8487e549d7229591c4c52f4aeff19a4104b3a23a44dad1be27e152c6bc31b311

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/07/2026, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
Size 3.7MB
Sample260711-prphvsct3y
SHA256 8487e549d7229591c4c52f4aeff19a4104b3a23a44dad1be27e152c6bc31b311
MD5 b5e2c9c9c6a795232fac7a2b680db095
SHA1 cde8d5d2c90246eeb8b4ca8d65e240f528b2b1d5
SHA512 c4c42486724599e80552f09d8b9eabe3d638e07d96bb03700a1d73a50699de230bdf15ede93493143b1a6ac99ffba664486eced1429219d43f50379aea521cd7
SSDEEP 49152:4972AlA4roDFpgoB/P7Hi3F1ywWO4HjMPyUXdPB8vb17n8TU6:497plrroDzgoBP7CV1ywodkdPmRb8TR
TLSH
T1EE068D037E8D903ED65D11305B696F759279AD843B201BC37275FE3CEC32391A9A722A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

adware defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 2 IoCs

resource	yara_rule
behavioral1/memory/1864-0-0x0000000000400000-0x00000000007CA000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral1/memory/1864-520-0x0000000000400000-0x00000000007CA000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\it\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\sq\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\as\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\128.png	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_3804_127013750\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_107_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1856165388\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_910306402\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\mk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\fa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\ca\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\ur\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1856165388\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\ml\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1749642670\_locales\hi\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3056	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 25 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download all links with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEGetAll.htm"	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Low Rights	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243"	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download all links with IDM\contexts = "243"	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe"	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3"	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe"	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3"	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm"	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download all links with IDM	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3"	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe"	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134282468655795339"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 19 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe"	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan"	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1"	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Name-Space Handler\http\	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{6F3B2D02-27B1-4B91-BAD9-51F848935BAF}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter"	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Name-Space Handler\ftp\	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User"	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Name-Space Handler\https\	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1572	msedge.exe
1572	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeRestorePrivilege	1864	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1864	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
3804	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1864	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
