45588793a990354cfa0459c87a219917f96f23b38ced19226985c20354a629fe

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/07/2026, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i.exe
Size 27.6MB
Sample260709-ee283scv2p
SHA256 45588793a990354cfa0459c87a219917f96f23b38ced19226985c20354a629fe
MD5 1face20ee5d14b488b9487d1c443ef8a
SHA1 4865470c8161312cb094d8be940993ca6482e1a1
SHA512 1da78479554c402cbc991ee889f5002e261cc969ae9d24fa96e74ab8b55f0ca0549a9fa828fe466cf1b07326e4dff4748c1f89be604297f9d1fa20a0a93507a6
SSDEEP 393216:WqNLVJTfxpLx/AS1MVc1ZwCrHXA3mDDDy/WTAwn:rfPlASqgrHR
TLSH
T14157516DE2E08CEBD43E76B526B81B12E69013BF93C19C673EFD915D4F362004426B69
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery

Malware Config

Signatures

Detects executables calling ClearMyTracksByProcess 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024497-49.dat	INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess
behavioral1/files/0x0007000000024440-105.dat	INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess

Detects executables containing URLs to raw contents of a Github gist 2 IoCs

resource	yara_rule
behavioral1/files/0x000700000002443b-43.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral1/files/0x0007000000024497-49.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	yncomb2sin3.exe

Deletes itself 1 IoCs

pid	Process
2948	yncomb2sin3.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BurgerWorker.exe	yncomb2sin3.exe

Executes dropped EXE 2 IoCs

pid	Process
2948	yncomb2sin3.exe
4588	BurgerWorker.exe

Loads dropped DLL 7 IoCs

pid	Process
2488	2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i.exe
2488	2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i.exe
2948	yncomb2sin3.exe
2948	yncomb2sin3.exe
4588	BurgerWorker.exe
4588	BurgerWorker.exe
4588	BurgerWorker.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1772_787400058\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1772_864066538\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1772_864066538\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1772_331757301\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1772_331757301\nav_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2116	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280427626850076"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{EC51B98E-29DB-441A-A821-D9DA6B861DC4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2948	yncomb2sin3.exe
4588	BurgerWorker.exe
4344	msedge.exe
4344	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2488	2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i.exe
Token: SeDebugPrivilege	2948	yncomb2sin3.exe
Token: SeDebugPrivilege	4588	BurgerWorker.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
2948	yncomb2sin3.exe
2948	yncomb2sin3.exe
2948	yncomb2sin3.exe
2948	yncomb2sin3.exe
1772	msedge.exe
1772	msedge.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2948	yncomb2sin3.exe
2948	yncomb2sin3.exe
2948	yncomb2sin3.exe
2948	yncomb2sin3.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 2948	2488	2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i.exe	85
PID 2948 wrote to memory of 4588	2948	yncomb2sin3.exe	86
PID 2948 wrote to memory of 1772	2948	yncomb2sin3.exe	87
PID 1772 wrote to memory of 2912	1772	msedge.exe	88
PID 1772 wrote to memory of 2116	1772	msedge.exe	89
PID 1772 wrote to memory of 1920	1772	msedge.exe	90
PID 1772 wrote to memory of 1920	1772	msedge.exe	90
PID 1772 wrote to memory of 1920	1772	msedge.exe	90
PID 1772 wrote to memory of 4156	1772	msedge.exe	91
PID 1772 wrote to memory of 4156	1772	msedge.exe	91
PID 1772 wrote to memory of 1648	1772	msedge.exe	93
PID 1772 wrote to memory of 1648	1772	msedge.exe	93
PID 1772 wrote to memory of 888	1772	msedge.exe	92
PID 1772 wrote to memory of 1648	1772	msedge.exe	93
PID 1772 wrote to memory of 888	1772	msedge.exe	92
PID 1772 wrote to memory of 888	1772	msedge.exe	92
PID 1772 wrote to memory of 3736	1772	msedge.exe	94
PID 1772 wrote to memory of 3736	1772	msedge.exe	94
PID 1772 wrote to memory of 3736	1772	msedge.exe	94
PID 1772 wrote to memory of 4448	1772	msedge.exe	95
PID 1772 wrote to memory of 4448	1772	msedge.exe	95
PID 1772 wrote to memory of 4448	1772	msedge.exe	95
PID 1772 wrote to memory of 5096	1772	msedge.exe	99
PID 1772 wrote to memory of 5096	1772	msedge.exe	99
PID 1772 wrote to memory of 2580	1772	msedge.exe	100
PID 1772 wrote to memory of 2580	1772	msedge.exe	100
PID 1772 wrote to memory of 3060	1772	msedge.exe	102
PID 1772 wrote to memory of 3060	1772	msedge.exe	102
PID 1772 wrote to memory of 4760	1772	msedge.exe	103
PID 1772 wrote to memory of 4760	1772	msedge.exe	103
PID 1772 wrote to memory of 3044	1772	msedge.exe	106
PID 1772 wrote to memory of 3616	1772	msedge.exe	108
PID 1772 wrote to memory of 3616	1772	msedge.exe	108
PID 1772 wrote to memory of 3148	1772	msedge.exe	109
PID 1772 wrote to memory of 3148	1772	msedge.exe	109
PID 1772 wrote to memory of 4572	1772	msedge.exe	110
PID 1772 wrote to memory of 4572	1772	msedge.exe	110
PID 1772 wrote to memory of 4832	1772	msedge.exe	111
PID 1772 wrote to memory of 4832	1772	msedge.exe	111
PID 1772 wrote to memory of 5060	1772	msedge.exe	112
PID 1772 wrote to memory of 5060	1772	msedge.exe	112
PID 1772 wrote to memory of 4232	1772	msedge.exe	119
PID 1772 wrote to memory of 1020	1772	msedge.exe	120
PID 1772 wrote to memory of 2888	1772	msedge.exe	121
PID 1772 wrote to memory of 3352	1772	msedge.exe	122
PID 1772 wrote to memory of 3352	1772	msedge.exe	122
PID 1772 wrote to memory of 4464	1772	msedge.exe	125
PID 1772 wrote to memory of 4464	1772	msedge.exe	125
PID 1772 wrote to memory of 1384	1772	msedge.exe	126
PID 1772 wrote to memory of 1384	1772	msedge.exe	126
PID 1772 wrote to memory of 4344	1772	msedge.exe	127
PID 1772 wrote to memory of 4800	1772	msedge.exe	128
PID 1772 wrote to memory of 4800	1772	msedge.exe	128

