45588793a990354cfa0459c87a219917f96f23b38ced19226985c20354a629fe

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i.exe
Size 27.6MB
Sample260709-ee283scv2p
SHA256 45588793a990354cfa0459c87a219917f96f23b38ced19226985c20354a629fe
MD5 1face20ee5d14b488b9487d1c443ef8a
SHA1 4865470c8161312cb094d8be940993ca6482e1a1
SHA512 1da78479554c402cbc991ee889f5002e261cc969ae9d24fa96e74ab8b55f0ca0549a9fa828fe466cf1b07326e4dff4748c1f89be604297f9d1fa20a0a93507a6
SSDEEP 393216:WqNLVJTfxpLx/AS1MVc1ZwCrHXA3mDDDy/WTAwn:rfPlASqgrHR
TLSH
T14157516DE2E08CEBD43E76B526B81B12E69013BF93C19C673EFD915D4F362004426B69
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery

Malware Config

Signatures

Detects executables calling ClearMyTracksByProcess 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c504-48.dat	INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess
behavioral2/files/0x000d00000001c49b-104.dat	INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess

Detects executables containing URLs to raw contents of a Github gist 2 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c48e-41.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/files/0x000d00000001c504-48.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Deletes itself 1 IoCs

pid	Process
984	ifwrlu0cr2e.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BurgerWorker.exe	ifwrlu0cr2e.exe

Executes dropped EXE 2 IoCs

pid	Process
984	ifwrlu0cr2e.exe
2764	BurgerWorker.exe

Loads dropped DLL 7 IoCs

pid	Process
3820	2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i.exe
3820	2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i.exe
984	ifwrlu0cr2e.exe
984	ifwrlu0cr2e.exe
2764	BurgerWorker.exe
2764	BurgerWorker.exe
2764	BurgerWorker.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
2	raw.githubusercontent.com

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_1664955567\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_124459027\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_124459027\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_449762895\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4324_449762895\nav_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1052	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280427688733020"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2626306573-1585762579-411806764-1000\{63F9BF15-9039-4065-A2A5-2B4A624F58E9}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
984	ifwrlu0cr2e.exe
2764	BurgerWorker.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3820	2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i.exe
Token: SeDebugPrivilege	984	ifwrlu0cr2e.exe
Token: SeDebugPrivilege	2764	BurgerWorker.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
984	ifwrlu0cr2e.exe
984	ifwrlu0cr2e.exe
984	ifwrlu0cr2e.exe
984	ifwrlu0cr2e.exe
4324	msedge.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
984	ifwrlu0cr2e.exe
984	ifwrlu0cr2e.exe
984	ifwrlu0cr2e.exe
984	ifwrlu0cr2e.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 3820 wrote to memory of 984	3820	2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i.exe	88
PID 984 wrote to memory of 2764	984	ifwrlu0cr2e.exe	89
PID 984 wrote to memory of 4324	984	ifwrlu0cr2e.exe	91
PID 4324 wrote to memory of 708	4324	msedge.exe	92
PID 4324 wrote to memory of 3004	4324	msedge.exe	95
PID 4324 wrote to memory of 1052	4324	msedge.exe	94
PID 4324 wrote to memory of 3004	4324	msedge.exe	95
PID 4324 wrote to memory of 3004	4324	msedge.exe	95
PID 4324 wrote to memory of 6008	4324	msedge.exe	96
PID 4324 wrote to memory of 6008	4324	msedge.exe	96
PID 4324 wrote to memory of 5768	4324	msedge.exe	97
PID 4324 wrote to memory of 5768	4324	msedge.exe	97
PID 4324 wrote to memory of 5896	4324	msedge.exe	98
PID 4324 wrote to memory of 5768	4324	msedge.exe	97
PID 4324 wrote to memory of 5896	4324	msedge.exe	98
PID 4324 wrote to memory of 5896	4324	msedge.exe	98
PID 4324 wrote to memory of 1280	4324	msedge.exe	99
PID 4324 wrote to memory of 1608	4324	msedge.exe	100
PID 4324 wrote to memory of 1280	4324	msedge.exe	99
PID 4324 wrote to memory of 1280	4324	msedge.exe	99
PID 4324 wrote to memory of 1608	4324	msedge.exe	100
PID 4324 wrote to memory of 1608	4324	msedge.exe	100
PID 4324 wrote to memory of 4400	4324	msedge.exe	102
PID 4324 wrote to memory of 3436	4324	msedge.exe	103
PID 4324 wrote to memory of 4400	4324	msedge.exe	102
PID 4324 wrote to memory of 3436	4324	msedge.exe	103
PID 4324 wrote to memory of 1444	4324	msedge.exe	105
PID 4324 wrote to memory of 2232	4324	msedge.exe	106
PID 4324 wrote to memory of 2232	4324	msedge.exe	106
PID 4324 wrote to memory of 2992	4324	msedge.exe	109
PID 4324 wrote to memory of 2992	4324	msedge.exe	109
PID 4324 wrote to memory of 2396	4324	msedge.exe	110
PID 4324 wrote to memory of 2396	4324	msedge.exe	110
PID 4324 wrote to memory of 3920	4324	msedge.exe	111
PID 4324 wrote to memory of 1576	4324	msedge.exe	112
PID 4324 wrote to memory of 4772	4324	msedge.exe	113
PID 4324 wrote to memory of 5476	4324	msedge.exe	114
PID 4324 wrote to memory of 5476	4324	msedge.exe	114
PID 4324 wrote to memory of 1608	4324	msedge.exe	118
PID 4324 wrote to memory of 1608	4324	msedge.exe	118
PID 4324 wrote to memory of 1412	4324	msedge.exe	119
PID 4324 wrote to memory of 1412	4324	msedge.exe	119
PID 4324 wrote to memory of 5008	4324	msedge.exe	120
PID 4324 wrote to memory of 5008	4324	msedge.exe	120

