f454cdcffda76ac50e6c9979e4ea25bf09b1d06517201f35b8b3c1b26aac02fe

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 02:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Size 19.2MB
Sample260710-che7lsc14w
SHA256 f454cdcffda76ac50e6c9979e4ea25bf09b1d06517201f35b8b3c1b26aac02fe
MD5 ad32a1c0936fb31f22e592f6585fa355
SHA1 ab6244340fccfe062bac1828e72b4358c40ebed4
SHA512 f4fc0f5a27135fda8baf0fdc35a27cdfd4189eb10194f4cad1acbf29b39ae705ca84abd1bae9c2a31b39bb8d4f6200758d46ae2a849ebd801430a21cfbab7db7
SSDEEP 393216:P0lxLfYIBU8z7zhff4E3npAdFsLczHwnPp/QgEILO/IAK1T:Oxj3GE7P3pSFsSQnPtzJB
TLSH
T17717331176D98434E1B20935D6A9D36B58B6FD724732C8CBB3D90A6D4A35AC28C3DF23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

bootkit discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
22	4968	msedge.exe

Checks for any installed AV software in registry 1 TTPs 5 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\SetupFolders	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avira\Launcher	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Launcher	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\AhnLab\V3IS80	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AhnLab\V3IS80	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_403952791\hyph-eu.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_403952791\hyph-te.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_1369332870\json\i18n-mobile-hub\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_1369332870\json\i18n-ec\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_1369332870\json\i18n-tokenized-card\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_1369332870\json\i18n-notification-shared\pt-PT\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_1369332870\json\i18n-shared-components\hu\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_1369332870\Mini-Wallet\miniwallet.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_1369332870\wallet-webui-792.b1180305c186d50631a2.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_403952791\hyph-cu.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_1369332870\json\i18n-ec\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_1369332870\json\i18n-notification\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_1369332870\json\i18n-notification-shared\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_1369332870\json\i18n-notification-shared\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_403952791\hyph-ga.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_403952791\hyph-hu.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_1815935234\Filtering Rules	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_1369332870\bnpl\bnpl.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_1369332870\json\i18n-ec\da\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_1369332870\json\i18n-notification\fi\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_1369332870\json\wallet\wallet-notification-config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_403952791\hyph-ka.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_1369332870\json\i18n-mobile-hub\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_1369332870\json\i18n-notification-shared\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_1369332870\json\i18n-notification-shared\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_1815935234\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_1369332870\json\i18n-hub\hu\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_1369332870\json\i18n-shared-components\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_1369332870\json\i18n-tokenized-card\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_1369332870\json\wallet\wallet-checkout-eligible-sites-pre-stable.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_1369332870\json\wallet\wallet-checkout-eligible-sites.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_403952791\hyph-de-ch-1901.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_403952791\hyph-kn.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_1369332870\json\i18n-hub\fr-CA\strings.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_403952791\hyph-ml.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_1369332870\hub-signature.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_1369332870\json\i18n-mobile-hub\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_1369332870\json\i18n-notification\el\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_1369332870\json\wallet\super_coupon.