA256 8c53985c403e44c0c899c2d1f2a0b8afb1f17fb928ff866271de7952c9ff7c66
MD5 0db104178cbb26201b06ca53a8c18e39
SHA1 36cd76eb3cf04bd3cdf0fc3be4ec84fc52663040
SHA512 7c7871ad15851162facfb71f854f72869c833a68ed26c331d21c7900ac4fd87a5dcd9fc7ea2f494155b51d9b2f7c40a29dcd0cf06215ed7255c376106120dfe2
SSDEEP 49152:pb+632BuPkFKRrdE6oh2stBhuXjfS4LWxn9:/3q6DjBK
TLSH
T1A4B56B03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge.exe
Size 4.0MB
SHA256 18f4157c2dabb39cf84662e17c471f69f679840a70be3a4685e0c4ed8ccc207a
MD5 48d1aea6577f190f1e31b4ce9c2c3a83
SHA1 7bc44982c5a6bf7506d6f2dc4b2630caf0b263ce
SHA512 be71c8f0481b619aceb33b32a9222b0b6909fd07866f01374fc92fa08632ff01b7708166239c284bd1429a6b44f3edc351db346d877f174a369be9edb61dbbd5
SSDEEP 49152:GudQuVyBvNszCnSgVdQM3/+TjER7zExldDwUIDtaZHWRdpev2y/BaK:iijnUdYd+RaAK
TLSH
T121164903B29940D8D059C074CE5AD232EB617C8947F162EF3690B7EA2A73AD47B3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge_pwa_launcher.exe
Size 1.8MB
SHA256 2c31887681976e9691cfed32b98a9f81898beaaee9ea3f7a90fe695b84190511
MD5 650cdf4a369b08768ceaa48a2cfd7fdb
SHA1 d105394f9f806863e3d4a8611c76f291e13fe588
SHA512 4679c6a80bedb2de0d405037277b3c32cf04223e048ca90b79d3d709face5240cc8ad97d9bebd5f53617ce06b551421569a9e5434e68b4d6a5b7b8284155c1b6
SSDEEP 24576:Z5kAGu6McqpA7D9ruO3O7Q7OBLLMdus7CtW7KSdHBxmRkkkkkkklQXBysWAk:ZZGu6qG13O7Q7gLYduZrSdHBAVfk
TLSH
T142957C03F6DA80E5E05DC2B8CB768B35EA717C554F20A6DF0680BA652E77AD04B3D394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedgewebview2.exe
Size 3.4MB
SHA256 c0566225b047e50773acde8ada568ef7612809e74f2cc200504e60cf7a917c68
MD5 12403afd3d0b104f1d0f6cf034ed01f7
SHA1 08a9a2c1962f9f522c841dad14a55400a2b9e25b
SHA512 29a14f52b706b966361d9875ef3904560b41924fa959ce90985dd5e694d2ca9d0181509309bcb512563479fd5b5286cbef216e3ed5ed90cc170105f6dd13ec1c
SSDEEP 49152:DuZgk07G0auOj85q7aGScYbb6YErz7z4AkOuaRoBISCaQZCLlrrW:lo/Yhy8OnZ9
TLSH
T16CF54903A29900D8D059D074CF4A9223EBA27C8D47F566EF3690B6D52A77EE47B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_click_helper.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\notification_click_helper.exe
Size 1.6MB
SHA256 0faa9f1f62a95136d454efa51e6f8e8ff06a08d344fd26dc2216de09f6fbee4e
MD5 3b9687342c1ebc56dfa598bf9f0f8358
SHA1 794bcee37bfdcd2e8df01f9773c277629c5891b0
SHA512 addf3d1844271b0e54e8c665df1f85f521f0f14bd66bbf8fdd00eeee46315c294830d6d95e441cddbe6843b230064759e0d12e70b32690a431afdd45ee3aefbf
SSDEEP 24576:pnh1d46If99L9KA4uaiXJVB6HveuTJb9HxeQuJXlPnyF4mfHU9YawsNk:34hoNiZVB6PeuT5lxeHX04mfHIk
TLSH
T145856903F2D841E8D06DD2B8CB568122EAB27C450B34A6DF0791B65A1F7BEE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\pwahelper.exe
Size 1.4MB
SHA256 df233ebee614cd9117f7e467f16f4c2225aadbc59213a5695913a4a87f792d6a
MD5 67a7c8fa88aa1c40a5715ad4e0f8c4f0
SHA1 3d61b3c5b653549b835cbb5cae396e0e7b435b4e
SHA512 fbce329738386cc1670b58ea7c58d67cef047977d831af84e50cb811dd6cffdda5552156a0e1756d60fde2c67f3cd672bc4b6e12e2728eec70d4288e49f5efbb