C:\Users\Admin\AppData\Local\Temp\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3820
- C:\Users\Admin\AppData\Local\Temp\ifwrlu0cr2e.exe
  "C:\Users\Admin\AppData\Local\Temp\ifwrlu0cr2e.exe" --delete-old "C:\Users\Admin\AppData\Local\Temp\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i.exe"
  2⤵
  - Deletes itself
  - Drops startup file
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:984
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BurgerWorker.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BurgerWorker.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Fortnite-Burger/DeadByDaylight-Unlocker-v2/releases/latest
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x350,0x7ff97d93c188,0x7ff97d93c194,0x7ff97d93c1a0
      4⤵
      PID:708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2148,i,11062569942752980401,10474547506418143819,524288 --field-trial-handle=2448,i,2192498844284536618,9729888924939321478,262144 --variations-seed-version --mojo-platform-channel-handle=3152 /prefetch:11
      4⤵
      System Time Discovery
      PID:1052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1852,i,14658723046883297038,5300731938700697496,262144 --field-trial-handle=2448,i,2192498844284536618,9729888924939321478,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:2
      4⤵
      PID:3004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,16092521824351004423,1881704796012980322,524288 --field-trial-handle=2448,i,2192498844284536618,9729888924939321478,262144 --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:13
      4⤵
      PID:6008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3564,i,2144033937335485411,1215046021987378352,2097152 --field-trial-handle=2448,i,2192498844284536618,9729888924939321478,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
      4⤵
      PID:5768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3576,i,11041156471410591279,938178121499278454,2097152 --field-trial-handle=2448,i,2192498844284536618,9729888924939321478,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
      4⤵
      PID:5896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,7022159597107376588,12821892445215589426,2097152 --field-trial-handle=2448,i,2192498844284536618,9729888924939321478,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:1
      4⤵
      PID:1280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,14539924257530463230,1382353784257131107,2097152 --field-trial-handle=2448,i,2192498844284536618,9729888924939321478,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:9
      4⤵
      PID:1608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3584,i,16279973054136336407,5188728802534882929,524288 --field-trial-handle=2448,i,2192498844284536618,9729888924939321478,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
      4⤵
      PID:4400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,10664448013805575921,5984599094352726067,524288 --field-trial-handle=2448,i,2192498844284536618,9729888924939321478,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
      4⤵
      PID:3436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,15445487584790620602,11046661718985984947,524288 --field-trial-handle=2448,i,2192498844284536618,9729888924939321478,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
      4⤵
      PID:464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,15445487584790620602,11046661718985984947,524288 --field-trial-handle=2448,i,2192498844284536618,9729888924939321478,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
      4⤵
      PID:1444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,11362405159141366011,10327034727539171660,524288 --field-trial-handle=2448,i,2192498844284536618,9729888924939321478,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
      4⤵
      PID:2232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,4531307698555114765,9134901995162425413,524288 --field-trial-handle=2448,i,2192498844284536618,9729888924939321478,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
      4⤵
      PID:2992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,16965581651229960206,11756679052035699984,524288 --field-trial-handle=2448,i,2192498844284536618,9729888924939321478,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:14
      4⤵
      PID:2396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1232,i,2194805842643000613,9122916188772806711,524288 --field-trial-handle=2448,i,2192498844284536618,9729888924939321478,262144 --variations-seed-version --mojo-platform-channel-handle=1256 /prefetch:14
      4⤵
      PID:3920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1244,i,6527592137963058841,11892734117504285020,524288 --field-trial-handle=2448,i,2192498844284536618,9729888924939321478,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:14
      4⤵
      PID:1576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,16917349981757742501,2847790997558886691,524288 --field-trial-handle=2448,i,2192498844284536618,9729888924939321478,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
      4⤵
      PID:4772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,12447132973266407593,12353673204327914364,524288 --field-trial-handle=2448,i,2192498844284536618,9729888924939321478,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:14
      4⤵
      PID:5476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4920,i,4279722719174123853,1342444709115245651,524288 --field-trial-handle=2448,i,2192498844284536618,9729888924939321478,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
      4⤵
      PID:1608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,9326260810610981197,10603235353987469041,524288 --field-trial-handle=2448,i,2192498844284536618,9729888924939321478,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:14
      4⤵
      PID:1412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,13803045325091414248,6006960394601634493,524288 --field-trial-handle=2448,i,2192498844284536618,9729888924939321478,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
      4⤵
      PID:5008

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SkinsPerks.json

Path C:\Users\Admin\AppData\Local\FortniteBurger\Configs\Profiles\SkinsPerks.json
Size 1.1MB
SHA256 2e0f764ac03ec2efc2fd754d2637807be93090fbf0a75648cfce8d9dfb3781dc
MD5 3bb71efec0597883fbdc929edbd805f1
SHA1 0861e66bd47401293d4d93705e908eb2658692e2
SHA512 d84af44479c80682ac552d8b12641aafd2a59f9a0736622bb3569d1fe00d633b0fada78ba4c4108a1396563c16ef6cace838b702ae6f0223360a7f09654c2ec3