C:\Users\Admin\AppData\Local\Temp\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Users\Admin\AppData\Local\Temp\yncomb2sin3.exe
  "C:\Users\Admin\AppData\Local\Temp\yncomb2sin3.exe" --delete-old "C:\Users\Admin\AppData\Local\Temp\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i.exe"
  2⤵
  - Checks computer location settings
  - Deletes itself
  - Drops startup file
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2948
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BurgerWorker.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BurgerWorker.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Fortnite-Burger/DeadByDaylight-Unlocker-v2/releases/latest
    3⤵
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffb231ec188,0x7ffb231ec194,0x7ffb231ec1a0
      4⤵
      PID:2912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,6957418693492445115,5162645571985908981,524288 --field-trial-handle=2056,i,15108191316271286046,10886809948578455693,262144 --variations-seed-version --mojo-platform-channel-handle=2104 /prefetch:3
      4⤵
      System Time Discovery
      PID:2116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1720,i,12721991986347278968,263582916524563446,262144 --field-trial-handle=2056,i,15108191316271286046,10886809948578455693,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:2
      4⤵
      PID:1920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,17423706102746603299,14629635135481238365,524288 --field-trial-handle=2056,i,15108191316271286046,10886809948578455693,262144 --variations-seed-version --mojo-platform-channel-handle=3172 /prefetch:8
      4⤵
      PID:4156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,10496593627162656858,9810664779924211948,2097152 --field-trial-handle=2056,i,15108191316271286046,10886809948578455693,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
      4⤵
      PID:888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,9729696798694401989,14855188039151367303,2097152 --field-trial-handle=2056,i,15108191316271286046,10886809948578455693,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
      4⤵
      PID:1648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,18289536732259775603,4747821041912035797,2097152 --field-trial-handle=2056,i,15108191316271286046,10886809948578455693,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
      4⤵
      PID:3736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4308,i,11375666323703429830,13488773149454186512,2097152 --field-trial-handle=2056,i,15108191316271286046,10886809948578455693,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:2
      4⤵
      PID:4448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3668,i,2610357126071770663,4123364008772231685,524288 --field-trial-handle=2056,i,15108191316271286046,10886809948578455693,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:8
      4⤵
      PID:5096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,12454563100514590204,7725687601395445420,524288 --field-trial-handle=2056,i,15108191316271286046,10886809948578455693,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:8
      4⤵
      PID:2580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,11192084671475915935,14739907658292517464,524288 --field-trial-handle=2056,i,15108191316271286046,10886809948578455693,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:8
      4⤵
      PID:3060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,11706046506413853919,5141380505099926140,524288 --field-trial-handle=2056,i,15108191316271286046,10886809948578455693,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:8
      4⤵
      PID:4760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,8830351512486012127,18053730750703929284,524288 --field-trial-handle=2056,i,15108191316271286046,10886809948578455693,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
      4⤵
      PID:4752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,8830351512486012127,18053730750703929284,524288 --field-trial-handle=2056,i,15108191316271286046,10886809948578455693,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
      4⤵
      PID:3044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,1269338234077758721,16420211451724276299,524288 --field-trial-handle=2056,i,15108191316271286046,10886809948578455693,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:8
      4⤵
      PID:3616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,17801192391433430397,3136605869838280288,524288 --field-trial-handle=2056,i,15108191316271286046,10886809948578455693,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:8
      4⤵
      PID:3148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,6320054288229872996,8822468850444744790,524288 --field-trial-handle=2056,i,15108191316271286046,10886809948578455693,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:8
      4⤵
      PID:4572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,17557409325079400483,10888354658457991367,524288 --field-trial-handle=2056,i,15108191316271286046,10886809948578455693,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
      4⤵
      PID:4832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,8250451920825242006,13392367741936628647,524288 --field-trial-handle=2056,i,15108191316271286046,10886809948578455693,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:8
      4⤵
      PID:5060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,10700492012223654276,18154784799132037663,524288 --field-trial-handle=2056,i,15108191316271286046,10886809948578455693,262144 --variations-seed-version --mojo-platform-channel-handle=700 /prefetch:8
      4⤵
      PID:4232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6676,i,18287624262804618232,3773014820805490817,524288 --field-trial-handle=2056,i,15108191316271286046,10886809948578455693,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:8
      4⤵
      PID:1020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4380,i,11470995798958709626,85491677435086276,524288 --field-trial-handle=2056,i,15108191316271286046,10886809948578455693,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
      4⤵
      PID:2888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,15358524033332796714,9694783167479792518,524288 --field-trial-handle=2056,i,15108191316271286046,10886809948578455693,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:8
      4⤵
      PID:3352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3692,i,15053513609077068574,11816214589539063529,524288 --field-trial-handle=2056,i,15108191316271286046,10886809948578455693,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:8
      4⤵
      PID:4464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=888,i,3941215294917019558,12052046272574350480,524288 --field-trial-handle=2056,i,15108191316271286046,10886809948578455693,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
      4⤵
      PID:1384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6636,i,10445226650170059209,12102550507329038389,262144 --field-trial-handle=2056,i,15108191316271286046,10886809948578455693,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,249163368193248092,5741133546576680093,524288 --field-trial-handle=2056,i,15108191316271286046,10886809948578455693,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:8
      4⤵
      PID:4800

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1772_331757301\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1772_787400058\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1772_864066538\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