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_712492446\shopping_iframe_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_1369332870\json\i18n-ec\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_1369332870\json\i18n-ec\th\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_403952791\hyph-sl.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_1815935234\Part-FR	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_1369332870\bnpl_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_1369332870\json\i18n-ec\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_1369332870\json\i18n-hub\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_1369332870\json\i18n-tokenized-card\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_1369332870\wallet-webui-560.da6c8914bf5007e1044c.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_403952791\hyph-und-ethi.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_1369332870\buynow_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_1369332870\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_403952791\hyph-da.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_403952791\hyph-es.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_712492446\auto_open_controller.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_1369332870\json\i18n-notification-shared\zh-Hans\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_1369332870\json\i18n-shared-components\pt-PT\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_1369332870\edge_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_1369332870\json\i18n-hub\pl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_1369332870\json\i18n-notification\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_1369332870\json\wallet\wallet-checkout\merchant-site-info.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_403952791\hyph-de-1901.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_403952791\hyph-el.hyb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4968	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{1B161D9F-E128-4047-8B91-D6A702E4BC99}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
4580	msedge.exe
4580	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Token: SeRestorePrivilege	5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 5912 wrote to memory of 1472	5912	2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe	88
PID 1472 wrote to memory of 2732	1472	msedge.exe	89
PID 1472 wrote to memory of 4968	1472	msedge.exe	90
PID 1472 wrote to memory of 3800	1472	msedge.exe	91
PID 1472 wrote to memory of 3800	1472	msedge.exe	91
PID 1472 wrote to memory of 3800	1472	msedge.exe	91
PID 1472 wrote to memory of 1240	1472	msedge.exe	92
PID 1472 wrote to memory of 1240	1472	msedge.exe	92
PID 1472 wrote to memory of 124	1472	msedge.exe	94
PID 1472 wrote to memory of 240	1472	msedge.exe	95
PID 1472 wrote to memory of 124	1472	msedge.exe	94
PID 1472 wrote to memory of 124	1472	msedge.exe	94
PID 1472 wrote to memory of 240	1472	msedge.exe	95
PID 1472 wrote to memory of 240	1472	msedge.exe	95
PID 1472 wrote to memory of 6004	1472	msedge.exe	97
PID 1472 wrote to memory of 2776	1472	msedge.exe	98
PID 1472 wrote to memory of 2776	1472	msedge.exe	98
PID 1472 wrote to memory of 6004	1472	msedge.exe	97
PID 1472 wrote to memory of 3312	1472	msedge.exe	99
PID 1472 wrote to memory of 2472	1472	msedge.exe	100
PID 1472 wrote to memory of 3312	1472	msedge.exe	99
PID 1472 wrote to memory of 3312	1472	msedge.exe	99
PID 1472 wrote to memory of 2472	1472	msedge.exe	100
PID 1472 wrote to memory of 6948	1472	msedge.exe	102
PID 1472 wrote to memory of 5540	1472	msedge.exe	105
PID 1472 wrote to memory of 5184	1472	msedge.exe	106
PID 1472 wrote to memory of 5796	1472	msedge.exe	107
PID 1472 wrote to memory of 1636	1472	msedge.exe	108
PID 1472 wrote to memory of 1636	1472	msedge.exe	108
PID 1472 wrote to memory of 6816	1472	msedge.exe	110
PID 1472 wrote to memory of 6816	1472	msedge.exe	110
PID 1472 wrote to memory of 3340	1472	msedge.exe	111
PID 1472 wrote to memory of 3340	1472	msedge.exe	111
PID 1472 wrote to memory of 2124	1472	msedge.exe	112
PID 1472 wrote to memory of 2124	1472	msedge.exe	112
PID 1472 wrote to memory of 6056	1472	msedge.exe	113
PID 1472 wrote to memory of 6056	1472	msedge.exe	113
PID 1472 wrote to memory of 4580	1472	msedge.exe	114
PID 1472 wrote to memory of 1136	1472	msedge.exe	115
PID 1472 wrote to memory of 1136	1472	msedge.exe	115