SSDEEP 3072:RBaT82QtULqR1POFBa7B4/mzFOjf6k0giX8WaeCxxlI+zY1bXUi1vTS61uI1KQ8+:7+zY1bXUi1vTS61uI1Kz+
TLSH
T165354F3EA1F68C6A043E577906693F06F900176FA289780777FE965D8F31381291BB27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3f51b0e24e52d8511f72e348c132f84b6b8edb54027a5c8c4fbe2a976322a690
MD5 e32f775acc5ed08adf9d5f6678c2bc4d
SHA1 bd5f4d60c6c8f97a1fed276a8c02ca345e30bb2a
SHA512 2b2fef021516ee5e90b192840780767fff5c147cfb2dfe5b900a8b298d542111707f16c28e265447d090c61e8e091b3529eb29ff376abe03cd34315206805eba
TLSH
T1DAD09B996686AD54DD80343534A1E34B9A18F522102C46488117B064CCA464246561FF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a54d1be6da491be16ecc22dac3ad8cfbe4eabb017451e32c26f2904977fde58e
MD5 9daa45ac0383b3b978ad8da2d5000b62
SHA1 f52083ce5d095366a6fa9406b8b49000fcb53bc0
SHA512 ac55ccfd63460f712cd2ffb1ff656349475683b1ec07abd198254ac469a634f7129cf280de184340d8314fe2b8f7e955f7a112deb1511d52de882ae801a7c1af
TLSH
T17DD09B9D6686AE54DD80343134A1E34B9A18F522642C464880177054CCA464246571FF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 6901511e3d0e502acfa0b8c752828e4d7b85ae0e933a387cdb792d59d05745be
MD5 12332909e9bc4021d817cc546a2052e4
SHA1 0f5c144bcda373925f623c9c196ca1359c13e045
SHA512 c1efe2c08e1787e707182de3ca89eaa540c67c0c2e1bcf6e511744d8255ff96754bf542d32020ca490f877e749aab31344b1cd44874284c39f6c583e044dd16b
SSDEEP 48:H9QsvQBl2QX1ji5mkYkuhu2kPpp6sMfe3jSJ3Rh4a2ZTncMrLO48JbHnoqkcDrgp:dQGQSmIdhp1b0Ib3mTar2AGc6XuYu
TLSH
T179916113036139F1E7AB4C7899E818DA3E789C6B60E79FA99044BD7E4C3ABD45253D30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59da78.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59da78.TMP
Size 2KB
SHA256 1cb6a8a5769701c033d079ffa9c75ecdc27b92097b8f596ede2e379dd223a3f7
MD5 cca7595a6143d8337b3c99d67688f1d1
SHA1 62ee128984f1967f71aa7b853de817de8c501ef1
SHA512 54777882d7cb6332236349b65883b22268cf51cae9ea1c6ba99bfa26a6abda0d9f318312e359a9879dc3ee0c4ac6553c7d63af350a640e9cef2f7eb07bb22c2d
TLSH
T1D5518550037579D2E7E941BDEAE809DA3E7CAC6A31E76EE814807C3B8D3A3245391034
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 b54dbd1fcb1b7471f2e820df52b419dc048c617cb36360f7f659ff7e0901aa9e
MD5 dda27a65a6830eeb14c50d7a499f382e
SHA1 74922ba4724b89e4d74af9ab5eccb1c90ba802aa
SHA512 637178c561d128fa62768590a9bed4fc866392a44d68f4aacf122a6e27a7802b06380edcdae5a488f0dfa6e7a933265215df40a96d819a3fb68125acd64a0f7b
TLSH
T1D461ADF783F5956DDA1295F0AA18AE1BCE2C0510831C3C6A89E0BE57E3E3871E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 fbfa1f6efd2eef62dbd139a816e422dc91df7ef6a5534db87eacb52a7cbf81e6
MD5 b7755fbc6632278aca10a4d33c76bf53
SHA1 8bbb2a9c0ca5c6aebafc92b110266220fce7bc52
SHA512 ded7e5fa4e75bdb04c7d4aec3755340356c50be291821ee1aad5fbd998137ce65148714d6f15f22668d6ef2c718efa5202e335abbf02b8425095776e3498f696
SSDEEP 192:sxRMRcJyM/jK1Ml8wC//f5s4LZSgjU8xVzoA8pygy/g6+WNSBW/YD5OGrIgrJ:sxRM08//f5s4lSgY8x4M/5J/+9
TLSH
T1EA62E9167E28597BCCDBD209FA517F53D6F81563E2941E44AAFC8A0C01E7AED121381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 6693509e7262a37edb411d762cda04cf822652ef2542b9bed3de1ea035293e6e
MD5 a474e5ac322f9269ecd48e95536ffef3
SHA1 af54b32263a20ecf72f05c53b277b62d35a4f90d
SHA512 981ce253d2c88f7e0446ce876dc6da73b417d75b8303cda9f2ccf343f8411e53007c0cfbe6aeb47f31ae558695e733e0a13a062505a0bbed92b779f96ac6868d
SSDEEP 192:sxRPRcJyM/jK1Ml8wC//f5sWLZSgjU8xVzoA8pygy/g6+WNSBW/YD5OGrIgDXJ:sxRP08//f5sWlSgY8x4M/5J/+l
TLSH
T18762D9167E28597BCCDBD209FA517B53D6F81563E2901E44AAFC8A0C01E6ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 63f83b7361d68be7cdb7f7f31670b60fc53585fb6921463f6032c96ef8440ec5
MD5 552999419a89814a6135f1d53f343885
SHA1 4ee59ead2b651204c4d58391bae0672998dc481f
SHA512 a375495bdd79252c32c38077aceae489008add0e32403bc3d173a9f7bc8126353ccefa224a037e19e0e0182153244af216b9c961561249604eae5121f7f4abca
SSDEEP 768:f+4+zH7pLuL7eDWgb/fPI8F1+UoAYDCx9Tuqh0VfUC9xbog/OVT3DIn2Bro7jIY:f+4+zBE7eDWgb/fPIu1jaI3Dw267jIY
TLSH
T17AE2EB7B680CCB7F4F404A9DEC29BD9A6DE801CF9698C95447FA880C03C6AEB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 0707f50ba3c4ac06e4c61bbf41ea97254529d6e38e30e9525aeb88cc510609bc
MD5 a95e07069c7b9fa06f2e72c1e0898367
SHA1 eb00434ed516fe884a040d2e431e11c86f35830e
SHA512 1f533cc7a787533ca7b7ecad7aead5e5c1211b83d8708f538fff380cd61160346b5b11588327bcf7d2f2cc3e633f32845acc1470cf77b2a5e432e7b2849539e5
SSDEEP 96:KR1i7Pj5J1WdSIg91K4EgT1c7j6dJOHm7KmgIIOW4tVgGOK47g0OcOGlkWbEBVjO:C1i7Pj5JAdSp9/EgTK7j6dJOHm7KmgIO
TLSH
T149915A14353B0680393E758C82A88C6B81C17091745BB56B3BE801DE1F6AE4B9EFEDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a6ac1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a6ac1.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 33470ce854e4371ae1965a46b6212939d0a050f74e06fd77f35441c95e927229
MD5 b21946cb0e2772614638b5e963fdbb99
SHA1 1a992a487039116330cbbc7a21a5c6c1d7d2caba
SHA512 3eaec5801d62ed9b86915044e406a752641e3e23ba90562111c5040bb1fa0563393e54378b487ea7645fbd70138cb3094f943d98de17f2225033609270c17859
SSDEEP 768:Ej+9l3RqgwifSmaHuVboPzkZLNx9OFPb9MQ:T9l3ReFXHOawZLNqlb+Q
TLSH
T16DF2BF31B825DD338CAB87D9B24B3A97BFF0216389C10E48DDE85B0D05975AD1B0BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 d15a8d95998d6e3810a449b075457c219d8adee28439c2f5bf1e76333b568d1f
MD5 80fa17bc4abe52d1b2f63a35f6c3e6cb
SHA1 6da1912b14c26b85f65a5581cfaa5aa490608f3e
SHA512 0ac7c955481356bec1c6d2d3ac360c58fb8a70ddc91e9199c9300fb18fa96330263c7445c5fd1fe5bfb06637a2849842efc202a9cc326b7ef29f4160e0f610ce
SSDEEP 768:gF1j+9l31wgTfl7paHuVboPzkZLNx9OFPb9MQ:t9l3H1kHOawZLNqlb+Q
TLSH
T1FF1328F6A8E38937D89E4787A33D2D46AEFCD163B5841984BBD41E0CCC961BFC606811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 fe1f6d7c2ef01a16c0efb919b399f68faf3df9cd3e7f18506df12c9c3b4dff9d
MD5 e90861a4945c4849371828d1712cfa51
SHA1 74e46b9df356f4afb4e2a975b14258141edfbc7d
SHA512 2cb31609c0a6d7ba4afcff355d8168e0397dcad707ac6eed8b2a3b4eedbc4823584a694ba376c8966c76749d2c3a5c18988ad53bb32654d26a84f295fd486131
SSDEEP 768:4j+9l3W7gwifSmaHuVboPzkZLNx9OFPb9MQ:n9l3WjFXHOawZLNqlb+Q
TLSH
T16BF2BF31B825DD338CAB87D9B24B3A97BFF0216389C10E48DDD86B0D05975AD1B0BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 9611b764e9d6fa6ac9e5ae5461409596386814e2d5e85de8fe33e38f6bc62ec6
MD5 f32b7771f5613c2d27b06ddba97bd30a
SHA1 b41b9e602b40fc9894c31fa8ede4835c6a797709
SHA512 938181a82d109b55cd49c4912a43556708a77fad27ec7144cc9049ad1b483ea8a858820875e97ebb723b7247e8dfeec432c23d9fc23710c50783e0397f729efd
SSDEEP 768:0rv+4UNbdC3iUkxwifRaHuVboPzkZLNx9OZQUik4K:0bsbs3iUpjHOawZLNqWUVr
TLSH
T1BB03B035A8749C37CDE79289B14B79477FF4215395C00B88C9DC2B4D46AB4AD270BE27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