SkinsPerks.json

Path C:\Users\Admin\AppData\Local\FortniteBurger\Configs\Profiles\SkinsPerks.json
Size 1.1MB
SHA256 2e0f764ac03ec2efc2fd754d2637807be93090fbf0a75648cfce8d9dfb3781dc
MD5 3bb71efec0597883fbdc929edbd805f1
SHA1 0861e66bd47401293d4d93705e908eb2658692e2
SHA512 d84af44479c80682ac552d8b12641aafd2a59f9a0736622bb3569d1fe00d633b0fada78ba4c4108a1396563c16ef6cace838b702ae6f0223360a7f09654c2ec3
SSDEEP 3072:RBaT82QtULqR1POFBa7B4/mzFOjf6k0giX8WaeCxxlI+zY1bXUi1vTS61uI1KQ8+:7+zY1bXUi1vTS61uI1Kz+
TLSH
T165354F3EA1F68C6A043E577906693F06F900176FA289780777FE965D8F31381291BB27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 e77142ac9ce99f734e5ace922c1c3bb866e8c515ceaa0a7e12d0e84d4a3d320b
MD5 ba5f591f1f0bd6234b5f1c7413288ed4
SHA1 0f78539ed364820208a9f3de3bee9808b3c7ce7b
SHA512 ea516a787dbd5fb5a2c6b005ef32cd8231c41a65d21e593e22751097fa1fdade874c796b671798b2912b5c660f39ca0ef667949d324271f94a37540c9d9f18ef
SSDEEP 96:asONsz97nx+ugMLETIhIWWtXCu4s+kzeD0Woi:1MQIlMthIWECu4TkzdS
TLSH
T196B16C160340CBF7D319C930E3E12664B8F1801D49571F3382A74ABD9E2ABEABA5553E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59070b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59070b.TMP
Size 3KB
SHA256 f7de2622dbc41520fc61ea216f7bc19db35169d1ca96b386f43d99e5cbeba517
MD5 901e7ea07af7e459ae1fd0644829c6a9
SHA1 83484b11b524dfe42eb77681191ebfd4c7cd1a18
SHA512 17a695d1d25732a76d1e328a6e63e7b1223a2a43542ea6777460002d2f4293a7e23a9ae08ff843002de6173948fbaf2338b45388c209367ccd1bbe843b340e49
TLSH
T1AA61715B0216EBB7D329C930D3F12505BCB281160A2B1F7352818A7DDF31BE7B16620C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 222cc094145a7bd2dd7d1c1393af9d60702d0e941992585f905520dd14339aca
MD5 bcfd9ba67cba77815150ddb5a2411102
SHA1 fe19aff5fbd04d40ac2fd2248d1884aff1bc5d92
SHA512 51736dfaf347602c8454a6534148eac3648bd9e6096ca54c3a50bc9cf30e685bc12863094a05453b59cae887b67c0b7b4234753a227ac414d363ce0d39306ff2
TLSH
T1B351ACF387E5856D8A0156F0BB18AE1BCE2D0510831C3D6A88E4BE4BD7E3871E14265F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5819929349f9d1d109b76879e93e7aa8c6b7412d5df787f8e1f97a9211abcf8c
MD5 502e0d7fcbce86e13d6739a3e1e29624
SHA1 c8e13f215d0566bcd0116dabb9174dfb9388d2ff
SHA512 41eb5342ab323d988b116d886934d7be58b17ca3e93914588e0982c6db356be4d99054b93dea14e5cd23be7ade0201c8832b11fbabfc25e14723ba1eff728f41
SSDEEP 192:sxZrRFyM/jK1Ml8MiY/fmshcOCrIdp9uEHW6+WNYdr/Y4pmMxIg4J:sxZrHqY/fmshN3tHb2/nc
TLSH
T1E452E916BA345977CCDBD20DF9457B93D6F50462E2911E489AFCCA0C01E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 1d2af6526036a114f613b658e6b8c8005ff0502a9ab608fdd3cc9dc8a7f7f581
MD5 aa66a20b5cbb76526ef9da306ce97dc5
SHA1 cc91146a996f73f2fe45357478659c06035b356e
SHA512 64c291e730cd6a48e73369a07b32a9ccc300f325052f5f64ddca3b3f38a262ccbec95c2130ee332c1f5158f4644ef686a9b44dccf8585fa90b43da23f9857698
SSDEEP 768:OQ8iJlG7pLuL7xNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVdEhALl6opdXrow:OQ8iJlmE7xNWvx76ru1jaEEhALocdEeT
TLSH
T169F2FA3B6C0CCB7E4F844E9CEC2A6E9A6DE801CF5A98895447FA841C03C66EE15175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 51a63f1efb61d3a367f341bbfb90dc5388921260462ffe43663b2677bb979cbd
MD5 6f431de41509ba3eaa441ed6ae9604e3
SHA1 ad470af73b6e0dcce4d034696d622ebf8946c623
SHA512 012c28a1d5d0d0c9ab02cb135b3e67208f01ff6459e1ef4d1aba030135e5920d6e634c04c12c4d5a4374d9d837aba5c45a6bd24cc9493565d7e152602b5895ab
SSDEEP 96:KwfyKoK6gKTiaK4YKRGHlyLf1vz3W7gugnFK40gjFl:8n/b+lyLf1vzG7gPnv0gjv
TLSH
T11991330231FB42262C3D651C92A587274B817FA33418E42B7BB854B51F2BE254CFD9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8e111634-b3a2-48c5-98aa-3e6dedd52386.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\8e111634-b3a2-48c5-98aa-3e6dedd52386.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 d92b0adda3e1e79577d19598ac0eb39c745dfc4f91efd84127b1a20ff415f498
MD5 a8f5ea2beba51640c57b16ce913d15fd
SHA1 cefa9f5fc3c3b1bebe6678e1c33f542de708695a
SHA512 5b8d7fed0e8280c3c2937689da2141d69cac6e922ede4cf6d058a204357a549e0ca818538e16b6ac3375f55918fc02fba33e9854659a7472b7e67888f21b3fbc
SSDEEP 384:n9tNn/s3n9SfsNL9dBU5zukqbFUiC+ZOObjI9G6w7fL:9j+9UKIubC+Z29Mj
TLSH
T141928D3178399D7689D39159F08B3A9B9FF810BB9BC52F88D5E89B0C05C729C1B07916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 5331eb326d48353edc607b7e4e379f8f62c551d9269ea2bc0f4c6c85ae8a333e
MD5 b6a04dcb19c2cf41e29fbfb059dbe72e
SHA1 bc33ab6c7365c06d8b4f20d67ac8db1737cd9a21
SHA512 d24751e9f713e72c0834ea31994d91cc3f07c4140e1342606bb5ccdec38884563e3866cadda8a93c88f90dc5b5528e0141e3ad7a21bd62012eaca5cc25a0fdb5
SSDEEP 384:nBiF1tNn/s3n9SgzsNV8TUNTUlIlQdBUKzu0DfQdqbFUi7+ZOObjI9G6w7fL:oF1j+9L4wgCTgcb7+Z29Mj
TLSH
T1D9D2C5F198D78A36E99E4787B33E2E469EBCC0A375885984F7C45E4CCC821BFC606805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2642f2f5701127d4a040f4a2d5000944bdb5083ee8892e4938b65e48ca328fd8
MD5 69c1430095ea671039a1c99beea57106
SHA1 b01f7db5b3e23e86e7cc27e034681687c4b82195
SHA512 c5d43b8ec704497758163a106be21b975ab79b1fa2c4c93c60030c41882ef89dca44d3676aec4ed5958047b4f4a43cdb5fcb9f618ac1fdd0d547b1f2a4867ea2
SSDEEP 96:ZqONkxQsjpfmUTmDK5ih/cIPURHl8h4otop5e5D9BhPwivh50xy0SFYK4AxYYCbb:gONZ6kDfQmiUyIjZ903bb9XQi+sCCU6
TLSH
T18702F93568786CBB8EA3AE49F48777275FA4107BEAC42F84DAE81B1C00D725C1702836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 33c99ddcf6a92cdc650aedbf12243cabb763019c412af1d863374817ea019b51
MD5 1a362a3d6fc79fd62b3bf9210d4e92bd
SHA1 03c5696ee0c656cf38bbf63a7c04c4c2b3fcecaf
SHA512 4d389a8e2cff0a24f82f15c7379373b744e9a70db22fd417ece1d1c50077ff7814d831c74ae12898870f82fbebf838bff9706ad96b413a1a9a1d0770eb6bd254
SSDEEP 384:nItNn/s3n9SfsNLQdBU5zukqbFUiC+ZOObjI9G6w7fL:Ij+9UfIubC+Z29Mj
TLSH
T1DF929D3178299D7689D3A159F08B3A9B9FF810BB9BC51F88D5E89F0C05C729C1B07916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 aeffcff4128a023f1653174a771dd4837942dadde40baced0dd9dc884c5a370e
MD5 083fcf461935fcb8b152fb15f3ab5863
SHA1 df6f91772bcb526f79102e0abe3691f327c5d5a1
SHA512 612e1a653eb3fad2dfcef25ec8442d65e7e5d818d635286aa6bc3ac55361279efcfc7445a23a92598f37dfbfcc6d1edd4f01ba85ac92b735d3aa1ec29bfa2df0
SSDEEP 192:wONO6kPQmiUyWjm903bb9zUNEj+cR+bqQtU6:wONO6sNm9qbFUiP+ZU6
TLSH
T1001217717879AC379ED3A515F08737A75FA820B7DE856F85E6E44B0C05C728C2B0B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2c9ecdd94c63e27c0ba0ba42c307aab153e14754f78163f2579cc191bff2b6f5
MD5 53f6d087799184424e02df871f234391
SHA1 38c1323a7e59396905eb78c488ff59765725ab65
SHA512 779e0c7963e3e5315b7aabd90abf314699ff3432364d381a3d5eb6236407ebbd2a8efcd1db8f26e1c6dd7051fab5dedeb5d9cdf089cec842d019038d7609001b
TLSH
T1F7410E58AAF91158B3B77E165FF6B86E447AB9332E06D55D00010E4E0A63B00D871B77
MD5 SHA1 SHA512 TLSH