SSDEEP 24576:WZGY26UEU3RyRPW+uSmS86IU8Gc7QGsVa4i6h27d3WlE:1Y2fF8FhmS86IUJWQn+6h27d/
TLSH
T152657C03F29940E8D059D1B8CB56853AEAB27C450B34A6EF0B90B7552F7BEE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSEDGE~1.EXE

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE
Size 1.5MB
SHA256 b4bdab2b2c7731923854f254ba1494c25a11331293c0ee4939afd10ba1e2b575
MD5 8042d50db625ec28b95ecd7911222ac0
SHA1 a485755c8216c717a446bce8f2a7644328c59d1c
SHA512 8a0e4a53bb43933937d588fe6bf4754245136995d2603c4e3fcb8dd66cc8714b80255a52e75a31aac09223ed7b2f8d49594c20288aa2beeb802136f0f5f9b799
SSDEEP 24576:ryoteh6euUHmEhK7eTuNdfxINakEtv9kWG2L1oaedpEukUoygGmq/SJ:rfehjvHHKTdfxINPEt99G2Bo7EukU16
TLSH
T14C657B03F2D801E8D069D1B8C7568536E9B2BC450B24AAEF0B90B6591F7BFE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
Size 1.4MB
SHA256 cd0adfcf43373e05fcf8836cc998cb17e3aaade9f8b190e28ce4331bd026f23c
MD5 aeb91dca670fae787b272163af7828ca
SHA1 a40927cc53e24d516f86042279684973fc85b77a
SHA512 f7a6aac88fcc029cd551cb4f336fb860d06b4f0094fea7a38a70aa8f25aa1f17300fda60a989ae89e558be15dc4e31dd74365e53ed44d3a3a41126e191297833
SSDEEP 24576:YmjDvw6qZ04SuTjPn68TQuD3g9gZLfChjyosZ9HT1zYeHNrk9NrfZ3:BDvwZ2XuTjPb33g9gZLfCdW9HTlXrk9T
TLSH
T113657B03F29900E9D059D1B8C7568536EAB2BC450B34A6EF0B90B7552E3BFE46B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3904_1143132155\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3904_2067240394\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3904_45835823\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

1c7fb779-fd33-408b-8354-4a453133288c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1c7fb779-fd33-408b-8354-4a453133288c.tmp
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 641fd9c984347b504866db4c156a2ecf1fd66f13484db1be5f63eae616470920
MD5 b5c383f317c3b842f0372adff1d1d429
SHA1 37433794ce1a4ed345ecdc52a8b0de589397b085
SHA512 fe216deebefa71206ed0a0be29bc3b2a640059ebc8b561610a42cf26d8eb7821173bdfce3c364824fd8a4a8104f26ccae8e20af94d8ab8b2e490833543296262
SSDEEP 96:qJ7lO3uX9jmjCa2S1/NIKVnG+FlSLFqU+kKBk:qzou9JK1/NIQJFMLwUQk
TLSH
T186C188F049DF25D3FB3C83FD54E62AD532207AFAFE075B9701E546682E92688F059022
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58acd5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58acd5.TMP
Size 3KB
SHA256 3b263bc578709cf5c9f4ec61a3b6245a25f9ae4d34538726a93c95ff1292fedc
MD5 d2481a30d89776a67ecd99d677ced2b7
SHA1 cf19ba344058a4382149fb871a5dfd4f9132042d
SHA512 2ee46f454259c9e8b21387e0570e28b8e5ad71078badd4d972ebeb63507b34dae7836fb94ef1bf52f00b3fce11bc4796628baf3b300a31efd4463ec55abf9c8e
TLSH
T174715DB04EDB0563FB608031A8E333667731B7FAFC175E9902E24B302795761F45A024
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 ba0298bb12072a2e1960b013243c8f3e2b904c384e675a43190835d8d1f1c597
MD5 b7d251ca23336f6a60f81b729f58107f