2a970e3d-2e96-4109-8a6a-8b4f3f830725.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2a970e3d-2e96-4109-8a6a-8b4f3f830725.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

AutoUpdater.NET.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\AutoUpdater.NET.dll
Size 248KB
SHA256 91f8f0038d5f6597e32229353116dbcbbfa8b1991a22321af4ca56c86de69e09
MD5 272e9904ebf29859c9dcf549320661f5
SHA1 7ab1613570303aaa1bc60603a7f74aca68d496c3
SHA512 26e4d98467df60f5956968b8d11cc081921ba1292235b98167f83b6173e43520f57b05f3153c2f8a33e6ebc530dbc5300162b14fc8001af9d762da7e70936098
SSDEEP 6144:Hl+tHMXIsl0eG2kBiJysWUL06jTwzrm7:UHMXIsl0eG2kBizC6jTcr
TLSH
T18F443A02FFE5C325C1663AF5983581A107357E96A900CA6A34B8764E4F33267CF6276F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BCMakeCert.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\BCMakeCert.dll
Size 600KB
SHA256 93ba40952f4be52de0c6afb0d66e8c306489edc682ad4515fb12cac8bee2630e
MD5 404918448fcc85fc40193430d0fc2580
SHA1 f01ca0b39a3bfa2e9c47ed2ecc7a033630c1f002
SHA512 ccd9a3014d8b6b424ef70efe0350fb75a19e8d60e2db277436434144b5f37bf0fbfb2b31f7f49ccb4b7b8d1185140fcd2f480a094392aeaa1582eb2560027878
SSDEEP 12288:lx97VGJc0V51wlTLau+3pgEkH5HBiG7LRK5H8:lx9L9au+3pgEkH5HBiG7gx8
TLSH
T16ED47D08A7F41326E19ED7B5C0705865DAF0F029B26BEB5F1CC276FA5953B128C41B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BasicFormatsForCore.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\BasicFormatsForCore.dll
Size 145KB
SHA256 f60f48e8a320b6fa2760d2f8fc5dcd5dff2fb526f967545dd2d620d09b9c5675
MD5 b5e3cb1cac8689c46633460289791f61
SHA1 c4f904be98a59a3a9154c8a3c36b62d66ee530c0
SHA512 45501bd2a58cf4e9753c464fc9adc8c92d43a963caf957de3515392ad68649ce908224f513159864686576b71a32846b2b1155c2a48ae189a72f643cd86eb67f
SSDEEP 3072:zM4HNvwUesP/3d9r9PM9NjeilcwUP0s8nrV+YHOyjO6njKr8iS:wIwU19ziWd+/O6nji8iS
TLSH
T1E2E36C4833E85600E1FFAF7A95B085114B75B516A973E79E0DC490AE2DB3781CE64F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetZip.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\DotNetZip.dll
Size 234KB
SHA256 309f84521fff1f48c3509f7110f1789347a272501992c79af3ef6e6d3b3de7d2
MD5 efadf1780d4ea45d067f7163c4c7a80e
SHA1 a460c0033a007ff979a66153e501023c5d9ab514
SHA512 b785689b51d4be82390fc3b582ba394044dee7f154d703ad4dd688d1c67acdde59d8c51326cdb47341e4576e24ae4fc19b19e43b285dde25b1716887f332249f
SSDEEP 6144:h5S2GuvzjoNuTdR/jZiWAzLIUjIcOF8sszR2:22PvPsAT/b+cF8Tzg
TLSH
T104345B0423ED4F6AF6EE67B9D0B59192C3B2B46134BEDB4E5D4460FE18173A0D9107A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FiddlerCore.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\FiddlerCore.dll
Size 774KB
SHA256 e7e7572d2c3028ffaa0b58c765a526525b2bdb5cc9696045e34f36b01ba847fb
MD5 06b6694b72df565e06e919ca4570b20b
SHA1 e4d2f2b7b6292cb2e8047f8eada5ac7e12e44743
SHA512 ad8c7d0a1e34067c84c539c56aa134ed9cc1963ad15647f48ed2a1be7b779798388371cf330457d3b1668b4c93d57a99db135cef88131b97530376b80e44a683
SSDEEP 12288:qwgpE6bmSuMZVnSuBbYSdTHaEpFdlYRdEI9VO:q/Y0f0OHaClYRHq
TLSH
T10EF4061027F85A11F2FBAB789DB225008BB9B896ED25CB5F0940C09D0D72BA5DD52F37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FontAwesome.WPF.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\FontAwesome.WPF.dll
Size 204KB
SHA256 63d50dbe094bbce5d7bf8af08c0d919cfa5e057ca05ae7b27704a8477c8b348f
MD5 2ace85429eee9e8320c82d878e5562b4
SHA1 77ed8b89210930d1de2495ba363519b696d0b6e2
SHA512 7ce3467d1469acdb544f4f42864d94c5ae0ada252c5f096329e16d4b571fc1800bd572e52cfe902ee5d4b91d59a1a4182b07f40b7a4dfe54e338ca46684af989
SSDEEP 6144:Z8P7/P97ilHDqO01ktQOzB4YjDnX08RYA3fP5S:Z8PpilHD+kQA4uk8RYA3f
TLSH
T1F924C077B640664AC6474631FC0BB74221FAE1629D1F4B16FFC4A98E3296B504E22F37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hardcodet.NotifyIcon.Wpf.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\Hardcodet.NotifyIcon.Wpf.dll
Size 101KB
SHA256 2059222c4ae5d0291fce13bd296adcc448d79b6fae27746aedf347608ed3090c
MD5 2cfde828cdbfbb545be5aa61fe1e62a1
SHA1 d376bde7322118787f6f08131ab34a17eb711789
SHA512 2a1215dde4bfc4626cc4fe9696b6465a0893a8787ce4ff41ca0c08908bb8aa52a992a156c3320deb0fefb225acb4c3132286d8c04a0caed93282b86adc011cda
SSDEEP 3072:5oy+75OQW4pg9xXsGQTckaX4kGsdO5UInM34:5+75ON4pg9xX7kzsTInM
TLSH
T1B1A3CF8523FC405AC1FEA73478B532148771FD837A61CF2A498262B849B77D91AD07EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Web.WebView2.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\Microsoft.Web.WebView2.Core.dll
Size 461KB
SHA256 c6feb73ec1cb9271f2004d2586fe1833621a0fcd3d04a6fc1dcf08557d634ac0
MD5 0901d7f2f8b621433f3eaee6a63cb8d1
SHA1 12bf14a2ad26f568f78e4a9304234a6a990757ba
SHA512 e428770009468c5e48e843031758d2ec2af3ceb3c0614248b17e90105415d7ddbf9783e5cfa77738731cf3aceaca788afa7405944dea0af3247ac5f0a4638b40
SSDEEP 12288:5MYWHzByTrx3YSi+iKmRFNge1+imQ9pRFZNIEJdIElxPrEIgcvLcglxMwCepM1SW:5HWTBFI
TLSH
T10DA44F2223FE425AF9F37F75557412204AF6FCD6B93AE75E0998A16D0C32B4089A1333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Web.WebView2.WinForms.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\Microsoft.Web.WebView2.WinForms.dll
Size 37KB
SHA256 983a69e9ae41e7cc91962704a903a2c2dd49d464f243a7d101d0b715f723f1c6
MD5 f696f28047246a651f90900475186ea1
SHA1 f87c665f212a7b8b3393060ca84d2e576e6bced6
SHA512 45588b89a24f3db2b5a56bb841480b991efeef9f4778b10e4b8a9a58c651cc12be81c8bf1ceda5badc0b76a03046bdf4b457a00130e1ac0e93cf724e71e756d2
SSDEEP 768:qN9HFciVtBZDgcEST3p4Jjrjh2jJ+SG2auxvxJKia5/Zi/ZGQKqu6bX6uTHRt8cF:29fVtBZDgcEST3p4JjrjaJ+SG2auVxJD
TLSH
T1A2034B0083ACC617EAEB5EB8A5B485620B7ABE837D60D39D5C88F1E90DB37E05514377
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Web.WebView2.Wpf.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\Microsoft.Web.WebView2.Wpf.dll
Size 43KB
SHA256 29f6e7dac224fc0ba91e45145e209fdb18c985781280d778aeedbd1ea885f137
MD5 c83529d6c90dc9644779207d81bb6539
SHA1 771dcb61c27bdbee4b749ba6d831107756412f77
SHA512 e42703c1d36c21542ccdef6071d2699b50fabec327b8c4db87e3b830fcb40e7d3f8ae3e951cfeca53c2297089b417e199be07105f199335fd3880ea816424cad
SSDEEP 768:k+Q2cVseHJ4Wgs0WZ8lBDP/ryEH0yBy4JjrD1h2jBhsUaGzkI7hKKa5/Bi/IGCvS:NmseHzxZ8lBDP/ryEH0yBy4JjrD1aBhl
TLSH
T11213289543EC492ADBEF6B74A07496610A3AFE437D71E78C1AC4B0E50EB77D025403AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\Newtonsoft.Json.dll
Size 695KB
SHA256 22c649f75fce5be7c7ccda8880473b634ef69ecf33f5d1ab8ad892caf47d5a07
MD5 adf3e3eecde20b7c9661e9c47106a14a
SHA1 f3130f7fd4b414b5aec04eb87ed800eb84dd2154
SHA512 6a644bfd4544950ed2d39190393b716c8314f551488380ec8bd35b5062aa143342dfd145e92e3b6b81e80285cac108d201b6bbd160cb768dc002c49f4c603c0b
SSDEEP 12288:mFIM0KteTMN4Or4D3OdmZg5WHEaEDIGBBjgrIQtD+tVqDMW:6zMTMNNd+g5Wk78GBBjgrIQtDF
TLSH
T165E45A2123E99B2BE0AF2775B032491647FAF542F6B7D78F5604D8AA1C43F558D82323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Steamworks.NET.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\Steamworks.NET.dll
Size 365KB
SHA256 a61778cbce992f1d3ab48577d8c6c1c43778727b6127cdfa8b97eccc353ce6ab