Submit Download

AutoUpdater.NET.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\AutoUpdater.NET.dll
Size 248KB
SHA256 91f8f0038d5f6597e32229353116dbcbbfa8b1991a22321af4ca56c86de69e09
MD5 272e9904ebf29859c9dcf549320661f5
SHA1 7ab1613570303aaa1bc60603a7f74aca68d496c3
SHA512 26e4d98467df60f5956968b8d11cc081921ba1292235b98167f83b6173e43520f57b05f3153c2f8a33e6ebc530dbc5300162b14fc8001af9d762da7e70936098
SSDEEP 6144:Hl+tHMXIsl0eG2kBiJysWUL06jTwzrm7:UHMXIsl0eG2kBizC6jTcr
TLSH
T18F443A02FFE5C325C1663AF5983581A107357E96A900CA6A34B8764E4F33267CF6276F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BCMakeCert.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\BCMakeCert.dll
Size 600KB
SHA256 93ba40952f4be52de0c6afb0d66e8c306489edc682ad4515fb12cac8bee2630e
MD5 404918448fcc85fc40193430d0fc2580
SHA1 f01ca0b39a3bfa2e9c47ed2ecc7a033630c1f002
SHA512 ccd9a3014d8b6b424ef70efe0350fb75a19e8d60e2db277436434144b5f37bf0fbfb2b31f7f49ccb4b7b8d1185140fcd2f480a094392aeaa1582eb2560027878
SSDEEP 12288:lx97VGJc0V51wlTLau+3pgEkH5HBiG7LRK5H8:lx9L9au+3pgEkH5HBiG7gx8
TLSH
T16ED47D08A7F41326E19ED7B5C0705865DAF0F029B26BEB5F1CC276FA5953B128C41B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BasicFormatsForCore.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\BasicFormatsForCore.dll
Size 145KB
SHA256 f60f48e8a320b6fa2760d2f8fc5dcd5dff2fb526f967545dd2d620d09b9c5675
MD5 b5e3cb1cac8689c46633460289791f61
SHA1 c4f904be98a59a3a9154c8a3c36b62d66ee530c0
SHA512 45501bd2a58cf4e9753c464fc9adc8c92d43a963caf957de3515392ad68649ce908224f513159864686576b71a32846b2b1155c2a48ae189a72f643cd86eb67f
SSDEEP 3072:zM4HNvwUesP/3d9r9PM9NjeilcwUP0s8nrV+YHOyjO6njKr8iS:wIwU19ziWd+/O6nji8iS
TLSH
T1E2E36C4833E85600E1FFAF7A95B085114B75B516A973E79E0DC490AE2DB3781CE64F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetZip.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\DotNetZip.dll
Size 234KB
SHA256 309f84521fff1f48c3509f7110f1789347a272501992c79af3ef6e6d3b3de7d2
MD5 efadf1780d4ea45d067f7163c4c7a80e
SHA1 a460c0033a007ff979a66153e501023c5d9ab514
SHA512 b785689b51d4be82390fc3b582ba394044dee7f154d703ad4dd688d1c67acdde59d8c51326cdb47341e4576e24ae4fc19b19e43b285dde25b1716887f332249f
SSDEEP 6144:h5S2GuvzjoNuTdR/jZiWAzLIUjIcOF8sszR2:22PvPsAT/b+cF8Tzg
TLSH
T104345B0423ED4F6AF6EE67B9D0B59192C3B2B46134BEDB4E5D4460FE18173A0D9107A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FiddlerCore.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\FiddlerCore.dll
Size 774KB
SHA256 e7e7572d2c3028ffaa0b58c765a526525b2bdb5cc9696045e34f36b01ba847fb
MD5 06b6694b72df565e06e919ca4570b20b
SHA1 e4d2f2b7b6292cb2e8047f8eada5ac7e12e44743
SHA512 ad8c7d0a1e34067c84c539c56aa134ed9cc1963ad15647f48ed2a1be7b779798388371cf330457d3b1668b4c93d57a99db135cef88131b97530376b80e44a683
SSDEEP 12288:qwgpE6bmSuMZVnSuBbYSdTHaEpFdlYRdEI9VO:q/Y0f0OHaClYRHq
TLSH
T10EF4061027F85A11F2FBAB789DB225008BB9B896ED25CB5F0940C09D0D72BA5DD52F37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FontAwesome.WPF.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\FontAwesome.WPF.dll
Size 204KB
SHA256 63d50dbe094bbce5d7bf8af08c0d919cfa5e057ca05ae7b27704a8477c8b348f
MD5 2ace85429eee9e8320c82d878e5562b4
SHA1 77ed8b89210930d1de2495ba363519b696d0b6e2
SHA512 7ce3467d1469acdb544f4f42864d94c5ae0ada252c5f096329e16d4b571fc1800bd572e52cfe902ee5d4b91d59a1a4182b07f40b7a4dfe54e338ca46684af989
SSDEEP 6144:Z8P7/P97ilHDqO01ktQOzB4YjDnX08RYA3fP5S:Z8PpilHD+kQA4uk8RYA3f
TLSH
T1F924C077B640664AC6474631FC0BB74221FAE1629D1F4B16FFC4A98E3296B504E22F37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hardcodet.NotifyIcon.Wpf.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\Hardcodet.NotifyIcon.Wpf.dll
Size 101KB
SHA256 2059222c4ae5d0291fce13bd296adcc448d79b6fae27746aedf347608ed3090c
MD5 2cfde828cdbfbb545be5aa61fe1e62a1
SHA1 d376bde7322118787f6f08131ab34a17eb711789
SHA512 2a1215dde4bfc4626cc4fe9696b6465a0893a8787ce4ff41ca0c08908bb8aa52a992a156c3320deb0fefb225acb4c3132286d8c04a0caed93282b86adc011cda
SSDEEP 3072:5oy+75OQW4pg9xXsGQTckaX4kGsdO5UInM34:5+75ON4pg9xX7kzsTInM
TLSH
T1B1A3CF8523FC405AC1FEA73478B532148771FD837A61CF2A498262B849B77D91AD07EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Web.WebView2.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\Microsoft.Web.WebView2.Core.dll
Size 461KB
SHA256 c6feb73ec1cb9271f2004d2586fe1833621a0fcd3d04a6fc1dcf08557d634ac0
MD5 0901d7f2f8b621433f3eaee6a63cb8d1
SHA1 12bf14a2ad26f568f78e4a9304234a6a990757ba
SHA512 e428770009468c5e48e843031758d2ec2af3ceb3c0614248b17e90105415d7ddbf9783e5cfa77738731cf3aceaca788afa7405944dea0af3247ac5f0a4638b40
SSDEEP 12288:5MYWHzByTrx3YSi+iKmRFNge1+imQ9pRFZNIEJdIElxPrEIgcvLcglxMwCepM1SW:5HWTBFI
TLSH
T10DA44F2223FE425AF9F37F75557412204AF6FCD6B93AE75E0998A16D0C32B4089A1333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Web.WebView2.WinForms.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\Microsoft.Web.WebView2.WinForms.dll
Size 37KB
SHA256 983a69e9ae41e7cc91962704a903a2c2dd49d464f243a7d101d0b715f723f1c6
MD5 f696f28047246a651f90900475186ea1
SHA1 f87c665f212a7b8b3393060ca84d2e576e6bced6
SHA512 45588b89a24f3db2b5a56bb841480b991efeef9f4778b10e4b8a9a58c651cc12be81c8bf1ceda5badc0b76a03046bdf4b457a00130e1ac0e93cf724e71e756d2
SSDEEP 768:qN9HFciVtBZDgcEST3p4Jjrjh2jJ+SG2auxvxJKia5/Zi/ZGQKqu6bX6uTHRt8cF:29fVtBZDgcEST3p4JjrjaJ+SG2auVxJD
TLSH
T1A2034B0083ACC617EAEB5EB8A5B485620B7ABE837D60D39D5C88F1E90DB37E05514377
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Web.WebView2.Wpf.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\Microsoft.Web.WebView2.Wpf.dll
Size 43KB
SHA256 29f6e7dac224fc0ba91e45145e209fdb18c985781280d778aeedbd1ea885f137
MD5 c83529d6c90dc9644779207d81bb6539
SHA1 771dcb61c27bdbee4b749ba6d831107756412f77
SHA512 e42703c1d36c21542ccdef6071d2699b50fabec327b8c4db87e3b830fcb40e7d3f8ae3e951cfeca53c2297089b417e199be07105f199335fd3880ea816424cad
SSDEEP 768:k+Q2cVseHJ4Wgs0WZ8lBDP/ryEH0yBy4JjrD1h2jBhsUaGzkI7hKKa5/Bi/IGCvS:NmseHzxZ8lBDP/ryEH0yBy4JjrD1aBhl
TLSH
T11213289543EC492ADBEF6B74A07496610A3AFE437D71E78C1AC4B0E50EB77D025403AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\Newtonsoft.Json.dll
Size 695KB
SHA256 22c649f75fce5be7c7ccda8880473b634ef69ecf33f5d1ab8ad892caf47d5a07
MD5 adf3e3eecde20b7c9661e9c47106a14a
SHA1 f3130f7fd4b414b5aec04eb87ed800eb84dd2154
SHA512 6a644bfd4544950ed2d39190393b716c8314f551488380ec8bd35b5062aa143342dfd145e92e3b6b81e80285cac108d201b6bbd160cb768dc002c49f4c603c0b
SSDEEP 12288:mFIM0KteTMN4Or4D3OdmZg5WHEaEDIGBBjgrIQtD+tVqDMW:6zMTMNNd+g5Wk78GBBjgrIQtDF
TLSH
T165E45A2123E99B2BE0AF2775B032491647FAF542F6B7D78F5604D8AA1C43F558D82323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Steamworks.NET.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\Steamworks.NET.dll
Size 365KB
SHA256 a61778cbce992f1d3ab48577d8c6c1c43778727b6127cdfa8b97eccc353ce6ab
MD5 9cad80b5a72727b344d5fb46734af788
SHA1 e83420c8b362944f9fe861c808172ecd7057030b