SHA1 a7edd3a2a6ce6b4baa66eb1eb562af1c377f2301
SHA512 9ea8ee0755f502a0f817f88322b154f0ea071e19fe75a1a12b95fdd96c27c69daaad453aa23e95073ff969da2b71e3aa46c6c3ebca9dad1571736c8950941f43
TLSH
T18881DFF7C3E5862DC90195F4AA147F2BCE2D0551436C3D4A88E4BF4BA3F28B1E15168E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 eec7512233714c8ad72e0d500ad7b8c6d031d604de5e6d57e58569e2fc38538d
MD5 ff81e795ede459e6382782cc9c5c70ce
SHA1 21b23ed1590548fb0f7aa66ba1031d84c44f1dfc
SHA512 e4a6bb76f0060f0556e31470be9e0e589e357d639b9d3d21cfea71300521c13a3d8457ab22a1c11d5ae15948b7a98b00759431e4e60eb336edff7f9d60e73f1a
SSDEEP 192:sxZXQUnv6RIyM/jK1Ml8ME5/fHRsBrLOzDWtbJRtdpmtHW6+WNBIe/YIY4MCIg4J:sxZbnySc5/fxsB31DOHbX/3c
TLSH
T19762D8166A24593BCCD7D618FA067B63D6F85562E6940E4496FCCA0C04E7BED2213C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 0f3243c8153bfbb38fdc46366a175fc0eeed82ac75b04285cd27b6cadd2bd934
MD5 eefc98981b730c64e63da151305f9b79
SHA1 27dc5725bc86d5f7e5ca05cfd085aed3abd0ca6e
SHA512 9691acd0d1dbcd54cdcc2c54d88b36401c10449882ad904a08d9779b0c8dca9addfa4396a56c3f842617581ef19045b70310176489ab9780d4393dfa70e43ea4
SSDEEP 192:sxZXQUnb6RIyM/jK1Ml8UQbE5/fHRs7rYDnMzDWtbJRDdp4tHW6+WNBIe/YIP7Jj:sxZbnOSqY5/fxs7U7LFAHbX/yg
TLSH
T17B72F8166A24493BCCD7D618FA057F63E6F855B295940E44AAFCCA0C05F7BDD2213C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 dd5b9642622d99effde3c0efc75dca3be86b968b0f3964d51564fe93bbcfc514
MD5 7117635410ffb69cb4a2df71abdd5a75
SHA1 4a37508bb858c341befcf52166113693cec90fe7
SHA512 738f9728199c4f99ff045e1329842f48cbaddf6df3b33151f2ffc442995fe1197661cbbcae5f0c07262704ce8188060d11ea312f1d33904192c8d0530804fdb3
SSDEEP 192:sxZXQUnb6RIyM/jK1Ml8ME5/fHRs7rLDnMzDWtbJRDdpmtHW6+WNBIe/YIY45CIH:sxZbnOSc5/fxs737LFOHbX/0W
TLSH
T1307209166A34093BCCDBD618FA057F67D6F8556296940E449AFCCA0C09E7BED2213C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 757c8a1628c994cb67590d2ff94f9b7be6a7914c7c7e603b16cf7e893795c059
MD5 3a1d58099f88d3b6598a96d092c02e97
SHA1 465ef584f229759efba57e3fdb5183dd8d6b683b
SHA512 502dce7dbf3900d9dda288789a56d737c809a85a2dc391b078aa20bb9682968f30c4b1e518be889b3f8f337b1e56eb57869559d3a7847be77112102d760f3f6f
SSDEEP 768:Q6sqxAlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVB4Ll6AR9croDL4:Q6sqxAlWvJD6Tu1jaK4LAs9HDM
TLSH
T159E21B3B694CCB7E4F840EADEC266FD76ED801CB56988D5447FA880C03CB2EA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\783ff0be-338c-40ad-8053-33ee09a8d709\index-dir\the-real-index
Size 72B
SHA256 c4302ac8c4060f80227756b1f6b218b2813605de685ba90b05f08b015d807697
MD5 227468ec01c74e1da54226e4e5e3b14f
SHA1 ccf9fd1fdfa74eac7d1aec12d4b9dc1952398731
SHA512 b6f5854545e413c3fad063dfde5c26c2ddd1adae437637f5e5aeba7a54b825c3e7f326b37888901c616debae6a787a99b4a5e3cb81b234c0f20311348d2a0fd3
TLSH
T131A0022417801205C91615B1565347515300CA106205932741911084CC92CD1EE8104D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\783ff0be-338c-40ad-8053-33ee09a8d709\index-dir\the-real-index