MD5 9cad80b5a72727b344d5fb46734af788
SHA1 e83420c8b362944f9fe861c808172ecd7057030b
SHA512 0e34d5f47398b52005cd41dba28d58a2e8128ecf3add668757c246946cbeb5d4d8f72d67c5a36f6d13ef8b2e30248b035630a444c3a6bf040978d338d489e927
SSDEEP 6144:38Z9REsOmCo0SIepPqX2lbRbRU/TB9nflJxSpbnk25pRk/9:38Z9q8tqzvflJir3RI
TLSH
T13484F82D7320793BC029433664B75E0BE6A0E4C2231B6E6F764249395DB77C49E3B2D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.CodeDom.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\System.CodeDom.dll
Size 183KB
SHA256 7b2ba5ede11ae8ac2d1d67df100fbd23e45558f8b29cf7ca767bb41d4f88281c
MD5 34f6f6df02024f033c0d9cecc9e19f5e
SHA1 0f72071a867d7ca61edac4cc70752ef608fe9926
SHA512 5a7e9d6c023cbc4de9360686149a001e0b6192580939224af193e952d1e62e3e0ba3577cded85f012d90678bd681245bfd25ff258d596c235a5c3afdb65b21b8
SSDEEP 3072:MFxaB6x7l+gq0WENWTv23phTvrgnlLXb8EVY3H+1Rzbbh1pTiWk:U33hEoURwE23yRznV2J
TLSH
T108043A713398823BCEDE5235E0A9405042F5E56A7382DB9F5C8965FA5E23F60ED20E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ComponentModel.Composition.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\System.ComponentModel.Composition.dll
Size 262KB
SHA256 7e65f888588c79f69acb593d9b39990c33fd58377fc48300a0a93fc8dbaa159f
MD5 e0bab5ab0d5835d00acc36eda1a4e3a2
SHA1 3b4dc4b656922e71deea58d7e4f51aa68e6680be
SHA512 e3faeae0346a62ac0f38ee42119213b39c4d1fa2372ef9d02514e95050eac70a67a92edf0019392642e3a08964e2a838edb8629e4346f5b68d40839173416733
SSDEEP 3072:DJDT6qZG065+dP14WQuE3pu4Y62v903SoIrEjFSikDdLRKVgWjqrgKQqktCsa6AP:1Bd4WQoCGmSoIlRA4itCsa6A5oM7
TLSH
T15944291237FD1366EAEF1B7CB67488118AB5F962B50AE74C2C4994FD0963F908521B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Management.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\System.Management.dll
Size 288KB
SHA256 75b833e2aea56dafa94f0d2728925db405f9dd758ff19d43924a7a268202c94d
MD5 bf74ada4da38cdb4a8decbdae77249b7
SHA1 bb419a9fb2b61bd2ab00f10266635cc47a9e0ffc
SHA512 f0f2ac9ccc3d217446fed2c2e78a5e503455cc7ae60f060a05a1e160109cdd542e75f6b044a7d5a356cf8fedd4ad15cf92e1df1361373fae7f55b6f923fbde3a
SSDEEP 6144:Xd4rRwgJrgMmbwipdLEoWkFPMcBIABGBcz7:XqrRwWiUA/
TLSH
T10D543B3037F8C196C5BE8EB9A03011948FB1B3AF244EDB9D5562BCED28B1781D65712B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Telerik.NetworkConnections.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\Telerik.NetworkConnections.dll
Size 67KB
SHA256 14a8afece485815896fc9f098d66b0457d1be374b10366b48c706dfdbb275094
MD5 f442ae4be024c27c59ef737902303a86
SHA1 c8191737225509a110a6fc42f9e0291fd6576c8d
SHA512 8b3f768ba5232db3d5355e8d4a719597f16f06a438f39365e494df4b30125f433dacaab5aee2bfbfde910c4b86ee0ca6903c703863b28c5d4a39c62103522af6
SSDEEP 1536:qpjTrvVmDDDy/WTAAPfi82uA+J+GwclhzF8FgaUK:qpX7VmDDDy/WTAa68JBJ+GwclhzF8FZX
TLSH
T158636D4133AC532BE7FF4F35A0B6A21004B6FB55BA23FBAE145450AD5C627C126217EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\WebView2Loader.dll
Size 156KB
SHA256 8d6fe8b14529e1d6a02a7f2d5991ee72ace0d7e2f1901c71cfd7df310600f4c1
MD5 e8894bce4a8fbd1a059023b3b3c7849e
SHA1 5ce5ea789dcfd04effc7ec2aa40d704bb42cb31b
SHA512 405b90498c9b71c0514129d72ff1bac345bca7188cd268ee3e6aa4ec6529f94ab91ea271a6e8e6d7e9343359e6e7e9fd8b275fb761abd14d100a36201e0538ab
SSDEEP 3072:rKLKQDEW3JHtcGNd/SzCzkYLSq9hX4qSd/8SALTcYrEtnWldxVKW6:mTBt9Nd/9d18qSyEtmG
TLSH
T1D0F36C57B3E5007BE1678274C9934A56E77378510B60AFDF03A482691F237E4AE3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoUpdater.NET.resources.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\ar\AutoUpdater.NET.resources.dll
Size 10KB
SHA256 cf2b1c3cf607e7884fe8dbeb87b74ce6c42f4536fb92131704df5abfad96ecd5
MD5 15f7af014cf402523f0f00a2897158b6
SHA1 e02d2ccc3c1e278f822ca303389f7c41aff137c6
SHA512 334e0644c29be7f6f0c829a31ce730fc93a0d2a1efeb8c35dac539e0a539196910d664ef082a167d22b7e590527fc8ea2429e99f3fecfbd0e1d02198e46c16ba
SSDEEP 192:fXhMivXhRlfM2j+jurjyjYtVfXwiRx7ofVsXiFRqe7eKMw:iivXhRlfM2j+jurjyjY3fXwiRKfVsXSr
TLSH
T1E72245122BFD5275E5B39A7694B66194C63BBE72DD21EA1E0496010DCCB2317CBB0F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoUpdater.NET.resources.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\cs\AutoUpdater.NET.resources.dll
Size 9KB
SHA256 18b1eb31160b5d3ef6e8424204dcfdd2df69a48ff191f08810fd01a95bf3f9a0
MD5 2a6292b0c3bcb81a18ae8b44a275ee96
SHA1 a9fbfc94728909d9909e48b60dcdd432460dea4e
SHA512 39d213392cc638e9fa786352e12d0353fc96112ad2d19bf031382206cc028d5f7d4cae29b4ed402b2ccc651717c9f1b3c808ea556c095814fc6bd331048147b1
SSDEEP 192:D8hP7iLXYgXY8M2jbju/jTjjt2M9l87+EXRgXCeWKMw:AjiLXhX/M2jbju/jTjj4MQqEXaXCeWY
TLSH
T1171251122BFD0239F8B35A766A764190873ABB71EE35C66F0495010D4CB2356CEB1F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoUpdater.NET.resources.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\da\AutoUpdater.NET.resources.dll
Size 8KB
SHA256 3d1dac05f707e995b1fa1a1a1c89dff452036fbf20273e6334afbb4b00033aa6
MD5 cfdbc013e1ac53ef5da16582054a4c58
SHA1 6831e26ff9ae73c210ded5379be3946918d33f01
SHA512 626243ad4a05c584771773d5d8f494a65d4d7cbf5571beba293a09b909d9d5ca82167605d7ac03486cd48bc2ad93776734d095f7ed064d7b1f1c07fc3ea4bda7
SSDEEP 192:KbXqigKM2jbjKhjOjD9M7OWLvoRGKMwi:figKM2jbjKhjOj5MqW/Yi
TLSH
T196F143136BF8433AE4F36BBA693A5255863AFA76D930C62F4484011D5DB37118BB1F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoUpdater.NET.resources.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\de\AutoUpdater.NET.resources.dll
Size 8KB
SHA256 408bbd72954cdd8e830ebd0787f9214405b5acc15d06c3336d7015cdaebb71ef
MD5 cb9f885e34df02e77aeb8d304019a372
SHA1 f9a787fa782799e4a84679ed18fc51041b451954
SHA512 f2f3ad6687a61f43d8c974934b5cb6e8eb74b0325c1bcee1eab5329e9a945955e3490ae71961525509c11089e0077061ce74fe274e35551bd2a9f41161769a3e
SSDEEP 192:f7hjFiYEM2j6j+ijAjD3fUMASZWLv6aIBKMw:PiYEM2j6j+ijAjzUM7WbcY
TLSH
T1320275122FF9423AF5F36B7E197641559A3AFA75AA31C61E0580111E5DB33228F60F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoUpdater.NET.resources.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\es\AutoUpdater.NET.resources.dll
Size 8KB
SHA256 d689092b0e4d74e1a55d0c6fe43abf65580a3fbf52b3b8368285d8639b1d2cb7
MD5 7d94426173a5be2b84fb5ecbbea4ac86
SHA1 75d186b84c28ef5ebb088a9a7cfaecde7bdcfeaf
SHA512 708a94708f126034829e5ea2f2a1508420cce0660a071f10ed3c59800ae2736ac9e871061a593dbd98aa46843d309666097e6275d5be45bf05a3bbaead04e3da
SSDEEP 192:5GhlB/igwM2jGj+Ej9jLXdMLfMmihMn5sWLvaGNL1CBeKMw:Yv/igwM2jGj+Ej9jLIfMrUGWGKweY
TLSH
T1F00277126BEC0239F4F36B766E7645529636FA75BD34C62E4080020E5C72746CE72F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoUpdater.NET.resources.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\fr\AutoUpdater.NET.resources.dll
Size 8KB
SHA256 2fb47dfb09f9f24585b8bfa71c773d855b93744dbbd8c376ed8c3edfd3f36064
MD5 399becfbbd24131839c31eb023556e47
SHA1 6e2c7c11e256f534e87c1868624774a2bebcb05c
SHA512 e1425ead6674ad37e59908675e4fff42bb3b184fffa00f3cea19e4faf63e26c7901958e55d449ba3713689870ea1a4ee0370f6b99fb6a3483f5ac1fa74397e1f