SHA512 0e34d5f47398b52005cd41dba28d58a2e8128ecf3add668757c246946cbeb5d4d8f72d67c5a36f6d13ef8b2e30248b035630a444c3a6bf040978d338d489e927
SSDEEP 6144:38Z9REsOmCo0SIepPqX2lbRbRU/TB9nflJxSpbnk25pRk/9:38Z9q8tqzvflJir3RI
TLSH
T13484F82D7320793BC029433664B75E0BE6A0E4C2231B6E6F764249395DB77C49E3B2D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.CodeDom.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\System.CodeDom.dll
Size 183KB
SHA256 7b2ba5ede11ae8ac2d1d67df100fbd23e45558f8b29cf7ca767bb41d4f88281c
MD5 34f6f6df02024f033c0d9cecc9e19f5e
SHA1 0f72071a867d7ca61edac4cc70752ef608fe9926
SHA512 5a7e9d6c023cbc4de9360686149a001e0b6192580939224af193e952d1e62e3e0ba3577cded85f012d90678bd681245bfd25ff258d596c235a5c3afdb65b21b8
SSDEEP 3072:MFxaB6x7l+gq0WENWTv23phTvrgnlLXb8EVY3H+1Rzbbh1pTiWk:U33hEoURwE23yRznV2J
TLSH
T108043A713398823BCEDE5235E0A9405042F5E56A7382DB9F5C8965FA5E23F60ED20E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ComponentModel.Composition.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\System.ComponentModel.Composition.dll
Size 262KB
SHA256 7e65f888588c79f69acb593d9b39990c33fd58377fc48300a0a93fc8dbaa159f
MD5 e0bab5ab0d5835d00acc36eda1a4e3a2
SHA1 3b4dc4b656922e71deea58d7e4f51aa68e6680be
SHA512 e3faeae0346a62ac0f38ee42119213b39c4d1fa2372ef9d02514e95050eac70a67a92edf0019392642e3a08964e2a838edb8629e4346f5b68d40839173416733
SSDEEP 3072:DJDT6qZG065+dP14WQuE3pu4Y62v903SoIrEjFSikDdLRKVgWjqrgKQqktCsa6AP:1Bd4WQoCGmSoIlRA4itCsa6A5oM7
TLSH
T15944291237FD1366EAEF1B7CB67488118AB5F962B50AE74C2C4994FD0963F908521B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Management.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\System.Management.dll
Size 288KB
SHA256 75b833e2aea56dafa94f0d2728925db405f9dd758ff19d43924a7a268202c94d
MD5 bf74ada4da38cdb4a8decbdae77249b7
SHA1 bb419a9fb2b61bd2ab00f10266635cc47a9e0ffc
SHA512 f0f2ac9ccc3d217446fed2c2e78a5e503455cc7ae60f060a05a1e160109cdd542e75f6b044a7d5a356cf8fedd4ad15cf92e1df1361373fae7f55b6f923fbde3a
SSDEEP 6144:Xd4rRwgJrgMmbwipdLEoWkFPMcBIABGBcz7:XqrRwWiUA/
TLSH
T10D543B3037F8C196C5BE8EB9A03011948FB1B3AF244EDB9D5562BCED28B1781D65712B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Telerik.NetworkConnections.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\Telerik.NetworkConnections.dll
Size 67KB
SHA256 14a8afece485815896fc9f098d66b0457d1be374b10366b48c706dfdbb275094
MD5 f442ae4be024c27c59ef737902303a86
SHA1 c8191737225509a110a6fc42f9e0291fd6576c8d
SHA512 8b3f768ba5232db3d5355e8d4a719597f16f06a438f39365e494df4b30125f433dacaab5aee2bfbfde910c4b86ee0ca6903c703863b28c5d4a39c62103522af6
SSDEEP 1536:qpjTrvVmDDDy/WTAAPfi82uA+J+GwclhzF8FgaUK:qpX7VmDDDy/WTAa68JBJ+GwclhzF8FZX
TLSH
T158636D4133AC532BE7FF4F35A0B6A21004B6FB55BA23FBAE145450AD5C627C126217EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\WebView2Loader.dll
Size 156KB
SHA256 8d6fe8b14529e1d6a02a7f2d5991ee72ace0d7e2f1901c71cfd7df310600f4c1
MD5 e8894bce4a8fbd1a059023b3b3c7849e
SHA1 5ce5ea789dcfd04effc7ec2aa40d704bb42cb31b
SHA512 405b90498c9b71c0514129d72ff1bac345bca7188cd268ee3e6aa4ec6529f94ab91ea271a6e8e6d7e9343359e6e7e9fd8b275fb761abd14d100a36201e0538ab
SSDEEP 3072:rKLKQDEW3JHtcGNd/SzCzkYLSq9hX4qSd/8SALTcYrEtnWldxVKW6:mTBt9Nd/9d18qSyEtmG
TLSH
T1D0F36C57B3E5007BE1678274C9934A56E77378510B60AFDF03A482691F237E4AE3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoUpdater.NET.resources.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\ar\AutoUpdater.NET.resources.dll
Size 10KB
SHA256 cf2b1c3cf607e7884fe8dbeb87b74ce6c42f4536fb92131704df5abfad96ecd5
MD5 15f7af014cf402523f0f00a2897158b6
SHA1 e02d2ccc3c1e278f822ca303389f7c41aff137c6
SHA512 334e0644c29be7f6f0c829a31ce730fc93a0d2a1efeb8c35dac539e0a539196910d664ef082a167d22b7e590527fc8ea2429e99f3fecfbd0e1d02198e46c16ba
SSDEEP 192:fXhMivXhRlfM2j+jurjyjYtVfXwiRx7ofVsXiFRqe7eKMw:iivXhRlfM2j+jurjyjY3fXwiRKfVsXSr
TLSH
T1E72245122BFD5275E5B39A7694B66194C63BBE72DD21EA1E0496010DCCB2317CBB0F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoUpdater.NET.resources.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\cs\AutoUpdater.NET.resources.dll
Size 9KB
SHA256 18b1eb31160b5d3ef6e8424204dcfdd2df69a48ff191f08810fd01a95bf3f9a0
MD5 2a6292b0c3bcb81a18ae8b44a275ee96
SHA1 a9fbfc94728909d9909e48b60dcdd432460dea4e
SHA512 39d213392cc638e9fa786352e12d0353fc96112ad2d19bf031382206cc028d5f7d4cae29b4ed402b2ccc651717c9f1b3c808ea556c095814fc6bd331048147b1
SSDEEP 192:D8hP7iLXYgXY8M2jbju/jTjjt2M9l87+EXRgXCeWKMw:AjiLXhX/M2jbju/jTjj4MQqEXaXCeWY
TLSH
T1171251122BFD0239F8B35A766A764190873ABB71EE35C66F0495010D4CB2356CEB1F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoUpdater.NET.resources.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\da\AutoUpdater.NET.resources.dll
Size 8KB
SHA256 3d1dac05f707e995b1fa1a1a1c89dff452036fbf20273e6334afbb4b00033aa6
MD5 cfdbc013e1ac53ef5da16582054a4c58
SHA1 6831e26ff9ae73c210ded5379be3946918d33f01
SHA512 626243ad4a05c584771773d5d8f494a65d4d7cbf5571beba293a09b909d9d5ca82167605d7ac03486cd48bc2ad93776734d095f7ed064d7b1f1c07fc3ea4bda7
SSDEEP 192:KbXqigKM2jbjKhjOjD9M7OWLvoRGKMwi:figKM2jbjKhjOj5MqW/Yi
TLSH
T196F143136BF8433AE4F36BBA693A5255863AFA76D930C62F4484011D5DB37118BB1F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoUpdater.NET.resources.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\de\AutoUpdater.NET.resources.dll
Size 8KB
SHA256 408bbd72954cdd8e830ebd0787f9214405b5acc15d06c3336d7015cdaebb71ef
MD5 cb9f885e34df02e77aeb8d304019a372
SHA1 f9a787fa782799e4a84679ed18fc51041b451954
SHA512 f2f3ad6687a61f43d8c974934b5cb6e8eb74b0325c1bcee1eab5329e9a945955e3490ae71961525509c11089e0077061ce74fe274e35551bd2a9f41161769a3e
SSDEEP 192:f7hjFiYEM2j6j+ijAjD3fUMASZWLv6aIBKMw:PiYEM2j6j+ijAjzUM7WbcY
TLSH
T1320275122FF9423AF5F36B7E197641559A3AFA75AA31C61E0580111E5DB33228F60F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoUpdater.NET.resources.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\es\AutoUpdater.NET.resources.dll
Size 8KB
SHA256 d689092b0e4d74e1a55d0c6fe43abf65580a3fbf52b3b8368285d8639b1d2cb7
MD5 7d94426173a5be2b84fb5ecbbea4ac86
SHA1 75d186b84c28ef5ebb088a9a7cfaecde7bdcfeaf
SHA512 708a94708f126034829e5ea2f2a1508420cce0660a071f10ed3c59800ae2736ac9e871061a593dbd98aa46843d309666097e6275d5be45bf05a3bbaead04e3da
SSDEEP 192:5GhlB/igwM2jGj+Ej9jLXdMLfMmihMn5sWLvaGNL1CBeKMw:Yv/igwM2jGj+Ej9jLIfMrUGWGKweY
TLSH
T1F00277126BEC0239F4F36B766E7645529636FA75BD34C62E4080020E5C72746CE72F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoUpdater.NET.resources.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\fr\AutoUpdater.NET.resources.dll
Size 8KB
SHA256 2fb47dfb09f9f24585b8bfa71c773d855b93744dbbd8c376ed8c3edfd3f36064
MD5 399becfbbd24131839c31eb023556e47
SHA1 6e2c7c11e256f534e87c1868624774a2bebcb05c
SHA512 e1425ead6674ad37e59908675e4fff42bb3b184fffa00f3cea19e4faf63e26c7901958e55d449ba3713689870ea1a4ee0370f6b99fb6a3483f5ac1fa74397e1f
SSDEEP 192:mW0UiHxoM2jcjiZj8j7qUCzL4MpCWLvxOLVVKMw:ZiHiM2jcjiZj8j7qp4M8WWbY
TLSH