C:\Users\Admin\AppData\Local\Temp\2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_ad32a1c0936fb31f22e592f6585fa355_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe"
1⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://down.360safe.com/setupbeta.exe
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2fc,0x300,0x304,0x2f8,0x324,0x7ff950d2c188,0x7ff950d2c194,0x7ff950d2c1a0
    3⤵
    PID:2732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,6213016706085197508,2096753603586609710,524288 --field-trial-handle=2716,i,14318347196029913065,10071155266820662563,262144 --variations-seed-version --mojo-platform-channel-handle=2892 /prefetch:11
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:4968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,14952414824756690176,7245526155080565988,262144 --field-trial-handle=2716,i,14318347196029913065,10071155266820662563,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:2
    3⤵
    PID:3800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2344,i,18336999311681326162,2768383933930895253,524288 --field-trial-handle=2716,i,14318347196029913065,10071155266820662563,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:13
    3⤵
    PID:1240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3524,i,17187881101571124324,932259307120387983,2097152 --field-trial-handle=2716,i,14318347196029913065,10071155266820662563,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
    3⤵
    PID:124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3528,i,16509740768705636083,14425023473962359908,2097152 --field-trial-handle=2716,i,14318347196029913065,10071155266820662563,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
    3⤵
    PID:240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,15894741356211081694,15048741593401329450,524288 --field-trial-handle=2716,i,14318347196029913065,10071155266820662563,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:14
    3⤵
    PID:6004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,14001437848468014993,4481593836679417788,524288 --field-trial-handle=2716,i,14318347196029913065,10071155266820662563,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:14
    3⤵
    PID:2776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5628,i,15604376167419274369,5393088547465860298,2097152 --field-trial-handle=2716,i,14318347196029913065,10071155266820662563,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:1
    3⤵
    PID:3312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,6712558347212603052,11732656075455894445,524288 --field-trial-handle=2716,i,14318347196029913065,10071155266820662563,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:14
    3⤵
    PID:2472
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,13700328270290746985,9690122362221091887,524288 --field-trial-handle=2716,i,14318347196029913065,10071155266820662563,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
    3⤵
    PID:1904
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,13700328270290746985,9690122362221091887,524288 --field-trial-handle=2716,i,14318347196029913065,10071155266820662563,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
    3⤵
    PID:6948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3292,i,11355624805722421986,11050541146544821809,524288 --field-trial-handle=2716,i,14318347196029913065,10071155266820662563,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:14
    3⤵
    PID:5540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,4609754962880329487,14569090286639231571,524288 --field-trial-handle=2716,i,14318347196029913065,10071155266820662563,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
    3⤵
    PID:5184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,8959791244482679732,5479619184767166364,524288 --field-trial-handle=2716,i,14318347196029913065,10071155266820662563,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:14
    3⤵
    PID:5796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,8541400006638345932,7140810538916226077,524288 --field-trial-handle=2716,i,14318347196029913065,10071155266820662563,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
    3⤵
    PID:1636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,1895061273200882070,16585194488085667343,524288 --field-trial-handle=2716,i,14318347196029913065,10071155266820662563,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
    3⤵
    PID:6816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4044,i,7394261691484069606,5409123600726911313,524288 --field-trial-handle=2716,i,14318347196029913065,10071155266820662563,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
    3⤵
    PID:3340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,14694031102421776875,1860329516953276822,524288 --field-trial-handle=2716,i,14318347196029913065,10071155266820662563,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
    3⤵
    PID:2124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2640,i,322639799464683800,7551778527020796777,524288 --field-trial-handle=2716,i,14318347196029913065,10071155266820662563,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:14
    3⤵
    PID:6056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5988,i,15709233660240361305,17665461477460002540,262144 --field-trial-handle=2716,i,14318347196029913065,10071155266820662563,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,12170513509127812988,4964105811777789600,524288 --field-trial-handle=2716,i,14318347196029913065,10071155266820662563,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:14
    3⤵
    PID:1136