1864	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
1864	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
1864	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
1864	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
1864	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
1864	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
1864	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
1864	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
1864	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
1864	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
1864	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 3848	1864	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe	88
PID 1864 wrote to memory of 3804	1864	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe	89
PID 3804 wrote to memory of 4980	3804	msedge.exe	90
PID 1864 wrote to memory of 5960	1864	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe	91
PID 1864 wrote to memory of 5456	1864	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe	92
PID 1864 wrote to memory of 3700	1864	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe	93
PID 1864 wrote to memory of 5436	1864	2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe	94
PID 3804 wrote to memory of 3056	3804	msedge.exe	96
PID 3804 wrote to memory of 4080	3804	msedge.exe	97
PID 3804 wrote to memory of 5180	3804	msedge.exe	98
PID 3804 wrote to memory of 4080	3804	msedge.exe	97
PID 3804 wrote to memory of 4080	3804	msedge.exe	97
PID 3804 wrote to memory of 5180	3804	msedge.exe	98
PID 3804 wrote to memory of 3444	3804	msedge.exe	100
PID 3804 wrote to memory of 3444	3804	msedge.exe	100
PID 3804 wrote to memory of 3444	3804	msedge.exe	100
PID 3804 wrote to memory of 1552	3804	msedge.exe	99
PID 3804 wrote to memory of 1552	3804	msedge.exe	99
PID 3804 wrote to memory of 1552	3804	msedge.exe	99
PID 3804 wrote to memory of 1600	3804	msedge.exe	104
PID 3804 wrote to memory of 1600	3804	msedge.exe	104
PID 3804 wrote to memory of 1600	3804	msedge.exe	104
PID 3804 wrote to memory of 2876	3804	msedge.exe	106
PID 3804 wrote to memory of 2876	3804	msedge.exe	106
PID 3804 wrote to memory of 5172	3804	msedge.exe	105
PID 3804 wrote to memory of 5172	3804	msedge.exe	105
PID 3804 wrote to memory of 1352	3804	msedge.exe	108
PID 3804 wrote to memory of 2852	3804	msedge.exe	121
PID 3804 wrote to memory of 3204	3804	msedge.exe	122
PID 3804 wrote to memory of 2312	3804	msedge.exe	123
PID 3804 wrote to memory of 1696	3804	msedge.exe	124
PID 3804 wrote to memory of 1696	3804	msedge.exe	124
PID 3804 wrote to memory of 2728	3804	msedge.exe	125
PID 3804 wrote to memory of 2728	3804	msedge.exe	125
PID 3804 wrote to memory of 3504	3804	msedge.exe	129
PID 3804 wrote to memory of 3504	3804	msedge.exe	129
PID 3804 wrote to memory of 1756	3804	msedge.exe	132
PID 3804 wrote to memory of 1756	3804	msedge.exe	132
PID 3804 wrote to memory of 5780	3804	msedge.exe	134
PID 3804 wrote to memory of 5780	3804	msedge.exe	134
PID 3804 wrote to memory of 5360	3804	msedge.exe	135
PID 3804 wrote to memory of 5360	3804	msedge.exe	135
PID 3804 wrote to memory of 1572	3804	msedge.exe	136

C:\Users\Admin\AppData\Local\Temp\2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_b5e2c9c9c6a795232fac7a2b680db095_elex_emotet_icedid_remcos.exe"
1⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" http://www.internetdownloadmanager.com/welcome.html?v=621b16
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7ffe3fc3c188,0x7ffe3fc3c194,0x7ffe3fc3c1a0
    3⤵
    PID:4980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,9266105785492020689,7130479436592539122,524288 --field-trial-handle=3456,i,6253151638920650075,18006670487715721792,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,9461517703484984609,17031794419231072536,262144 --field-trial-handle=3456,i,6253151638920650075,18006670487715721792,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:2
