Analysis
- max time kernel
150s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/07/2026, 02:56
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
General
- Target 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe
- Size 20.4MB
- Sample260710-dfbxvacv4k
- SHA256 764cc9d938388935b6ab654793aef7ca0f9937a2d23e582aa89d98a655511bd2
- MD5 4309afe85c1f2e0ccfcc0d4ceee6a1bb
- SHA1 495f4b5ab4a70de570573bb261ff9e67dcfcf024
- SHA512 14157890a6374ed29c8d380e3a2d72ed3af21757ff21bea6832adfc37895536fa4ebca619c7e37cb7c8d042fb8b579c3c34945ea2a26a196112725d8f82d9f1a
- SSDEEP 393216:P0lxLfYIBU8z7zhff4E3npAdFsLczHwnPp/QgEILO/IAK15gxlBts:Oxj3GE7P3pSFsSQnPtzJYxS
- TLSH T15C27331177D98474E1B20635D6A9D32B58B6FD724722C9CBB3C90A6D4A35AC28C3DF23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
flow pid Process 20 2120 msedge.exe - Checks for any installed AV software in registry 1 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Avira\Launcher 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Launcher 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AhnLab\V3IS80 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AhnLab\V3IS80 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\SetupFolders 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\json\i18n-notification-shared\en-GB\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\json\i18n-shared-components\de\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\json\i18n-shared-components\fr\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\json\i18n-tokenized-card\pt-BR\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\shopping_iframe_driver.js msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\json\i18n-mobile-hub\ja\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\json\i18n-notification\id\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\json\i18n-notification\sv\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\json\i18n-notification-shared\sv\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\json\i18n-tokenized-card\id\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\json\i18n-tokenized-card\zh-Hans\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\Notification\notification_fast.html msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\wallet-icon.svg msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\bnpl\bnpl.html msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\driver-signature.txt msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\json\i18n-ec\el\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\json\i18n-ec\fr\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\json\i18n-ec\pl\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\json\i18n-mobile-hub\zh-Hant\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\json\i18n-notification\zh-Hant\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\Mini-Wallet\mini-wallet.html msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\Wallet-BuyNow\wallet-buynow.bundle.js msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\wallet.bundle.js msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\wallet_checkout_autofill_driver.js msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_232064241\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\app-setup.js msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\json\i18n-ec\fr-CA\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\json\i18n-hub\th\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\json\i18n-notification\ja\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\json\i18n-notification-shared\ja\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\json\i18n-shared-components\hu\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\json\i18n-tokenized-card\ar\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_232064241\Part-DE msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\json\i18n-hub\sv\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\json\i18n-mobile-hub\nl\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_232064241\adblock_snippet.js msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\json\i18n-ec\hu\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\json\i18n-hub\id\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\json\i18n-notification\de\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\json\i18n-notification-shared\zh-Hans\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\Wallet-Checkout\wallet-drawer.bundle.js.LICENSE.txt msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\wallet-webui-708.de49febeeb0e9c77883f.chunk.js msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\json\i18n-hub\it\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\json\i18n-shared-components\zh-Hant\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\json\wallet\wallet-eligibile-aad-users.