SSDEEP 192:mW0UiHxoM2jcjiZj8j7qUCzL4MpCWLvxOLVVKMw:ZiHiM2jcjiZj8j7qp4M8WWbY
TLSH
T17F0263072BFC126AF5F36B766A7692518637FA79ED31D72E0481020D58723118AB2F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoUpdater.NET.resources.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\it\AutoUpdater.NET.resources.dll
Size 9KB
SHA256 eea2adbc5356ce05b2d9fc418e99ef0711e9c7fcdeff3d0c6d85c3758a49a75f
MD5 0c987d6182959a0a9bffa4ab31f08c0e
SHA1 e39e497924d8a0eadd514d47ce47cd1685f49b75
SHA512 814b171319f85c39dab237c146f1d811f303fd982ca919cb7e418dfa49dcda145a0f75d436409b4b0cc82381c019558a400932227faa54adf97652c5e09bc5e1
SSDEEP 192:KVh35iwkM2jUjf8j6jlV7MDAP6X/aBXjLxu7KMw:GpiwkM2jUjf8j6jlV7MTX/aBXvE7Y
TLSH
T17C1264222BFD0239F0F32B7A59765181977BB975FD20DA2E0485010D59B27429AB1F37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoUpdater.NET.resources.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\ja-JP\AutoUpdater.NET.resources.dll
Size 8KB
SHA256 3370fbd2efb274b714a02ce32b3b642c65fa19a896f3ed7ac0a9502fe7d6beeb
MD5 39605f921bb6d87527972f23f17f4e7b
SHA1 eaeb878e8a12d36cdffb0b605ea3dc8181d4dc82
SHA512 5afaf1f311c54465b0db0e2c8bebbd7ae01239d9bc9f30fdf2ebbd68d2026c51d1e970ea6d0d6966f8410f909375b3879f8fac1bd8cc45f6e9ca1a36717ad390
SSDEEP 192:05qdi/h2uM2jijfjjOjdLMaXoWLvIKMw:oyiJhM2jijfjjOjdLMXWkY
TLSH
T1D802632D67E8026AE8F32A72287A52818536FE75ED31D72F045C811D6D7231ECA71F72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoUpdater.NET.resources.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\ko\AutoUpdater.NET.resources.dll
Size 8KB
SHA256 c5b8a8e7da93b9b50d3a1ef3330035b41c514ef6f361188be97ac273716919ac
MD5 9e6898093a38b2c4da2d9cdf2dfd13ed
SHA1 936c0e03e4d8d4f5b5023694d47e10c2ed393096
SHA512 84f9be33177151418cd7f125f46508538f2d8b36bcc2c739ad6e5b528a24c25f0907d4821c3060e316ff048bf8a7d0965744c56e951170c091f72f1f018224ce
SSDEEP 192:T2C1gid3M2jDjDijDjdM5IirBWLvl1dKMw:rgid3M2jDjDijDjdMlrBWZ1dY
TLSH
T1E80284921FEE0279E4F36E7A2E75A241867AF974FE32C61E4844050D9D723128E71F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoUpdater.NET.resources.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\lv\AutoUpdater.NET.resources.dll
Size 8KB
SHA256 b00f6217cb875a0daedfea0e00d3311d2608d03c0bee74d524d177de06f4da74
MD5 224ffe50479ba20cd6a210d5ee920d7d
SHA1 322147636cf8b1c1c2d38f3fc94e8632a6c9a7e9
SHA512 b93a7335970f293f071680e56e8710f904c12f129d07144a3c83c7baba3186573514c751ca11150b65342f20b274beee7ba37ab63654fcde0a502d13d1c92547
SSDEEP 192:Kh0UmiwRrM2jtjYUjCjqdWMpHsejeWLvtrEKMw:O07iwRrM2jtjYUjCjbM5sejeWBrEY
TLSH
T1A10252222BFD06B9F5F36AB61A76915145BAFB74BD21C62F0485020E8D723158EB1F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoUpdater.NET.resources.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\nl\AutoUpdater.NET.resources.dll
Size 8KB
SHA256 6e9df964edd743039174e6dffc068219e59f40cafd33902581e74a08dc72edf2
MD5 77b89a64c5aeb6f43ee89f87c46f97a9
SHA1 6b479246676ee768010a76baf36cc3197afa6aa3
SHA512 70dbf04206eccaa9c8998a7b260439e77554fd93b401540f17f2d3fd8bfcb3704c632d4c50162c2c944a5a025d47254012333d11197027bc15ba836fd213c448
SSDEEP 192:55OqiyaM2jGjEnjSj1iu+bOFMgNscL7WWLvPMRKMw:viyaM2jGjEnjSjEu+bOFM9cL7WWDMRY
TLSH
T185F185172BF9423EF5F35A7A58768292863BFA75DE31C62E4444021D5CB23128EB1F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoUpdater.NET.resources.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\pl\AutoUpdater.NET.resources.dll
Size 8KB
SHA256 a041069ac5e288d2704ab670efa6753dd268bf86b3223003e4e094754a337936
MD5 7f9bc29eef52c3b890c5b1e245626952
SHA1 c1592857e7e023a22eed970f66c4a84d80c58ec9
SHA512 c9a75131406961f20fd9807fe9168fd36c2859f9879f31841d3a10f02bdd9614fa41060135fb01b1f799f2263c7a647b60a0e83ab2d215458e36d67f9da3ed3b
SSDEEP 192:EJU/WiYeM2jDjUwjej9ul8LMfK6D5WLvN2JKMw:siYeM2jDjUwjej9ul8LMy6D5WRoY
TLSH
T1320285116BF8023AF8F36A7A6A765255893AFA75EC30C65F4441110E9C723528EB2F37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoUpdater.NET.resources.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\pt-BR\AutoUpdater.NET.resources.dll
Size 8KB
SHA256 ae81bc07e5daf06825a77b68d5ec12cc5998348c2a73bdbf6d5e6fcef9d64f70
MD5 0eabb0e7abd788c23b3c142fa7fe51fd
SHA1 6d6495bdf98765cb0e1a9d61f636d34a3feea9f0
SHA512 a8eeae1b31f7e14db61146e535e4ab1d16bdb66eb2ab9f9d5ec9df4bf16c8a65b1ee31b2351022f4c464149f0b4af633d099b0f39639dc38d19e7fd591c4c820
SSDEEP 192:p+3IilOM2jnjmzjtjmMweWLvF2i82OKMw:k4ilOM2jnjmzjtjmMTWxYNY
TLSH
T1A10263222FF90239F8B32B76593A9612963AFA35ED24D65F4581060E5D723428E71F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoUpdater.NET.resources.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\pt\AutoUpdater.NET.resources.dll
Size 8KB
SHA256 1212b1aa059492afa336dcc83a96a409f9d00198f7fc20e340f60619cf3f63b0
MD5 67817d2edd9b0675d4f7485700abb972
SHA1 ffe63a1bd069b684bf38541410ea5e551cc19c20
SHA512 7e2b80cf825f1e989a0fee378a9f7bff048a950df4c7b12a154ace1c0b363e699f944f14cc646843b1dfface148986ebedf07193d88b0f759f5be0bbffdac0fb
SSDEEP 192:1NhIxipGXM2jUjlvjJj/JMsWfWLvFmi8lLdKMw:JEipGXM2jUjlvjJj/JMzWZoNdY
TLSH
T15F0275222FF80239F4B36B76293657558A7AFA75FD34CA5E8580060E5C723418E71F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoUpdater.NET.resources.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\ru\AutoUpdater.NET.resources.dll
Size 9KB
SHA256 97314053709366284705558e17873ee11b29eac1344306c851c29e4e559fea55
MD5 f96858ad3330d500c34efceebee620db
SHA1 7f07b4ff7035a33ba5b9c1c65a7aa9363e6714dc
SHA512 dcfab9ee51b6c71848c1c4784030b435e66416ab6f3f36c5f5c4a0a452b374d64e9cd736a02cd6e30afaf61ff45b9e6a8ce18d522163899f0808aec44394772e
SSDEEP 192:pdhnm+M53i4bM2j81jsJjkjMeLMQV/WLvJNKMw:d6i4bM2jOjsJjkj3MO/WlNY
TLSH
T1661231122BEA11ADE1B3653AD9355A056537BABDBF32C71E0490192E6CF23018A71F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoUpdater.NET.resources.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\sk\AutoUpdater.NET.resources.dll
Size 9KB
SHA256 1408db02419f71222248b0019446b2d501c7e68584fc155445ed7af56074c9d9
MD5 48d1a998361ddcddf8528cd7d8ecd52d
SHA1 5b0c585235dba229088b3cea9ccde5f3a78c2601
SHA512 d7182ddbe61ac0028d8ae3a95e6dc0ac1cbf922f4b931a06d2b8fb42d1ac6576573e6da7dbf97f2075027f4c46dbb75e9259cc9f274a5fae6d435e4d1339eaf0
SSDEEP 192:ZErh+OipXYgXXM2jbjOSjXjbbUMxGcwXRgXF146KMw:cipXhXXM2jbjOSjXjboMscwXaXjpY
TLSH
T1DD1272222BED4239F5F35A765A765291863EFA74AD34C62F4881020E4CB2355CAB1F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoUpdater.NET.resources.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\sv\AutoUpdater.NET.resources.dll
Size 8KB
SHA256 c428be2722773a6234ade47ac9c7977dfea0bb671fdd893efe74b22665097fb6
MD5 31d1028b4630c2e3318a12becd4c0062
SHA1 31ce3ad6fe249806078ab39821993f6675b86a7f
SHA512 f4496320f958070170c05dcbd1729dcda68afc4b993809ffbeb6b593b37d7ca2398e6aca3c12f5397b385b97a650abd8743c63b0b5e30088b17aeb3c67cee938
SSDEEP 192:GhQxiyhM2jIj28jljXkEM+eKXTgXDKMw:6EiyhM2jIj28jljXkEMFKXUXDY
TLSH
T1970294122FF9423AF4F36A7669764295893BFA76AE31DA1E40C5011D5DB33018BB1F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.deps.json