Size 72B
SHA256 b1a3228effca705327b275d4f3e4ee8624bf6841faa495bd06ece2b8324c5654
MD5 6f5ccf9e3eaee004133356538d5b305f
SHA1 1910c1b3bf19e1fec571f566bd96cd9591568ed4
SHA512 7cf8e3faa20b2149771ee560e76d4bff730bd03e03c6573c0eac3cd5d1e811ad410c5fdc2f6b76680f1fe8583568e1107240c07dada7811a059a5fc79466e54a
TLSH
T133A0022512D47441C02252F225DB41A1225049E34201137E81D1404DCDE0745568220D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index
Size 3KB
SHA256 62b6573d933024f51273b4d841dd9a896b7a1e2136e04f8bac268afff92f87b2
MD5 6bee7032eec79a792a871bf79345041b
SHA1 34ed3472e49cd2f7fa1dc4655360266adc216568
SHA512 a543089c16437bbe62c26fbf1b64dd4ecdf41aca7af7945613dace1466dfa105a91ba97a300f877af03baae8b95256c09d73d2a699f2ecc86a62fb93e16f7e0a
TLSH
T18151C75F4C563A97CDAC227364F404C82739B8DC6B845F2794FC9138BC877282869369
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index
Size 1KB
SHA256 2b46f30a632c3201e2381cc38b31c6a52df4af6a9070f5a271198c512cbbdee3
MD5 e94981308069a4342b4a8cf06057cd3e
SHA1 69db98a2daa427ac291e9215d030b997884cf526
SHA512 d791e9c6632ab3308d8c7e8e83c6133d34ff2a5322ea88d776405091e0c27bd6414e079d12c430a1f90b74b8905aba1ccfba79c69f990eefc7d2dc68a9f32adc
TLSH
T1B031518E8E50959FE9A449F2047261B436B0C9CC2B01E7134C3C61377D2736A2A1B1EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58316b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index~RFe58316b.TMP
Size 1KB
SHA256 98b9d2a61fb57679687b75533a5cabe3fdbb762ded346515117452363c552822
MD5 dff4ecd435fe9201fab7072bd6119e5e
SHA1 851abaa6864f17993dd57405e24837ba29f2cfa7
SHA512 20623e2f7e330886908ccdd42fd203a5e526ae500d2886ebb7a3a16de4e0273fce22008df5561ebd3ec39b52fdbd54faa6c5eb68ecda0fd2959cab6c4385df3b
TLSH
T1A331938A8A418A1FE8D410720993A4B83379C940531277C7987C6239BC753BE1E9F0C9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 c0d236966e9f7a03bd2e8a51d4ae3c788ab4524f4f91953d9156efca452362ef
MD5 e3119cc2f684c5591f9c25ee8d2795f9
SHA1 7d408737e77cd0ba97d95d0db63e6286331aa837
SHA512 977e737b7bc214ef2de1548c2beda20c71b6b6341642de99cd0a849c4ed5df11e1bffdd44b0893e6e8d2a6fe89311b38394648aa3c32f5faff026f55c18b8b0b
TLSH
T169E068B62AF70804A8ABD3DA087294960401F428C851EC4F0029928710722602825C26
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 15eb38c25261d82c8cfa3df8b960b65f6f8f18878e7095eab3d20e1a70c3f58b
MD5 f5b6dd46221af6cf63d4b5d29133dfbd
SHA1 5dc8b347f58cbb50ed2e81cb67326d2791edfcb8
SHA512 9a8d9c27a303bdf244f3213f8b601c76bdb5c1df2bd30debfb8a63a6e3cc745639443392d5142aa450c240fea97fc10095c1d186b36348acf53d8b22e26773a7
TLSH
T1EFA002BA856E1899E00453B0B44142C53310D9211715266747E401A8BE52241C162415
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5888e2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5888e2.TMP
Size 48B
SHA256 b19f6c57f3677e6ec4b2f3101a4cbd4a821274da019c333aa17695873095ede3
MD5 d47006b2dbf5348ee47fa43e9d62e85a