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\manifest.webapp.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\json\i18n-notification\ko\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\json\i18n-ec\ko\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\json\i18n-hub\fi\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_232064241\Part-NL msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_232064241\Part-IT msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\json\i18n-ec\es\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\json\i18n-mobile-hub\sv\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\json\i18n-notification-shared\fi\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\bnpl\bnpl.bundle.js msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\crypto.bundle.js msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\json\i18n-ec\id\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\json\i18n-hub\ar\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\json\i18n-notification-shared\pt-PT\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\json\i18n-shared-components\fr-CA\strings.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\load-hub-i18n.bundle.js msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\Wallet-Checkout\wallet-drawer.html msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\hub-signature.txt msedge.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2120 msedge.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe - Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\ msedge.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{9CDFFC66-F8E2-4756-9168-C8DFB57A1B5F} msedge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ msedge.exe - Suspicious behavior: EnumeratesProcesses 52 IoCs
pid Process 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe 748 msedge.exe 748 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe Token: SeRestorePrivilege 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe 3588 msedge.exe - Suspicious use of WriteProcessMemory 34 IoCs
description pid Process procid_target PID 4184 wrote to memory of 3588 4184 2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe 85 PID 3588 wrote to memory of 5404 3588 msedge.exe 86 PID 3588 wrote to memory of 3736 3588 msedge.exe 87 PID 3588 wrote to memory of 2120 3588 msedge.exe 89 PID 3588 wrote to memory of 3736 3588 msedge.exe 87 PID 3588 wrote to memory of 3736 3588 msedge.exe 87 PID 3588 wrote to memory of 7092 3588 msedge.exe 90 PID 3588 wrote to memory of 7092 3588 msedge.exe 90 PID 3588 wrote to memory of 1812 3588 msedge.exe 91 PID 3588 wrote to memory of 3816 3588 msedge.exe 92 PID 3588 wrote to memory of 1812 3588 msedge.exe 91 PID 3588 wrote to memory of 1812 3588 msedge.exe 91 PID 3588 wrote to memory of 3816 3588 msedge.exe 92 PID 3588 wrote to memory of 3816 3588 msedge.exe 92 PID 3588 wrote to memory of 6584 3588 msedge.exe 94 PID 3588 wrote to memory of 6584 3588 msedge.exe 94 PID 3588 wrote to memory of 6820 3588 msedge.exe 95 PID 3588 wrote to memory of 6820 3588 msedge.exe 95 PID 3588 wrote to memory of 4856 3588 msedge.exe 96 PID 3588 wrote to memory of 2912 3588 msedge.exe 97 PID 3588 wrote to memory of 4856 3588 msedge.exe 96 PID 3588 wrote to memory of 2912 3588 msedge.exe 97 PID 3588 wrote to memory of 2912 3588 msedge.exe 97 PID 3588 wrote to memory of 360 3588 msedge.exe 99 PID 3588 wrote to memory of 1412 3588 msedge.exe 103 PID 3588 wrote to memory of 5644 3588 msedge.exe 104 PID 3588 wrote to memory of 1988 3588 msedge.exe 105 PID 3588 wrote to memory of 7016 3588 msedge.exe 106 PID 3588 wrote to memory of 7016 3588 msedge.exe 106 PID 3588 wrote to memory of 5588 3588 msedge.exe 109 PID 3588 wrote to memory of 5588 3588 msedge.exe 109 PID 3588 wrote to memory of 748 3588 msedge.exe 110 PID 3588 wrote to memory of 2488 3588 msedge.exe 111 PID 3588 wrote to memory of 2488 3588 msedge.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-10_4309afe85c1f2e0ccfcc0d4ceee6a1bb_coinminer_darkgate_elex_glassworm_rhadamanthys_stop.exe"1⤵