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\svchost.deps.json
Size 20KB
SHA256 3cba949ef5a94d911b9d3ea6d973691df36d0628e02b0df74d8e39f2179ca5e9
MD5 5dee9e3be8d7d561228f25fa68ef1468
SHA1 9132a32584398adaa3eb7c4c7256ebf2ba6dd7ab
SHA512 426cdd6e68df388f2c1b8ce0eea2ba9df9660b466837a7104209823c34038a375632f152f60f39ab09d343673ed322397fded586937fa33872d03c4ffb7b6995
SSDEEP 192:+4AJleI07MpqWyB2eiUc8gRpKTSoXL4G3Ow:+4UleH7MpqWyWfRYmoXL4M
TLSH
T17492AB25DA849D7742726FA228384282F625536F50016D8F78FC259CDF73F8BA1A2F74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\svchost.dll
Size 22.4MB
SHA256 d307f383e1d24cec5271859be77b3dad20906898ee3a9ea7f5675c7cc4a4dc74
MD5 65cd40cfb6074da4f9bb0c1f50143230
SHA1 ea3cbdb422b82cdbba637cb009a333083706fc02
SHA512 87406b1421465abdc6a660b3084c9b77e142dfa5df14059b9a70a757a4b08c86081f690fd0d8eace5bb1e3000b69efb7e25c8822b2cda0e306edb8800c8040ef
SSDEEP 196608:wzII3rX0Ln/0z/1To0xpLxnRlAS1UVnRPzSCmLlrITKONNCrHZQy+:+NLVJTfxpLx/AS1MVc1ZwCrH
TLSH
T119371E6EE2E08CEBD43E76B526B81B16E29013BF93C19C673EFD915D4F3A1005026B59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.runtimeconfig.json