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 92a973fa8f43e6bbe56af5b1d6fa5d7cdf55bfe802df730198b1f45fdd812bf4
MD5 3be0c11962ee216ef2908c1a909de89d
SHA1 6735c8bfdbf3433111a55484b7523759d3a4efe2
SHA512 20b2f448310d71aed54df599452395c476aa73f812c1412148b715f1a413b7863acba1561219bd93602706064257343b8bc6e84fda74449055e5fc44743b54c8
TLSH
T151E02BA7C961BC376AFD1B1860580687EB50131B3B41984B3B3C835C4FF46374686C5C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 065b81647074ade9cfe5d0e57d1130107bcfcbe8234acf68f1605b25eb899ea2
MD5 484366636d8ef7b8c12621bbd7bd23cf
SHA1 a55d7215f82a6d7af1a1a043ef3c678af94bc0b4
SHA512 de23318d0a3c414312857b9448f8214aded61493560872185d8faf69365d6a0a89ee27bc32b51445f15b393a13610a5e13fbfecd2c2f176dc8a7ffa4420cb2b7
TLSH
T1C641BFF783F4866ED91196F0AA18BE2FCE1D0515432C3D6AC9E0AE1B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 3aab178ae2cc9b61fbdd6f50c31682d1c3a72d3d9b1049e0bd01c693046e8f72
MD5 ab1ac30211ed79853f637f463fef833c
SHA1 fb6e2a1a491cf1673657bced9e0b3282b1ba953f
SHA512 f89207923fb6679ca0d75945b1e3f90c9b1aeff6be4151cb4ccb6d4d98e2a5b7503db6c5cc7838db6c4386fc55807580e915b2b6a9f3bfba0fa4f29c8f0c4f32
SSDEEP 384:sxRQlFN/fTsfmN/RIpbw/5IWmgsGQOjQo:s8bN/fCEWi/5IWmgsGQ3o
TLSH
T1DF62E9166A249D7B8CCBD209FA557F93D6F85163A1905E44ABFCCB0C04E6AEC211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 e5ff69838466f62753d391e3af6b5a86ad302952ca544e3c4bdc9c2fbfa00da8
MD5 2f0dc43479b2c95e699196731c3b5ea9
SHA1 666e32b634ecb03b1d2f5eb8d5f0a219bcef2380
SHA512 c4daefb42da2d453ccee8f4bdd7a09a614d4d6027c80e4099e3e210e8d95ced307612606095c16ac63465245c282afbed9047e75a35989c94e8dbde274a67df2
SSDEEP 384:sxRQlq+N/fTsfmN/RIpbw/5IWmgsGQOtD:s80+N/fCEWi/5IWmgsGQ0
TLSH
T14972E9166A289D7B8CCBD219FA957F93D6F85173A1901E44ABFCCB0C04E66EC211381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 8aec5daafefb83f35638c76b088f1ca19ed398d6a53cbad428febc9db34493a5
MD5 8c0b9b7481d6a8f09de28e578c18aa79
SHA1 ac96ad9d9db5fe9174bac93a4e3d0c74d98f35d9
SHA512 20db593175a37ed5b791b41e0c4a767a1628a2e70c6eff9685791384e6872f43543a307f76af7e3f3d4e87b296d3b9a7bd50d631938305bd4d1362e43a9714ee
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVRobbDwzro84N:Ob4YZnE7yTWg1NfwBu1jaCobHwADN
TLSH
T1F1E2EC3B280CCB7E4F804ADDEC29BD9A6DA801CF5AD8C95447FA450C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 40457564f58dda21675d959425adcc6c83218f5c6c3a8527244525fd1a026244
MD5 b3d6b1278f8a0e5a2210e28c2e5de72a
SHA1 0b267a62fc3af578efbbf8a98c39077806218037
SHA512 5b1e96a178dad6b525d873d8f56b45784bbd431a298f5ffd936142e1495522e047d34e8725a76d3a366366a85ead0a13f183b26275e0db95c457f6c806502920
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9EkRC2kyCtmfyuIwB0ns0X+CJDs+:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRF
TLSH
T155B24B51713F4280383EA91C85B8981F96C2B4637519E52F7BA801A65F6BE03DDFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 856e1dea488410d869711649c5f1f580124f47a71349b07ef402791649858383
MD5 3549eacfc9910d31e889f81a6fb151f1
SHA1 405398bae8c38543c62dcc8f6035acd889495a99