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://down.360safe.com/setupbeta.exe2⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffb88b1c188,0x7ffb88b1c194,0x7ffb88b1c1a03⤵PID:5404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,13540376297350020915,10207491644863564626,262144 --field-trial-handle=2288,i,2648014809095487156,13059170005941363000,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:23⤵PID:3736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,9808043668464545692,8178429339090931080,524288 --field-trial-handle=2288,i,2648014809095487156,13059170005941363000,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:113⤵
- Downloads MZ/PE file
- System Time Discovery
PID:2120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2544,i,10550028462497591491,6767585421116189231,524288 --field-trial-handle=2288,i,2648014809095487156,13059170005941363000,262144 --variations-seed-version --mojo-platform-channel-handle=3188 /prefetch:133⤵PID:7092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,8619356373732136313,9868163750935323157,2097152 --field-trial-handle=2288,i,2648014809095487156,13059170005941363000,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:13⤵PID:1812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3528,i,4093669801782561229,14512240394941192452,2097152 --field-trial-handle=2288,i,2648014809095487156,13059170005941363000,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:13⤵PID:3816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,14191596642848521269,12950910106425179310,524288 --field-trial-handle=2288,i,2648014809095487156,13059170005941363000,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:143⤵PID:6584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,3630758417631380271,11819149663257472572,524288 --field-trial-handle=2288,i,2648014809095487156,13059170005941363000,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:143⤵PID:6820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,12816073467375188540,17286857366986771295,524288 --field-trial-handle=2288,i,2648014809095487156,13059170005941363000,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:143⤵PID:4856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5812,i,12974664450190475688,2363925903165351031,2097152 --field-trial-handle=2288,i,2648014809095487156,13059170005941363000,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:13⤵PID:2912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,9424059616982041369,1647707162446898868,524288 --field-trial-handle=2288,i,2648014809095487156,13059170005941363000,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:143⤵PID:4288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,9424059616982041369,1647707162446898868,524288 --field-trial-handle=2288,i,2648014809095487156,13059170005941363000,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:143⤵PID:360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,4492631508882339287,15320262479064563647,524288 --field-trial-handle=2288,i,2648014809095487156,13059170005941363000,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:143⤵PID:1412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,9732839513062101836,17393073823952352451,524288 --field-trial-handle=2288,i,2648014809095487156,13059170005941363000,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:143⤵PID:5644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,10219680266627114809,1634755300520691855,524288 --field-trial-handle=2288,i,2648014809095487156,13059170005941363000,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:143⤵PID:1988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,16418593505056713635,5135964697868533572,524288 --field-trial-handle=2288,i,2648014809095487156,13059170005941363000,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:143⤵PID:7016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,7844260813178699449,5774543588505844884,524288 --field-trial-handle=2288,i,2648014809095487156,13059170005941363000,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:143⤵PID:5588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6680,i,10337827194914982529,6731135849697431775,262144 --field-trial-handle=2288,i,2648014809095487156,13059170005941363000,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:103⤵