    3⤵
    PID:4080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2340,i,8623417305895349669,12635819595542853584,524288 --field-trial-handle=3456,i,6253151638920650075,18006670487715721792,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:8
    3⤵
    PID:5180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3084,i,7220821381912796337,2322944724179614525,2097152 --field-trial-handle=3456,i,6253151638920650075,18006670487715721792,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
    3⤵
    PID:1552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3088,i,6706264492773597247,13521900601813928564,2097152 --field-trial-handle=3456,i,6253151638920650075,18006670487715721792,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:1
    3⤵
    PID:3444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4880,i,13333590671897828097,13761957237210782595,2097152 --field-trial-handle=3456,i,6253151638920650075,18006670487715721792,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:1
    3⤵
    PID:1600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3940,i,11839618928918632674,12697480379590189704,524288 --field-trial-handle=3456,i,6253151638920650075,18006670487715721792,262144 --variations-seed-version --mojo-platform-channel-handle=3984 /prefetch:8
    3⤵
    PID:5172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3944,i,1720726619744572773,11139593324400646783,524288 --field-trial-handle=3456,i,6253151638920650075,18006670487715721792,262144 --variations-seed-version --mojo-platform-channel-handle=3948 /prefetch:8
    3⤵
    PID:2876
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,8670493168170163472,6700484690596263169,524288 --field-trial-handle=3456,i,6253151638920650075,18006670487715721792,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:8
    3⤵
    PID:5340
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,8670493168170163472,6700484690596263169,524288 --field-trial-handle=3456,i,6253151638920650075,18006670487715721792,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:8
    3⤵
    PID:1352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,3392287178532708476,6503734842976402454,524288 --field-trial-handle=3456,i,6253151638920650075,18006670487715721792,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
    3⤵
    PID:2852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,2224615983044995172,14086517404158174593,524288 --field-trial-handle=3456,i,6253151638920650075,18006670487715721792,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:8
    3⤵
    PID:3204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,10811739009294659623,14875884754130480480,524288 --field-trial-handle=3456,i,6253151638920650075,18006670487715721792,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:8
    3⤵
    PID:2312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,17578293335735797954,6945163463522408472,524288 --field-trial-handle=3456,i,6253151638920650075,18006670487715721792,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8
    3⤵
    PID:1696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,11187896662466755764,18002946127386420162,524288 --field-trial-handle=3456,i,6253151638920650075,18006670487715721792,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:8
    3⤵
    PID:2728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,16777565281525838072,635400925108483830,524288 --field-trial-handle=3456,i,6253151638920650075,18006670487715721792,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:8
    3⤵
    PID:3504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,15384475856114871721,14885043147865183452,524288 --field-trial-handle=3456,i,6253151638920650075,18006670487715721792,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
    3⤵
    PID:1756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,10079377790585942395,2291703135996569001,524288 --field-trial-handle=3456,i,6253151638920650075,18006670487715721792,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:8