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\svchost.runtimeconfig.json
Size 372B
SHA256 1eca0f0c70070aa83bb609e4b749b26dcb4409784326032726394722224a098a
MD5 d94cf983fba9ab1bb8a6cb3ad4a48f50
SHA1 04855d8b7a76b7ec74633043ef9986d4500ca63c
SHA512 09a9667d4f4622817116c8bc27d3d481d5d160380a2e19b8944bdd1271a83f718415ce5e6d66e82e36819e575ec1b55f19c45213e0013b877b8d61e6feb9d998
TLSH
T1CEE02C7BCA10ACB315F52BBAC02AC282FE20232B00004D2A35FC180C2F3AAB30012F49
MD5 SHA1 SHA512 TLSH

Submit Download

AutoUpdater.NET.resources.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\th\AutoUpdater.NET.resources.dll
Size 9KB
SHA256 048a52e5ea8c4a6d8d8cf7ec46c1f41ae67aced49c10d11d5d13ecacef886077
MD5 96b2559351f5d42f05b0e7194cdf86f1
SHA1 90a14dd3e4e82be11ec988eb34c726fde75938aa
SHA512 a9d569a6e82487d048d07852b1ecf11ce7d06bd9796adb457fa436ae83244547180bf10f39f29d18f3d3afdf55c8b7aaa21524a59c1e5588e6776d3a0f215611
SSDEEP 192:0CSstiNOW5pM2jIjMCj1jr5dOO6V8v0lSMjsBv5nT5TA5p5WLvqgbMfKMw:0siNL5pM2jIjMCj1jr5dO1S8lSM0v5n/
TLSH
T1281210632BE941B5F4F22A365A3A7285463ABE747E31F6DD0085115E69F13018922FF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoUpdater.NET.resources.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\tr\AutoUpdater.NET.resources.dll
Size 8KB
SHA256 749ebe2660ef8ce869ee88627cb1a7c4ef6f7049b65eb04ef25b610f7f50f9d5
MD5 1066670400388b5812741d8ea461d04d
SHA1 35e01c85f0625123f1a0489790ce87757bb9a7db
SHA512 54652196e76c72a552cbe5dfa2f9af2b351a625970a91b1716e51594b3a3e74fbc898aecbbbb920265695dc01024ed736287b4acb0feab8a8f5613f329be91fa
SSDEEP 192:Bt71KeqiG4M2jDjHBHj/jMaMk6wWLvVKMw:miG4M2jDjHBHj/jbMpwW5Y
TLSH
T10A0263122FFD023EF4F72AB669768166863AFA75F931D96F4441010E5D72312CA72F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoUpdater.NET.resources.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\zh-TW\AutoUpdater.NET.resources.dll
Size 8KB
SHA256 93d21963b12a0553d4d5b1df679f3b8ff61e5fc699acab45266f0cd3e9764533
MD5 b485aff46f1cc1f6418de58d8c281bd7
SHA1 067b3acc70a323a5d4f0c06bb72f09a91350b7fb
SHA512 12a3fedd7109cf4b1d11799d0fd70c4c72d87ca40d50ff3dc23056b20496fe3a8dfed28fb82894b3faceca916c8bb8d289593467990157da562558df08a58569
SSDEEP 192:mkkiJ6cXaj9jWjnjUZMlDdb/eWLv9I8/mpFKGKMw:4iJ6cXaj9jWjnjUZMf/eWilLNY
TLSH
T13EF154266BFC027AF5F36A7A29B54252853BB979EC31DA2F4480010D5D727128E71F37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AutoUpdater.NET.resources.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-09_1face20ee5d14b488b9487d1c443ef8a_agent-tesla_cobalt-strike_dcrat_glassworm_hijackloader_i\JhjmG9HbJqfv7ul11DfeNb5BsuCb88c=\zh\AutoUpdater.NET.resources.dll
Size 8KB
SHA256 4ea925fb369c847a76f2adc2e8b48b17189dc29eb13337865ed63e5fa88f3a31
MD5 851f713fe6a4013fde196b8d9591cff8
SHA1 7a01240bdd955f12cec5800c8184eeb0a439b2f9
SHA512 98b2091ed735d30ab6b8487fa76de66dc24db42bf4f1de92b8ab588e0f9711a30ac87d8751519c900a49ad9166d4beb2d304741dde9b6ab5a319141ef29b96f5
SSDEEP 192:ZW2likKM2j9j7UjjjtMIdknn6WLv+dFNKMw:tikKM2j9j7UjjjtMZn6WyRY
TLSH
T1C1F175621BF80239F5F36A762A7A9251C63AFA75ED31DA1F4480010D5D727128EB1F27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BurgerWorker.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\BurgerWorker\KViFU+Z1eTRgb8PSk+++KuLKmRQ4+cU=\BurgerWorker.dll
Size 20KB
SHA256 2182f4b0a54ad92fd9f20af5e776424f94918e54d21b8f75184fb12099bd3a85
MD5 2ca23190c3eaed6a103badf7993b0143
SHA1 6e42329a7c521f11743bbf65f8b0623984c3518b
SHA512 7170d15642892b3df70a13da7a43b976f9db1da9b07828d05441ee03f61cd7154f5665ba879f641fe5b1b7030e47fee79edbdeee836db73da51cd948002b3817
SSDEEP 384:gtVB/wFYS4IqptYcFwVc03KFc78SB0r2OnA/WkSFbOxxxxxxxxxxxxxxxxxxxxxB:gtbyP4IetYcFwVc6KF5SX7
TLSH
T13B92F705D7844215FDB142785AB38D6B8F3BFE166961A7DF344CB1AB2F723C282A3851
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetDiscordRpc.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\BurgerWorker\KViFU+Z1eTRgb8PSk+++KuLKmRQ4+cU=\NetDiscordRpc.dll
Size 178KB
SHA256 0e569f2b81e4b795d323f456a3e76e7b733c12ca840ac353de85417d80b12667
MD5 1f5c8c7386892eea3a6aa70ad7aeace8
SHA1 601aa25bafbda622aedff9931437c75b984e03a8
SHA512 08576ef29f224875c04930be1a034a1606e2018432fbbd1a5ad89ced44743ed1e9d579054c164792635218010624fbc1f37e7549f7cf1480b07c3f0b74d297c3
SSDEEP 3072:HxJC4kXsNmaK0lIl26o0VtGs7i8Y2AIH104i2W9+mZddWs7fSB:MYm6OE2AIi4i2u+mTdTjm
TLSH
T15304271593E84506F6BF977C94B3C20187B7B84A6721C3CB4664A5892F57BC2BE32732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\BurgerWorker\KViFU+Z1eTRgb8PSk+++KuLKmRQ4+cU=\Newtonsoft.Json.dll
Size 1.8MB
SHA256 c69ec2bb5e2275a3c7b5a276a310ac0ca59c1eef33aae345f8586e2921f72006
MD5 e56ff0ce43155049e4460bc41803e9e0
SHA1 b6f4fb5f94c69dc99b14e9c40ee329d6323b3a1e
SHA512 4c8d131c8118626b52a6641afe122b3af743f013d9b41b84df5f33a01ccd468e1cb405a704d305e88d073bb13cc3d6b0671c12bf87720899aa3c55af0c9698d7
SSDEEP 24576:N99C8jMjYpHiFSsqeyQucw/PuFBG4ZjPSduVNTpm7PppZCadycB7jW5JMta1Ck3Q:N99CjFSss6xAAcB7jAtBr
TLSH
T161858D06E3D8CB01E9AF56BD9D325406C6F1F15B2361D6CB1404E9842F57BC3AB363AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifwrlu0cr2e.exe

Path C:\Users\Admin\AppData\Local\Temp\ifwrlu0cr2e.exe
Size 27.6MB
SHA256 d9c428e16dff6a1349ffeb1294a41e0b9e0cef0a5322ff495d3b7df02d824e6c
MD5 8123d322c06f96f4a3c41ff8b4aba152
SHA1 7913f0a3d7facea33a65e465227ed2b412fdee77
SHA512 4ff3b9318070d7c666a3dc844cda20ffdf442625fb2665e6399aca7d53801ff2ca0ded5360a3a2c209ccc8c55e85c1b5f12c7c8b315af79388814dcdc2958dd0
SSDEEP 393216:WqNLVJTfxpLx/AS1MVc1ZwCrHXA3mDDDy/WTAwg:rfPlASqgrHa
TLSH
T19B57516DE2E08CEBD43E76B526B81B12E69013BF93C19C673EFD915D4F362004426B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4324_323922568\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BurgerWorker.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BurgerWorker.exe
Size 2.1MB
SHA256 b5edd3a53f8cb50d1ab5ddd6979f633b1a6ca2ac53992d6642907e6a7b6c8d44
MD5 2cf687bac91aea27154769ae642f2e39
SHA1 d65c1f3cbd581f091cf36c46b1c89ef32d1ff19b
SHA512 0f4302e023cc36c4d457aea4fd3de32827645f201d430dbf4ac89847eeb9539cbec1e50fd566abf5409c6ea117324d04cb31225c4440496043c7f4bc0095cda7
SSDEEP 24576:6nTS92u+mtKB99C8jMjYpHiFSsqeyQucw/PuFBG4ZjPSduVNTpm7PppZCadycB79:6mUu+mtc99CjFSss6xAAcB7jAtBrG
TLSH
T190A58D06A3D8C711E9AF967D98324406C7F1F55B2361D6CF2404E9842F67BC3AB363A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download