- Suspicious behavior: EnumeratesProcesses
PID:748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,1527745382789376155,18118822140470244567,524288 --field-trial-handle=2288,i,2648014809095487156,13059170005941363000,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:143⤵PID:2488
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:2248
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:2416
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵PID:6932
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\24495088-8d16-4874-a693-a7e44a522674.tmp
- Size 28KB
- SHA256 42c260fed314ecfe5137943508c1a958d9a529a069079c66c5fd445384ee77f8
- MD5 19ff0790a523465b6e3b176c4ed99cd3
- SHA1 53e6d9697faecdaf3c69708e3942b129c34fa109
- SHA512 2bb7c8b7ae14f38fb7654c105d644bd536e8cd5eee7dc1c9e3091b5d258932035aba94f569bd79af407bc01cbd95cae4195e0fbc02dc7b370172ebf7798026a4
- SSDEEP 384:nviF1tNn/s3n9Sf8NLN8TUNTUlIR8PvuTAcREqfbYG8oqGqrblTOObjI9G6w7AUg:6F1j+9GQNwg6urUG8DGURT29MC
- TLSH T1FAD25B36D865CEB7ECEB4F99B74A7A96DEE012A3848C59C4D6C95E4C00C72DD070BC1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
- MD5 8a26ea5cde92773cb558eb116e113216
- SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
- SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
- TLSH T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
- MD5 00fe8112e1beaff1b09c3e772b0b70e6
- SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
- SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
- TLSH T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 92a973fa8f43e6bbe56af5b1d6fa5d7cdf55bfe802df730198b1f45fdd812bf4
- MD5 3be0c11962ee216ef2908c1a909de89d
- SHA1 6735c8bfdbf3433111a55484b7523759d3a4efe2
- SHA512 20b2f448310d71aed54df599452395c476aa73f812c1412148b715f1a413b7863acba1561219bd93602706064257343b8bc6e84fda74449055e5fc44743b54c8
- TLSH T151E02BA7C961BC376AFD1B1860580687EB50131B3B41984B3B3C835C4FF46374686C5C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
- Size 106KB
- SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
- MD5 25dca813dd764f2197142ef84bc5ce66
- SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
- SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
- SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
- TLSH T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 b081df024a98ce6755a62d15803c15c68c60aba0926ae0dcbf3a7cae84cc7d96
- MD5 e8621a40210ed644c8337e68a393ddf4
- SHA1 8f1cc07211862be9422445f00d811d79c307ba47
- SHA512 4261332ea2406655d8be82b925ced8c363c7e687b3b93db2b29b97173edb51f9d360efe98b6c628e5e639ad56a54b32b8412f3b2403c0220ef0ff289d74e338a
- TLSH T14741DFF783F4866EC91196F0AA18BE2FCE1C0515432C3D6AC9E0AE1B93E3471E141A5F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
- Size 40B
- SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
- MD5 20d4b8fa017a12a108c87f540836e250
- SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
- SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 15KB
- SHA256 daf0e513dc5e2b52b15ca61438904d10500452793bac3c3ec2b53547399d4a88
- MD5 7c60a2c6708ae73de8768700ac8e74b2
- SHA1 74595356322596ec8a83e4b571b6fd83a3459a2f
- SHA512 d011a003ab4b1e1736e360602c27746f31d9d8ec9692854249267c897a647fc33935834d861a412627aba658b6469b274a3b575936d2c71ed5913b0d65f3a201
- SSDEEP 384:sxRQlFN/fQsqgDN/RIpbw/5IWmgsGQ1jQ:s8bN/f2EWi/5IWmgsGQy
- TLSH T1DE62E9156A289D7BCCDBD219FA557F93D6F85163A1905E44ABFCCB0C04EA6EC210382F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 15KB
- SHA256 4ec53dcb5ddf80bb8ef810a88b6e67557f973184756e268eb4587e6e897b2bf8
- MD5 0be5f9f5bfee9aeed7e0206692ba54d3
- SHA1 6b29ad1400d3a6f6f6ebae4016f50c28b4c88572
- SHA512 cd6d06fe3517e00faeba820d65e0499df09af12e2953491f81a58fd8600a3ad53be60d10f116d0f62ec3c31ec56902f12c883f3212847727c9b2aa5b946aa76a