    3⤵
    PID:5780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,1230961023482327753,358815415486121584,524288 --field-trial-handle=3456,i,6253151638920650075,18006670487715721792,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:8
    3⤵
    PID:5360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3956,i,3505125434880806306,14472400301184836162,262144 --field-trial-handle=3456,i,6253151638920650075,18006670487715721792,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1572
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5960
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5456
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3700
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5436

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

llm_user_input_extractor_config.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1539278246\llm_user_input_extractor_config.json
Size 4KB
SHA256 2056ee7ed0e7adb69344c93a024158ee4e2332ecd50d183dbad7595c4d588ed9
MD5 7736ccfaf720ef9b0db919dd01c4bf8c
SHA1 24b48ec2dee093b8e4384ad1e25ad8f12af0831e
SHA512 f044ed3b6fee483d211328df83f26b98dfe47890c05409c65c7f7333fde1fc043cd1c05d18250e8ee8731f355c13b3a0aedc0e60b82a26c42a7f209a69ad4781
SSDEEP 96:a0y3Cmyjw2w61skd7GZrlWqPZ96vOim87Ai:wyOy7k5rx0WVS1
TLSH
T11F91DF3BD8A15C2B00F3B225B87A7642F534A35B27C05C5B7A7C5A1C8FB6D312582F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1539278246\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3804_1856165388\manifest.json
Size 118B
SHA256 9884eab7370008ea0366a3516952304fe3dfc3e4af613a701b140070052ea2fb
MD5 c2eb53757016d742f60dae3f6dedd5dc
SHA1 59e8ee7a18522944c88977476e3b2b37d5eb8b81
SHA512 905ee402639d8ae8988817e1726c97e466676b6b007b8c045179999f034f39855403c97a530bdfe38318b5f1b1fd5fd525d940c04e546ef33a3d0d37fe69c81c
TLSH
T1ACB092B00C0AA03B26C19320ECA066C683F80218E8025B1A088036881F8817880362B6
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3804_910306402\manifest.json
Size 53B
SHA256 b2574db59e08ca01a3df98d2fb2d691981bf8167321f9789caf4e456364a46fe
MD5 8a7fdbc8b7044c1062a9c2ae49afa19f
SHA1 0602a4bc23f1023beb5c2a90235ede1fb8b6df10
SHA512 51584c3507666262b06f6e31da984947d18da8fe44d1b47942a4483b47573596abcabfdb739a894ec18eed6686591916cf60d5999fe3a76f3f2e6d94b328b2c3
TLSH
T1C49002604414951716C10E5065F0B881D391A61995850D5D04451559029546CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b0642b89f8f157a920eeede078999b3ad929ac213664e96f8c83c52433c0ec1b
MD5 1c3035ce603b40f2ea916b73fad79ec2
SHA1 60b7323bbe97acdb1a3b595199e35a205a855d43
SHA512 ab177c128fcb5754ae67a0877f135ed9d04c8561c08d7dddb050c2ee73215c9cedb902396bbc34f6450dc55d2ccf8447a6e38e5eb1e3aaa665f29f7811b0f9cd
TLSH
T1F2E02BA6C821EC2718FD0719A41D5766E74013272680594F3B3C82098FF463745D586C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0aad23b3aaf034576c42a7e77b8d84c2375dd3cccc9fe9a722c013949e18c746
MD5 713ff5d165354752c91786af099e2384
SHA1 3cf3a295e004853baa87c81e8e54fb397dd8c7bc
SHA512 a14c3183b5af8e0be13e2070b45686a8bfa52604aba979f211b54285f2c8a80fa0994e194bc00c3a0646a0673b8f866df74e65b096a0be5dd29c266b698dba2c
TLSH
T13281A23345421E73DB110A33C3D21E14B03BCAFCFB538E96A1C6557596CD752817596E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bc75.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58bc75.TMP
Size 3KB
SHA256 d498ba1be218606a98bc0e2ef7877595e24e6510334177e98b2ef6773378b2c3
MD5 8b5080e7d00c5a38a88a249f61e9e16b
SHA1 038132e2f726d712f9af6457029464f2404cac5d
SHA512 4b28cb68dc774f450bac835a0b564ea82fd0eae04260f2eb5cccad8fbfc72951299cec26e4a88cbd5accbbdd6cfc6a8e027f777b1f738f348f84013770ff12a7
TLSH
T10E81A23345421EB3DB110A33C3D21E14B03BCAFCFB638E9AA1C6557596CD792817596E
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e040cf90d6982a80af3d71c7f17199c524ce297e91e39b574247d9ca09002152
MD5 f761fcae5701c545363eb3d8a38ae464
SHA1 73a72d900a9c0adbdbec7543b5f265592dd4204a