SHA1 27f16d326996739938a0e99442af57c3abdf1b20
SHA512 46ea4f6b4629b74a66449d8a2d933b8c1a6d1c36ed025499b212793ef2f37362789f4317b844625ff6a41d62411f81f0f6132b9d37ab0d9290a0d14d61e5bd54
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 f53f57d18f42739a38d22b788bbe34eb2eb484580d0b5ded56514f586d290319
MD5 fffcc199e48907d04c0d61e5dcd5a10d
SHA1 570dc4418b5dec2a52a1c5ab749c0224e874e1c1
SHA512 0a9f7cdece339a26aeb970448a0d1aa05cf2898cb471ebc82646608032f213c6ff467efff195b08cc884afae459248c7d88ab98b7a6fadb59be0006f7ce7219a
SSDEEP 96:KYbaKYIK+P6Ko8uutGKuIRJKKqQaCMwKZ2fRu/bpL4:ExZBdPxzKRu/bpL4
TLSH
T13BE13A42713B821238BE690CA27695374E8373B77518A56F7FB860720E66E114DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe591311.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe591311.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 81496bbcee4998f295395f304fe53e51d843d6b832593b7c96e23e8100216c36
MD5 44cd683aa50814b4995ffd4862767b2c
SHA1 ea29064f3e23e17a1b200ec663357c64ca8a4b89
SHA512 a13012e6bd883de1704d2b0d23fb77ef7a283f684b95087261a33b953e9427f214909d7d8a908d55ec32d26d1868d08978dcb3da708a1d15fdce09806957a29c
SSDEEP 384:nWtNn/s3n9SfsNkvgsYErbNhsuVRNVOK+t9FRXVObjI9G6w7Ock:Wj+9UAEHLHVOKs9bXf9Mi
TLSH
T148929D32AC290C378EE28949F54B3A2B8FF851BB97C51E84D5DC6F0C06DBAAC5316D05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 316fb56b950c7397e0d4e62674fd3efe44ffe71bbb301042f69d57adb7dbceef
MD5 a33f54810fc9157f806a00f3ffad4050
SHA1 24d44b08268b6e02c9ca9353957fc26acc8b2ce7
SHA512 450c37eaa1a2219d8591962b16a89e28f756d4b97fb8c2b676f3a892391cf568d58016fac4c626997ee6823bdd4984c5672c7e29329501a86d435aaa5755d9bb
SSDEEP 192:uuELsNk+gQbYeYE4WEkRb+obcmiU11BsB4VRNVOmSY+y6l9nFWiRUqTF0XgXc:nysNk+gsYErbNhsuVRNVOK+t9FlXc
TLSH
T100423932AC340C774EF6A545F54B36178EB850A7AAC52E94D5EC6F0C06DF6AC230BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 9497bba575937c27221f3df1f71975eee2e9c675788688202ded2e068facb1f2
MD5 f168279bd30b3517848128e16a364a78
SHA1 ff5244c1fbbaea2809c0678b27d660303e642105
SHA512 511e9e0f66a82410baf5ab089fd77669f842d9f1ede278f91fd4a5bd0f0f53f5b648885b45b3b383fcc1d29ea484824ce068a93f0fe1b19edffadecbbfa16f13
SSDEEP 384:n1iF1tNn/s3n9SYzsNs8TUNTUlIlvgsYErbNhsuZDfwZRNVOK+t9FRXVObjI9G6b:8F1j+9fVwgGEHQZHVOKs9bXf9Mi
TLSH
T149B22936DC65CE7BADE28BC5F64B3A5BDEE402A786C959C4D9C86E4C05CB5EC030AC05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4daa164e4fb2585af3f1200d5b124c382c021dd8916605af9bc0b1c7b601d150
MD5 30f430b5deaef5b0a289fe29a774aa49
SHA1 56ae2f59558bae13921f2c235c3956eb9b91d619
SHA512 521fc0812fce6f11b2cc68a500a12b97c388c91025c463bc8b713e05ccead3decaa74cde9db15b92e564e06f920a5ed1cd4c1eb22ab2accfb771bd9dd9dc7ea1
SSDEEP 192:tONc6JkRtQmiUyFyW+RNVOmSY+y9h3XReU6:tONc6Ur7W+RNVOK+GsU6
TLSH
T1C902E835AD381C7B8EF26E0AB48B27175FA8203BA9852B80D6D81F0C01D765C2347836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 a4c5509f45e1f2520d1f6f98163764582d362e640e26b5651a0cea9fd80c43df