- SSDEEP 384:sxRQlqjN/fQsqgDN/RIpbw/5IWmgsGQ1Kky:s80jN/f2EWi/5IWmgsGQvy
- TLSH T16C72E9156A289D7BCCDBD219FA957F93D6F8116391901E44ABFCCB0C04EA6EC211381F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 32KB
- SHA256 72d99b90d9eae481e1e2da2749eb154370d7ea74e67d45f468d2b26f93206c3c
- MD5 124e92aa1658506c1cb8f41edd19bffc
- SHA1 64b5902d669411c45271027f6f262e6728ccb7d3
- SHA512 c6787caf1ee18bdf0a089398f8adb1f920e8503d79ec657882d58c30d744cbbbfc7311f9350be0e792f773205bcc6d09bc3cfa366d679ede54cab7ce4cb99403
- SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDobbDwzroi4w:Ob4YZnE7yTWg1NfwBu1jasobHwANw
- TLSH T11CE2FC3B280CCB7E4F804ADDEC29BD9A6DA801CF5AD8C95447FA850C03C6BEB55165DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 23KB
- SHA256 6bdc9316f3fb23f2dcbd5dcedd8c57f366f3481407569e3aa876f40f9e9f6041
- MD5 1ccb178138bd76c54443d8889899095f
- SHA1 9b04c9d6b71db0981a6eda4ee3b131c0495b28ea
- SHA512 a82af6badc210f081478da4d31416c08854be1ac76b35d7040a22afac8414d7f79d9a8565104bffb426c40a93a0cf28e4b0c13236004fe5ed8cc6a9f85b6b806
- SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9h7e:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRR
- TLSH T1F9B24A51713F4280383EB91C91B9981ED6C2B4A37419E52F7BA801A65F67E039DFE8CD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 26KB
- SHA256 b45ef0e3bc936fda5a04b05e5ee26fd529d65d9345a2776058d8c7eb2412c8f4
- MD5 90b7261bc87ea35efc374182ba58fc81
- SHA1 9e3b91125e44dbae07bde6f41a658ba3eb260ba3
- SHA512 e97a38e3082f8fb22df649a75a9fa9983084017c3546d15670b25fe767b466e1f09b3684d27dc3787a11fa4e49ebeb147914fff92a56827fdfea69d98b93bb85
- SSDEEP 384:nhiF1tNn/s3n9Sn8Ngc8TUNTUlIRzPvuTu5REqfbYG8oqHLgOObjI9G6w7aijh83:IF1j+9SXcwgJuQUG8Drg29MaWa
- TLSH T1CFC25A36DC55CEB7ECE64F98B74A7A56EEE0126385D85AC4DAD81E4C00C71ED4307C2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 28KB
- SHA256 378f6d2430c1f2793c8407d990f6693ec9553ff347584f923d5ba756c7b8ba08
- MD5 356c651176aa98b9771a5eda815d5555
- SHA1 e1e97dfda81bfd76b1e0b5881fdec663f2fdc6da
- SHA512 24f82b7c2336a1c0ed1316f4d7e3c499ab9680429117933f3661300d3cf90eb3c939951f683cfb872022d12f5ac4a0a182cf3efc8d52a28af728bd8bca5d5772
- SSDEEP 384:nHiF1tNn/s3n9SB8NLN8TUNTUlIRGPvuTCcREqfbYG8oqGqr6BTOObjI9G6w7AU+:CF1j+9EQNwg8uZUG8DGUMT29M0
- TLSH T132D25C32D855CEB7ECEB4F99B75A3A96DEE012A3849C49C4D6C95E0C00C76DD070BC1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 2KB
- SHA256 870e4630dbaa1b821c9664c9e707d4acce883f9f50cd3a4a24545baf91a2f4ee
- MD5 0bc827f41af0e2e75216e24e75223653
- SHA1 086ebafb29d1c7a260c08f7373f58ad27a07c3b1
- SHA512 3d8e769d49c5a4e4e48bdd7f142366ca40fdeb1f5b124849a57a75142dea9ecebabdbf27871dede327647cdba87e48196953a083d4106db3abd76084ad83331b
- TLSH T18D512CE08C381AD1D4BD0E7EB04B78EC95E8D726F490343D6858EA985A7A75D208083F
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\Mini-Wallet\miniwallet.bundle.js.LICENSE.txt
- Size 551B
- SHA256 38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179
- MD5 7bf61e84e614585030a26b0b148f4d79
- SHA1 c4ffbc5c6aa599e578d3f5524a59a99228eea400
- SHA512 ca5f2d3a4f200371927c265b9fb91b8bcd0fbad711559f796f77b695b9038638f763a040024ed185e67be3a7b58fab22a6f8114e73fdbd1cccdda6ef94ff88f3
- TLSH T108F08B5A31E12673416285A1270B52DE7F0C10BDB0AF39779444C3386C348EE82D0EE1
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\Notification\notification.bundle.js.LICENSE.txt
- Size 1KB
- SHA256 363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831
- MD5 8595bdd96ab7d24cc60eb749ce1b8b82
- SHA1 3b612cc3d05e372c5ac91124f3756bbf099b378d
- SHA512 555c0c384b6fcfc2311b47c0b07f8e34243de528cf1891e74546b6f4cda338d75c2e2392827372dc39e668ed4c2fd1a02112d8136d2364f9cab9ee4fa1bd87f5
- TLSH T1A2313A5B32F53673416245A1670B52DEBF0C24AEB56F38B79495C3387C388ED82D1DA1
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3588_2086856629\json\i18n-tokenized-card\fr\strings.json
- Size 2KB
- SHA256 c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5
- MD5 cd247582beb274ca64f720aa588ffbc0
- SHA1 4aaeef0905e67b490d4a9508ed5d4a406263ed9c
- SHA512 bf8fa4bd7c84038fae9eddb483ae4a31d847d5d47b408b3ea84d46d564f15dfc2bae6256eac4a852dd1c4ad8e58bc542e3df30396be05f30ed07e489ebe52895
- TLSH T17251EE3D88F4489B60C7921B6B1142D7C9704E36D704F3848A63828A035BDEFB0BF69D
- MD5 SHA1 SHA512 TLSH