T17F0263072BFC126AF5F36B766A7692518637FA79ED31D72E0481020D58723118AB2F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoUpdater.NET.resources.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\it\AutoUpdater.NET.resources.dll
Size 9KB
SHA256 eea2adbc5356ce05b2d9fc418e99ef0711e9c7fcdeff3d0c6d85c3758a49a75f
MD5 0c987d6182959a0a9bffa4ab31f08c0e
SHA1 e39e497924d8a0eadd514d47ce47cd1685f49b75
SHA512 814b171319f85c39dab237c146f1d811f303fd982ca919cb7e418dfa49dcda145a0f75d436409b4b0cc82381c019558a400932227faa54adf97652c5e09bc5e1
SSDEEP 192:KVh35iwkM2jUjf8j6jlV7MDAP6X/aBXjLxu7KMw:GpiwkM2jUjf8j6jlV7MTX/aBXvE7Y
TLSH
T17C1264222BFD0239F0F32B7A59765181977BB975FD20DA2E0485010D59B27429AB1F37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoUpdater.NET.resources.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\ja-JP\AutoUpdater.NET.resources.dll
Size 8KB
SHA256 3370fbd2efb274b714a02ce32b3b642c65fa19a896f3ed7ac0a9502fe7d6beeb
MD5 39605f921bb6d87527972f23f17f4e7b
SHA1 eaeb878e8a12d36cdffb0b605ea3dc8181d4dc82
SHA512 5afaf1f311c54465b0db0e2c8bebbd7ae01239d9bc9f30fdf2ebbd68d2026c51d1e970ea6d0d6966f8410f909375b3879f8fac1bd8cc45f6e9ca1a36717ad390
SSDEEP 192:05qdi/h2uM2jijfjjOjdLMaXoWLvIKMw:oyiJhM2jijfjjOjdLMXWkY
TLSH
T1D802632D67E8026AE8F32A72287A52818536FE75ED31D72F045C811D6D7231ECA71F72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoUpdater.NET.resources.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\ko\AutoUpdater.NET.resources.dll
Size 8KB
SHA256 c5b8a8e7da93b9b50d3a1ef3330035b41c514ef6f361188be97ac273716919ac
MD5 9e6898093a38b2c4da2d9cdf2dfd13ed
SHA1 936c0e03e4d8d4f5b5023694d47e10c2ed393096
SHA512 84f9be33177151418cd7f125f46508538f2d8b36bcc2c739ad6e5b528a24c25f0907d4821c3060e316ff048bf8a7d0965744c56e951170c091f72f1f018224ce
SSDEEP 192:T2C1gid3M2jDjDijDjdM5IirBWLvl1dKMw:rgid3M2jDjDijDjdMlrBWZ1dY
TLSH
T1E80284921FEE0279E4F36E7A2E75A241867AF974FE32C61E4844050D9D723128E71F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoUpdater.NET.resources.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\lv\AutoUpdater.NET.resources.dll
Size 8KB
SHA256 b00f6217cb875a0daedfea0e00d3311d2608d03c0bee74d524d177de06f4da74
MD5 224ffe50479ba20cd6a210d5ee920d7d
SHA1 322147636cf8b1c1c2d38f3fc94e8632a6c9a7e9
SHA512 b93a7335970f293f071680e56e8710f904c12f129d07144a3c83c7baba3186573514c751ca11150b65342f20b274beee7ba37ab63654fcde0a502d13d1c92547
SSDEEP 192:Kh0UmiwRrM2jtjYUjCjqdWMpHsejeWLvtrEKMw:O07iwRrM2jtjYUjCjbM5sejeWBrEY
TLSH
T1A10252222BFD06B9F5F36AB61A76915145BAFB74BD21C62F0485020E8D723158EB1F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoUpdater.NET.resources.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\nl\AutoUpdater.NET.resources.dll
Size 8KB
SHA256 6e9df964edd743039174e6dffc068219e59f40cafd33902581e74a08dc72edf2
MD5 77b89a64c5aeb6f43ee89f87c46f97a9
SHA1 6b479246676ee768010a76baf36cc3197afa6aa3
SHA512 70dbf04206eccaa9c8998a7b260439e77554fd93b401540f17f2d3fd8bfcb3704c632d4c50162c2c944a5a025d47254012333d11197027bc15ba836fd213c448
SSDEEP 192:55OqiyaM2jGjEnjSj1iu+bOFMgNscL7WWLvPMRKMw:viyaM2jGjEnjSjEu+bOFM9cL7WWDMRY
TLSH
T185F185172BF9423EF5F35A7A58768292863BFA75DE31C62E4444021D5CB23128EB1F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoUpdater.NET.resources.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\pl\AutoUpdater.NET.resources.dll
Size 8KB
SHA256 a041069ac5e288d2704ab670efa6753dd268bf86b3223003e4e094754a337936
MD5 7f9bc29eef52c3b890c5b1e245626952
SHA1 c1592857e7e023a22eed970f66c4a84d80c58ec9
SHA512 c9a75131406961f20fd9807fe9168fd36c2859f9879f31841d3a10f02bdd9614fa41060135fb01b1f799f2263c7a647b60a0e83ab2d215458e36d67f9da3ed3b
SSDEEP 192:EJU/WiYeM2jDjUwjej9ul8LMfK6D5WLvN2JKMw:siYeM2jDjUwjej9ul8LMy6D5WRoY
TLSH
T1320285116BF8023AF8F36A7A6A765255893AFA75EC30C65F4441110E9C723528EB2F37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoUpdater.NET.resources.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\pt-BR\AutoUpdater.NET.resources.dll
Size 8KB
SHA256 ae81bc07e5daf06825a77b68d5ec12cc5998348c2a73bdbf6d5e6fcef9d64f70
MD5 0eabb0e7abd788c23b3c142fa7fe51fd
SHA1 6d6495bdf98765cb0e1a9d61f636d34a3feea9f0
SHA512 a8eeae1b31f7e14db61146e535e4ab1d16bdb66eb2ab9f9d5ec9df4bf16c8a65b1ee31b2351022f4c464149f0b4af633d099b0f39639dc38d19e7fd591c4c820
SSDEEP 192:p+3IilOM2jnjmzjtjmMweWLvF2i82OKMw:k4ilOM2jnjmzjtjmMTWxYNY
TLSH
T1A10263222FF90239F8B32B76593A9612963AFA35ED24D65F4581060E5D723428E71F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoUpdater.NET.resources.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\pt\AutoUpdater.NET.resources.dll
Size 8KB
SHA256 1212b1aa059492afa336dcc83a96a409f9d00198f7fc20e340f60619cf3f63b0
MD5 67817d2edd9b0675d4f7485700abb972
SHA1 ffe63a1bd069b684bf38541410ea5e551cc19c20
SHA512 7e2b80cf825f1e989a0fee378a9f7bff048a950df4c7b12a154ace1c0b363e699f944f14cc646843b1dfface148986ebedf07193d88b0f759f5be0bbffdac0fb
SSDEEP 192:1NhIxipGXM2jUjlvjJj/JMsWfWLvFmi8lLdKMw:JEipGXM2jUjlvjJj/JMzWZoNdY
TLSH
T15F0275222FF80239F4B36B76293657558A7AFA75FD34CA5E8580060E5C723418E71F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoUpdater.NET.resources.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\ru\AutoUpdater.NET.resources.dll
Size 9KB
SHA256 97314053709366284705558e17873ee11b29eac1344306c851c29e4e559fea55
MD5 f96858ad3330d500c34efceebee620db
SHA1 7f07b4ff7035a33ba5b9c1c65a7aa9363e6714dc
SHA512 dcfab9ee51b6c71848c1c4784030b435e66416ab6f3f36c5f5c4a0a452b374d64e9cd736a02cd6e30afaf61ff45b9e6a8ce18d522163899f0808aec44394772e
SSDEEP 192:pdhnm+M53i4bM2j81jsJjkjMeLMQV/WLvJNKMw:d6i4bM2jOjsJjkj3MO/WlNY
TLSH
T1661231122BEA11ADE1B3653AD9355A056537BABDBF32C71E0490192E6CF23018A71F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoUpdater.NET.resources.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\sk\AutoUpdater.NET.resources.dll
Size 9KB
SHA256 1408db02419f71222248b0019446b2d501c7e68584fc155445ed7af56074c9d9
MD5 48d1a998361ddcddf8528cd7d8ecd52d
SHA1 5b0c585235dba229088b3cea9ccde5f3a78c2601
SHA512 d7182ddbe61ac0028d8ae3a95e6dc0ac1cbf922f4b931a06d2b8fb42d1ac6576573e6da7dbf97f2075027f4c46dbb75e9259cc9f274a5fae6d435e4d1339eaf0
SSDEEP 192:ZErh+OipXYgXXM2jbjOSjXjbbUMxGcwXRgXF146KMw:cipXhXXM2jbjOSjXjboMscwXaXjpY
TLSH
T1DD1272222BED4239F5F35A765A765291863EFA74AD34C62F4881020E4CB2355CAB1F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoUpdater.NET.resources.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\sv\AutoUpdater.NET.resources.dll
Size 8KB
SHA256 c428be2722773a6234ade47ac9c7977dfea0bb671fdd893efe74b22665097fb6
MD5 31d1028b4630c2e3318a12becd4c0062
SHA1 31ce3ad6fe249806078ab39821993f6675b86a7f
SHA512 f4496320f958070170c05dcbd1729dcda68afc4b993809ffbeb6b593b37d7ca2398e6aca3c12f5397b385b97a650abd8743c63b0b5e30088b17aeb3c67cee938
SSDEEP 192:GhQxiyhM2jIj28jljXkEM+eKXTgXDKMw:6EiyhM2jIj28jljXkEMFKXUXDY
TLSH
T1970294122FF9423AF4F36A7669764295893BFA76AE31DA1E40C5011D5DB33018BB1F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.deps.json