SHA512 e6ce86aede1cb70063839abc116d3f99c50dfe764c817f7ac76561065b6747dbe4138cb8f323277e7fb143cecb35ac0bd142cacf856cab06008c9dce4679215a
SSDEEP 384:nfiF1tNn/s3n9Sn8NgH8TUNTUlIRQPvuTuMREnf+GGrpNdshPWkLSOObjI9G6w7A:qF1j+9SXHwg2uFAGrfdsjS29MA
TLSH
T11BC25B36E865CEBBEDE74F99B64A7A56EEE01163859C59C4EAD81D0C00C31AD4703C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 69185f21c34151d931327c8008f66ed2cb7e321453317796d91d387a3d25c3f2
MD5 b41fd04ea3dfc60d66396f603dd7b8d1
SHA1 f9401971f67226c91f06f2b44dbffdff16472370
SHA512 6d53d77aa540ca71fa83fab39b139310e57c2466adcf1bb0238ee2b29118cd9ec7bdcc0e5da8759de98259447e32047789e44da616c564589ae77d9b568def61
SSDEEP 384:n5iF1tNn/s3n9Sw8NLE8TUNTUlIRdPvuTKxREnf+GGrpNdshPWmBp+FH+YOObjIq:QF1j+9xQEwgDuwAGrfdsvPeeY29MN
TLSH
T115D25C32DC55CEB7ECEA4F99B64A7A97EEE011A3858C5EC4E6C85E4C00C729D4B07C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4cd638672eda1eae76d135e0b450dafb24abd7590803fced54141c6ae4e26802
MD5 b865ddfb81e9f2ffca20a2c60212a720
SHA1 968b79347e7b242022cdba87bbeeeddc91e80bb4
SHA512 6aa63d5e7fb52755289e79bf6c8a903e130ef4f4441e0d5cdc224a7104c3219cdf7a2455ffd721d403458d758d34881005ac7fc7de50847413e1334462a00525
SSDEEP 384:nwiF1tNn/s3n9Sm8NLE8TUNTUlIREPvuTaxREqf+GGrpNdshPWmBp+FSmYOObjIf:LF1j+9rQEwgquYZGrfdsvPevY29MM
TLSH
T1C2D25C32DC55CEB7ECEA4F99B24A7A97EEE011A3898C5EC4E6C85E4C00C759D4B07C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 1007274fe003a33bfebc76d576b0815e3fd025492dfe12243687a87f06223e1d
MD5 9c91ee3aabe14e71ebdfd1868194eaec
SHA1 e9bc16d02fc8a9a22a9274c20dd31e77cf64a135
SHA512 7e1c1f89df71e8aae74aff4e4e74dadd98ba25b59cc9ffa24bfde6f9b379fcc84a16f65a754d0c04182f81c008ba096ace0ca04a3bad8ee328cd8c902452a976
TLSH
T18F4141E04C381AD1D4BD0E7FB04B74FC95ECD726F490347D6858EA985A7A65D218083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 870e4630dbaa1b821c9664c9e707d4acce883f9f50cd3a4a24545baf91a2f4ee
MD5 0bc827f41af0e2e75216e24e75223653
SHA1 086ebafb29d1c7a260c08f7373f58ad27a07c3b1
SHA512 3d8e769d49c5a4e4e48bdd7f142366ca40fdeb1f5b124849a57a75142dea9ecebabdbf27871dede327647cdba87e48196953a083d4106db3abd76084ad83331b
TLSH
T18D512CE08C381AD1D4BD0E7EB04B78EC95E8D726F490343D6858EA985A7A75D208083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 cf549aea8a238269042df393c8b4105d42abf72e101236e03a3c40a0345b4e81
MD5 9241d646d554891879c345aa741ba5ed
SHA1 58b5c30f7a893098dd0690706054b598b96455ca
SHA512 2653c9aefae0e5b3afab354b6324fe8f41f2a36f19d24399a70310f3872a47b1f44bb9c7ee47bdc1fa166a37034ef50b8fb917d0d862bf1d7f8e04bee5da9dbd
TLSH
T143512FE08C381AD1D4BE0E6EB44778FC85E8D725F4A0347C6858EA585A7A65D308083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 4dbb20126192431275845c776c2c66d7d18d54932ff72d3955d2a327e125b2e4
MD5 50a2ed32135e7f2fe888d1877700e6c0
SHA1 1731053588c766af721e571f15a591646b894019
SHA512 e748b66e2f90797ef92c3d9638a9e1abb6f590cf12ee51a966ce01f4e7c46785d5524d854a655034432df30a56fb44779a140f9e2d2ba253a56b6c3068ddb30f
TLSH
T1D2413FE05C382AC1D4BE0E7F748B34FC84E8D726F490347D6858EA985A7A65D258083F
MD5 SHA1 SHA512 TLSH