MD5 f1de85b75647d574c2a3a1dc3f22c460
SHA1 c601c0d28072f8eb15a7e4b795ac401e81efb8f7
SHA512 da924b6a2efd7874cd00acabb3a9c5d1380e379546f923bd49fd1c9a5fd53227475b27d71720b56cd57241bf27deeab38eb8c4ca1eb5748d71603d5e8fcdf5a9
SSDEEP 384:nCtNn/s3n9SfsNk+gsYErbNhsuVRNVOK+t9FJXVObjI9G6w7Ock:Cj+9UlEHLHVOKs9PXf9Mi
TLSH
T18F929D32AC290C778EA28949F58B3A2B8FF851BB96C51E84D5DC6F0C06DF6AC5316D05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 49665d2c794af6a42d9d0c615c3b1f29234a52c5b4d475a777cfb4a57ad56ed8
MD5 da7aaa323d045aa6eb66b8ffe7c103ae
SHA1 e09761dae30d50b18418c7d5d7d3c188256ccc18
SHA512 7335ca6af2beca0cc09d17ab8789af9a4dd0851bef3e5fb2dfab2456db1e4c92d6796539f88aa19e8ab4b7840b97e295770b81ab427072eb13b5859975aa5dce
SSDEEP 192:kONt6JkRgQmiUy6yX+RNVOmSY+y6l9nF/VcUqTFU6:kONt6UgqX+RNVOK+t9FeXU6
TLSH
T1A2121A32AC385C7B5EE26945F48736178EA55137EB896F90D1DC1F0C06DFA9C234AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\OriginTrials\0.0.1.7\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

a960e17d-c0ee-4357-ba90-aef13483a9ec.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a960e17d-c0ee-4357-ba90-aef13483a9ec.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4be761d37af220a6f233ec013009b426cf1f15a4dde4e2543b4d78424aa4ff20
MD5 ed1105b64a3d95caa0cfc189e48cb2ec
SHA1 4fe848555f98f2cba1368b52a9fa1e8c0b166274
SHA512 0fe693f3bab294cc187a7385b2416a6fdd4d2a587cc05e859e227c3ce670895e799e05cbd3524ff50fb1dfa4ea59d8257298d620ef80ac8b878cb655c37d4644
TLSH
T169411658AAE91148B3B76E169BF6A86E447FBD772F06C05D00010E4F4A63A45C8A1B37
MD5 SHA1 SHA512 TLSH

Submit Download

2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe

Path C:\Users\Admin\AppData\Local\Temp\3582-490\2026-07-02_d52088c5f66c1cd8efdcf1158c94285f_cobalt-strike_elex_glassworm_icedid_neshta_njrat.exe
Size 5.1MB
SHA256 ff4f760bb826d81922f314c0912c009ee25b88330feb75c9efafb089a5cfef58
MD5 5b9ec05572b4907d1ad8457c96a1483c
SHA1 32536b8e2dde76034804478885ed102b78b035ac
SHA512 761cfaa58f140988c3692f28dc0d898b0917aeff87b0f0daad442987b9031f575338b51891be1d01ed11da217b43d6986839a1283f229c2dc91799ea9a774ce9
SSDEEP 49152:C7EY75Vhj9As9UVrdxGD9KKqZDTltew1fqeNTwanpSkU0ZfbZa2jVQMRVrJzVoLJ:m74YKRrS4hRQI6Jy4Xhv
TLSH
T179366D03F2EA41D8E0BAD6758BB68232EA76BC454B34A2DF065036151E75FE49F3C712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Users\Admin\AppData\Local\Temp\3582-490\identity_helper.exe
Size 1.4MB
SHA256 4cd3e95e38df0cfb094ceedc26a43312d71f71e1361b3f8498f4996fdef2c73a
MD5 e9eff67e5bcb8b27e3109516d470fc56
SHA1 56a3e9b944260a05f25eacf55ac49af1aadf55b3
SHA512 85832d93f4354a63e39428f7cd80413aa5b094fbb933f84a2f5bcbe8e971b6fe9b38aab0013860d4fc061a769e5c29ff7fb4b488446b7a7984afddc8affa624a
SSDEEP 24576:JmjDvw6qZ04SuTjPn68TQuD3g9gZLfChjyosZ9HT1zYeHNrk9NrfZB:KDvwZ2XuTjPb33g9gZLfCdW9HTlXrk9l
TLSH
T126656B03F29900E9D059D1B8C7568536EAB2BC450B34A6EF0B90B6552F3BFE46B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\3582-490\setup.exe