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\svchost.deps.json
Size 20KB
SHA256 3cba949ef5a94d911b9d3ea6d973691df36d0628e02b0df74d8e39f2179ca5e9
MD5 5dee9e3be8d7d561228f25fa68ef1468
SHA1 9132a32584398adaa3eb7c4c7256ebf2ba6dd7ab
SHA512 426cdd6e68df388f2c1b8ce0eea2ba9df9660b466837a7104209823c34038a375632f152f60f39ab09d343673ed322397fded586937fa33872d03c4ffb7b6995
SSDEEP 192:+4AJleI07MpqWyB2eiUc8gRpKTSoXL4G3Ow:+4UleH7MpqWyWfRYmoXL4M
TLSH
T17492AB25DA849D7742726FA228384282F625536F50016D8F78FC259CDF73F8BA1A2F74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\svchost.dll
Size 22.4MB
SHA256 d307f383e1d24cec5271859be77b3dad20906898ee3a9ea7f5675c7cc4a4dc74
MD5 65cd40cfb6074da4f9bb0c1f50143230
SHA1 ea3cbdb422b82cdbba637cb009a333083706fc02
SHA512 87406b1421465abdc6a660b3084c9b77e142dfa5df14059b9a70a757a4b08c86081f690fd0d8eace5bb1e3000b69efb7e25c8822b2cda0e306edb8800c8040ef
SSDEEP 196608:wzII3rX0Ln/0z/1To0xpLxnRlAS1UVnRPzSCmLlrITKONNCrHZQy+:+NLVJTfxpLx/AS1MVc1ZwCrH
TLSH
T119371E6EE2E08CEBD43E76B526B81B16E29013BF93C19C673EFD915D4F3A1005026B59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.runtimeconfig.json