Submit Download

miniwallet.bundle.js.LICENSE.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_1369332870\Mini-Wallet\miniwallet.bundle.js.LICENSE.txt
Size 551B
SHA256 38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179
MD5 7bf61e84e614585030a26b0b148f4d79
SHA1 c4ffbc5c6aa599e578d3f5524a59a99228eea400
SHA512 ca5f2d3a4f200371927c265b9fb91b8bcd0fbad711559f796f77b695b9038638f763a040024ed185e67be3a7b58fab22a6f8114e73fdbd1cccdda6ef94ff88f3
TLSH
T108F08B5A31E12673416285A1270B52DE7F0C10BDB0AF39779444C3386C348EE82D0EE1
MD5 SHA1 SHA512 TLSH

Submit Download

notification.bundle.js.LICENSE.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_1369332870\Notification\notification.bundle.js.LICENSE.txt
Size 1KB
SHA256 363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831
MD5 8595bdd96ab7d24cc60eb749ce1b8b82
SHA1 3b612cc3d05e372c5ac91124f3756bbf099b378d
SHA512 555c0c384b6fcfc2311b47c0b07f8e34243de528cf1891e74546b6f4cda338d75c2e2392827372dc39e668ed4c2fd1a02112d8136d2364f9cab9ee4fa1bd87f5
TLSH
T1A2313A5B32F53673416245A1670B52DEBF0C24AEB56F38B79495C3387C388ED82D1DA1
MD5 SHA1 SHA512 TLSH

Submit Download

strings.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_1369332870\json\i18n-tokenized-card\fr\strings.json
Size 2KB
SHA256 c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5
MD5 cd247582beb274ca64f720aa588ffbc0
SHA1 4aaeef0905e67b490d4a9508ed5d4a406263ed9c
SHA512 bf8fa4bd7c84038fae9eddb483ae4a31d847d5d47b408b3ea84d46d564f15dfc2bae6256eac4a852dd1c4ad8e58bc542e3df30396be05f30ed07e489ebe52895
TLSH
T17251EE3D88F4489B60C7921B6B1142D7C9704E36D704F3848A63828A035BDEFB0BF69D
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-bn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_403952791\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mr.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_403952791\hyph-mr.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_403952791\hyph-nn.hyb
Size 141KB
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
TLSH
T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1472_712492446\edge_checkout_page_validator.js
Size 1009KB
SHA256 04047fbad72cb02b113ee3a1f1823227aac74e1615fc5fa359d11776c727259c
MD5 21147b0280aa959a020d50a7d5738f17
SHA1 2e57c2a0e0b2c1f1cc78acf1a8fbb833c01b984f
SHA512 92db10d864968ee94156df795552867723aeb7ef03341e00c7f8cf11542a8443f83e1eb2487631ed38b441d4af751c8f4b3f99319312e50d8501df74263c01a4
SSDEEP 24576:cs4ymRAbsvvG3kJ6ARjiQixwaErg/OUfWEo0EQ1Xp8C9T0dK/vzHEiJsfaG81E9/:cs4ymRAgvvG3kJ6ARjiQixwaErg/OUfq
TLSH
T1B5252B84E1E2253466D74CB960B7D2C4B5DC04583399F1E8FA6C68CADB0F94723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5912-0-0x0000000004980000-0x0000000004981000-memory.dmp

Download