Size 7.0MB
SHA256 26cb956ab6e70438d9e2d82ded0db3294148ae689d2a1e29d3d1eee7b90b87e0
MD5 79739842d0875865064b6f3880b7f04b
SHA1 f2b4f9e8c53359ea6fccd3d883ea4b57d4d1ff87
SHA512 e06d24e4ce83afbde9406fa612a4955ffca1b5b486cd7777f280280bf439b6833fd3f4ca51ed3ef0792bb4ca3d83ad659ca856905d6fdd1614f5b7c9f9f3d4e1
SSDEEP 98304:r6CZetahq+WZxcpwCsJB2++fGOOxRj2vJzRN+T6frX:uCZetaEMGIG5xVqzRdDX
TLSH
T153766C47E3E600A8E46ED970CF2A9521DA353C8E47B492EF169476E41A32FD47B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9e3fe6cf-5f3c-40dc-8d65-6b07c946b353.tmp

Path C:\Users\Admin\AppData\Local\Temp\9e3fe6cf-5f3c-40dc-8d65-6b07c946b353.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f3c67e97-40fd-4719-a129-43b0dfa43de9.tmp

Path C:\Users\Admin\AppData\Local\Temp\f3c67e97-40fd-4719-a129-43b0dfa43de9.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

67749e26-a0fe-495d-81b5-8063273c2115.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3904_1517947945\67749e26-a0fe-495d-81b5-8063273c2115.tmp
Size 152KB
SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
MD5 d2e80cd29c43ea745d16284dc1f58ea6
SHA1 53fe0165f9f303b333be9284865c8a74f3553c0b
SHA512 375fd3e65b12f80b92a63c1cf6f0ace9fe878c1a0cb5179d869c99aad0cfde14715fd1499eab22a04f353e5f292c19d6a5aeccb43ec2ff5cd6878a5226b005ca
SSDEEP 3072:bHVqfst2F+fBXzSKmg3n0OIH1iCylcLMLgaK9enj59Ah8MuBX8Yk17CF:b1qkfBXG801idlcLMLgaOeV9A2XdBkda
TLSH
T1DBE3E13C3EDACD26C21B20F97F287587C54D8F17A10BA50BE14A84015A76B5E17E2DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3904_808899337\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.com

Path C:\Windows\svchost.com
Size 40KB
SHA256 18ac91904c0ad479259e714029e22741b98fd232bba86932f89fc9921473e604
MD5 954a9af1b5a3ab2aabfa185e778c712b
SHA1 2e56bc05a093e7d4490d9a79a1b735b030b55d7b
SHA512 67752bb46e034efe24ec3f4f700b0aacfccf4956d7d974caf09423e2cab967b871b17df6bb8e5985856b770e7e6ccba3b3f84bc06d0036e7b3e067a4b72ef425
SSDEEP 768:eyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJ:JxqjQ+P04wsmJC
TLSH
T154130A51FDADC8B1D02009BCCF1A9FF4843A3D22B92516A3A7B53DBEEC79781680C549
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2004-897-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2008-492-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2452-1410-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2452-1453-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2452-1449-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2452-1214-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3584-1419-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3584-629-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3584-1452-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3584-1377-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4624-864-0x0000000000400000-0x000000000041B000-memory.dmp

Download