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\svchost.runtimeconfig.json
Size 372B
SHA256 1eca0f0c70070aa83bb609e4b749b26dcb4409784326032726394722224a098a
MD5 d94cf983fba9ab1bb8a6cb3ad4a48f50
SHA1 04855d8b7a76b7ec74633043ef9986d4500ca63c
SHA512 09a9667d4f4622817116c8bc27d3d481d5d160380a2e19b8944bdd1271a83f718415ce5e6d66e82e36819e575ec1b55f19c45213e0013b877b8d61e6feb9d998
TLSH
T1CEE02C7BCA10ACB315F52BBAC02AC282FE20232B00004D2A35FC180C2F3AAB30012F49
MD5 SHA1 SHA512 TLSH

Submit Download

AutoUpdater.NET.resources.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\th\AutoUpdater.NET.resources.dll
Size 9KB
SHA256 048a52e5ea8c4a6d8d8cf7ec46c1f41ae67aced49c10d11d5d13ecacef886077
MD5 96b2559351f5d42f05b0e7194cdf86f1
SHA1 90a14dd3e4e82be11ec988eb34c726fde75938aa
SHA512 a9d569a6e82487d048d07852b1ecf11ce7d06bd9796adb457fa436ae83244547180bf10f39f29d18f3d3afdf55c8b7aaa21524a59c1e5588e6776d3a0f215611
SSDEEP 192:0CSstiNOW5pM2jIjMCj1jr5dOO6V8v0lSMjsBv5nT5TA5p5WLvqgbMfKMw:0siNL5pM2jIjMCj1jr5dO1S8lSM0v5n/
TLSH
T1281210632BE941B5F4F22A365A3A7285463ABE747E31F6DD0085115E69F13018922FF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoUpdater.NET.resources.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\tr\AutoUpdater.NET.resources.dll
Size 8KB
SHA256 749ebe2660ef8ce869ee88627cb1a7c4ef6f7049b65eb04ef25b610f7f50f9d5
MD5 1066670400388b5812741d8ea461d04d
SHA1 35e01c85f0625123f1a0489790ce87757bb9a7db
SHA512 54652196e76c72a552cbe5dfa2f9af2b351a625970a91b1716e51594b3a3e74fbc898aecbbbb920265695dc01024ed736287b4acb0feab8a8f5613f329be91fa
SSDEEP 192:Bt71KeqiG4M2jDjHBHj/jMaMk6wWLvVKMw:miG4M2jDjHBHj/jbMpwW5Y
TLSH
T10A0263122FFD023EF4F72AB669768166863AFA75F931D96F4441010E5D72312CA72F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoUpdater.NET.resources.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\zh-TW\AutoUpdater.NET.resources.dll
Size 8KB
SHA256 93d21963b12a0553d4d5b1df679f3b8ff61e5fc699acab45266f0cd3e9764533
MD5 b485aff46f1cc1f6418de58d8c281bd7
SHA1 067b3acc70a323a5d4f0c06bb72f09a91350b7fb
SHA512 12a3fedd7109cf4b1d11799d0fd70c4c72d87ca40d50ff3dc23056b20496fe3a8dfed28fb82894b3faceca916c8bb8d289593467990157da562558df08a58569
SSDEEP 192:mkkiJ6cXaj9jWjnjUZMlDdb/eWLv9I8/mpFKGKMw:4iJ6cXaj9jWjnjUZMf/eWilLNY
TLSH
T13EF154266BFC027AF5F36A7A29B54252853BB979EC31DA2F4480010D5D727128E71F37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoUpdater.NET.resources.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\zh\AutoUpdater.NET.resources.dll
Size 8KB
SHA256 4ea925fb369c847a76f2adc2e8b48b17189dc29eb13337865ed63e5fa88f3a31
MD5 851f713fe6a4013fde196b8d9591cff8
SHA1 7a01240bdd955f12cec5800c8184eeb0a439b2f9
SHA512 98b2091ed735d30ab6b8487fa76de66dc24db42bf4f1de92b8ab588e0f9711a30ac87d8751519c900a49ad9166d4beb2d304741dde9b6ab5a319141ef29b96f5
SSDEEP 192:ZW2likKM2j9j7UjjjtMIdknn6WLv+dFNKMw:tikKM2j9j7UjjjtMZn6WyRY
TLSH
T1C1F175621BF80239F5F36A762A7A9251C63AFA75ED31DA1F4480010D5D727128EB1F27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BurgerWorker.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\BurgerWorker\KViFU+Z1eTRgb8PSk+++KuLKmRQ4+cU=\BurgerWorker.dll
Size 20KB
SHA256 2182f4b0a54ad92fd9f20af5e776424f94918e54d21b8f75184fb12099bd3a85
MD5 2ca23190c3eaed6a103badf7993b0143
SHA1 6e42329a7c521f11743bbf65f8b0623984c3518b
SHA512 7170d15642892b3df70a13da7a43b976f9db1da9b07828d05441ee03f61cd7154f5665ba879f641fe5b1b7030e47fee79edbdeee836db73da51cd948002b3817
SSDEEP 384:gtVB/wFYS4IqptYcFwVc03KFc78SB0r2OnA/WkSFbOxxxxxxxxxxxxxxxxxxxxxB:gtbyP4IetYcFwVc6KF5SX7
TLSH
T13B92F705D7844215FDB142785AB38D6B8F3BFE166961A7DF344CB1AB2F723C282A3851
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetDiscordRpc.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\BurgerWorker\KViFU+Z1eTRgb8PSk+++KuLKmRQ4+cU=\NetDiscordRpc.dll
Size 178KB
SHA256 0e569f2b81e4b795d323f456a3e76e7b733c12ca840ac353de85417d80b12667
MD5 1f5c8c7386892eea3a6aa70ad7aeace8
SHA1 601aa25bafbda622aedff9931437c75b984e03a8
SHA512 08576ef29f224875c04930be1a034a1606e2018432fbbd1a5ad89ced44743ed1e9d579054c164792635218010624fbc1f37e7549f7cf1480b07c3f0b74d297c3
SSDEEP 3072:HxJC4kXsNmaK0lIl26o0VtGs7i8Y2AIH104i2W9+mZddWs7fSB:MYm6OE2AIi4i2u+mTdTjm
TLSH
T15304271593E84506F6BF977C94B3C20187B7B84A6721C3CB4664A5892F57BC2BE32732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\BurgerWorker\KViFU+Z1eTRgb8PSk+++KuLKmRQ4+cU=\Newtonsoft.Json.dll
Size 1.8MB
SHA256 c69ec2bb5e2275a3c7b5a276a310ac0ca59c1eef33aae345f8586e2921f72006
MD5 e56ff0ce43155049e4460bc41803e9e0
SHA1 b6f4fb5f94c69dc99b14e9c40ee329d6323b3a1e
SHA512 4c8d131c8118626b52a6641afe122b3af743f013d9b41b84df5f33a01ccd468e1cb405a704d305e88d073bb13cc3d6b0671c12bf87720899aa3c55af0c9698d7
SSDEEP 24576:N99C8jMjYpHiFSsqeyQucw/PuFBG4ZjPSduVNTpm7PppZCadycB7jW5JMta1Ck3Q:N99CjFSss6xAAcB7jAtBr
TLSH
T161858D06E3D8CB01E9AF56BD9D325406C6F1F15B2361D6CB1404E9842F57BC3AB363AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d43e909-e519-40a4-845a-9e89cdc8d0cc.tmp

Path C:\Users\Admin\AppData\Local\Temp\5d43e909-e519-40a4-845a-9e89cdc8d0cc.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

ec973c51-153d-47e7-b0ea-138b67050773.tmp

Path C:\Users\Admin\AppData\Local\Temp\ec973c51-153d-47e7-b0ea-138b67050773.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2ecf5b84-1ec3-4b63-82e3-41ea09781160.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1772_178111120\2ecf5b84-1ec3-4b63-82e3-41ea09781160.tmp
Size 152KB
SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
MD5 d2e80cd29c43ea745d16284dc1f58ea6
SHA1 53fe0165f9f303b333be9284865c8a74f3553c0b
SHA512 375fd3e65b12f80b92a63c1cf6f0ace9fe878c1a0cb5179d869c99aad0cfde14715fd1499eab22a04f353e5f292c19d6a5aeccb43ec2ff5cd6878a5226b005ca
SSDEEP 3072:bHVqfst2F+fBXzSKmg3n0OIH1iCylcLMLgaK9enj59Ah8MuBX8Yk17CF:b1qkfBXG801idlcLMLgaOeV9A2XdBkda
TLSH
T1DBE3E13C3EDACD26C21B20F97F287587C54D8F17A10BA50BE14A84015A76B5E17E2DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1772_501233267\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yncomb2sin3.exe

Path C:\Users\Admin\AppData\Local\Temp\yncomb2sin3.exe
Size 27.6MB
SHA256 f328351130db9e395cc94e5dacb314ff27252c59cc591265699195c0280ce154
MD5 d2314ffc4d62b6d924f8d343182fc195
SHA1 2d35debe09e6a1e98878bc3b92e1d7fa7e364e97
SHA512 d908c0a2dfeb9fd6db5e630e5091ca61d2cacc20836e564ccd1b88a05e5b0911d495e9c9645c415cfff55ff71ca18c2d2869aac0ca1d0886915579a67594aa12
SSDEEP 393216:WqNLVJTfxpLx/AS1MVc1ZwCrHXA3mDDDy/WTAw4:rfPlASqgrHC
TLSH
T1DF57516DE2E08CEBD43E76B526B81B12E69013BF93C19C673EFD915D4F362004426B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BurgerWorker.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BurgerWorker.exe
Size 2.1MB
SHA256 b5edd3a53f8cb50d1ab5ddd6979f633b1a6ca2ac53992d6642907e6a7b6c8d44
MD5 2cf687bac91aea27154769ae642f2e39
SHA1 d65c1f3cbd581f091cf36c46b1c89ef32d1ff19b
SHA512 0f4302e023cc36c4d457aea4fd3de32827645f201d430dbf4ac89847eeb9539cbec1e50fd566abf5409c6ea117324d04cb31225c4440496043c7f4bc0095cda7
SSDEEP 24576:6nTS92u+mtKB99C8jMjYpHiFSsqeyQucw/PuFBG4ZjPSduVNTpm7PppZCadycB79:6mUu+mtc99CjFSss6xAAcB7jAtBrG
TLSH
T190A58D06A3D8C711E9AF967D98324406C7F1F55B2361D6CF2404E9842F67BC3AB363A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3044-805-0x00000202C4460000-0x00000202C45A9000-memory.dmp

Download

memory/3044-804-0x00000202C4460000-0x00000202C45A9000-memory.dmp

Download