SHA512 310eeaaf7b8ac962a3eb5998893f36fb00cebeba051e680a14b6826b3166796bef0234691459ad7078629f21af9f6c5a25a3e842625b5d8d06603d1a7f235ce9
TLSH
T1E241CFF783F4856E9A0195F0FA18AE1FCE2D0514432C7D9A85E4AF1B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 8d095f0847b7abcd16caa06283fe69ac3fcd9c70a6355cada3f105c8fbab6b85
MD5 8b1e4d329a65a4384786c0834fcd8771
SHA1 019c327e27a8e70b950652d16796cec526ace029
SHA512 2fa939feabb2f8609fce77e20677831d5267dd05bc538439ae9600a7d1198771978cc8839903719c0ea685edb4f06d356bdd754b69100e43221d7e43e3d613e2
SSDEEP 384:sxZOUg/Oqldj/f9DsCAzIKYCaW2Hbd/QQVIx:sGUg/xldj/f9ZAzralHbhQQE
TLSH
T1FA72F9066A349D779DD7D219F645BB93E6F5012292944E84AAFC8F0C01E77ED220783F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 abcb545d92a23c9bbcf06828b444f1d9070e3e3928114c8af8f884956fac2f0d
MD5 44817b8bc9d64f504b9090c9b7d6512e
SHA1 b92f0ef1197601bd8245f254bdcca71f13ac1fcb
SHA512 8b759c1aad0cc7165f5b61f0867034645ca41f1576acb57cd1c38eef1f122ddf1235794f4f59269be7bedaddb6a4724e9d84e360d701999f306fed18e2883945
SSDEEP 384:sxZOUg/O7dj/f9DssQeazIKYCaW2Hbd/AQVjl:sGUg/cdj/f9xQeazralHbhAQL
TLSH
T1DE72F9066A349D779DDBD209F645BF53D6F9012392945E44AAFC8B0C05E7BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 34aeb031b4e0ecb46bf10345ddbf570b7026317e29380836d83de796021072a6
MD5 1d3dd3b6023a89e8ba5b79ac7f1e0a89
SHA1 2ed453fd5037d885f8b3985a18046765f45f821d
SHA512 2c5ab41b159f4b38e592249a0dcdd365c72f458a1fa7a17a0368010c62f78274773070be8e8c569e3ed6e9f84646218d4f6a5910b4e2a2bab29bb5d19624c40d
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXysy10Llj:eY8Od/HEnFhWvFvmXu1ja7t10Lm2Nuhm
TLSH
T1D3F2FB3B6C0CCB7E4F844E9CEC2A7F8A6DE802CB5698895447FA844C02C76EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 e9d2de069d506233647624de2462b73d22ca4b90befb59cb2ce5c945673804ad
MD5 531a604f7b9987df0381c43ab87a482f
SHA1 35d594004e30d284a08643ad4629cb5bb828c9c8
SHA512 84cb4a8be60124a28e55b2ceb88e6a22cb761c30bada0e869c4c8a4bf3b8c20726840e4e631aa9e5d6c7b28ff1fdbd3a58a61bafe775e9903c7e149b8e20fb09
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGi:05ppxnY753RNBvRJJdt7p5J9j6dt
TLSH
T14FB27A5A703E0212397E298CB39596364F4235A37058E4AF7FB814A14F67E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.17\data.txt
Size 149KB
SHA256 fac5ec341b2f4b9c98a8bd7ec852589ee81e4938812666568752f36ae4f115ab
MD5 37f7815ef32ef7a6d94bf74fff24d177
SHA1 7f89ad80f67aad3ff68cbb27b15bc2ec7abe1bee
SHA512 843a7845f7c020a7d111b8dffd1482625fab9eb15afabff99e2cada1533d1a90c33807c208e536b4062cd4356ca9b19ca648f98b8c708d840d5d52378af13e03
SSDEEP 3072:SPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEhRUnf3WzARDcgGfQUX:+X1aI5aZoKzMJ07Nh6n/vDcgMQ+
TLSH
T1CFE3F1148DC44FDDDEA8291C90FD0F2D23A0C6AD857BA5CAE323BD49BFA79045727185
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 e1c90260839ff032ea8d8abacb3c053e1c1e58ff95727b524f8ed06afe827064
MD5 e1e160fc092e4a603a3088d1a3a75f27
SHA1 af9e08f2d4b43504ed92fbecfa45ef5b6ef430a3
SHA512 0c1e4a13add4a1f343a2f3794c49b90462c84f2dd4298b0d884a57b4940d2de85d5d30795e0c3e9af1cc53a6a9351a59a9c113e37932e4b22646fb55ad4b1db7
SSDEEP 768:/GF1j+9+3J5wg4kFr9Ypi0RoG4+AM0em29M0:/t9+3JgAr9YpfRL22+0
TLSH
T196E290F698D78A76E99E4B87A73E2E469EFCD15775880984F7841D0CCC821BFC206825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 6a2626425c18a38187ab17c4de531553a08f6091bbf60c6c7b806cb7a39cd73c
MD5 2b3f012745a57f46ad759cb40fe7b1bb
SHA1 ea67652cc19a35da5b87b0c7e2e9dc592c16c4f3
SHA512 5a301008d40f5820dab84af4f1a21f53c89a8ab513ae4dfa5c128c5e1c255eda88493c1f49002b9f96a8e9aee6401f7ced31c8decfd1f4c64a48cb93cb135749
SSDEEP 384:np+iF9CcmyWCs3sNs8TUNTUlIm2QckCr9l4o4KphiftG4WXGGLpJe4KV8p0nLat0:pVFccps3NwgbkUSo4koG4+p7I8p0nLP
TLSH
T183B25C36EC64CEB7EDE74F99B74A3A03DEE0526785D89ED4DAD85D0C009719D030B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 4e793e96cd80622c6fe9ddd997296523b355725b44d602098d1eb9e42184eaf9
MD5 2f642b369567783549b945a873f7df00
SHA1 617c20996ba7f1c6b9eee0678cc548deaf2f407d
SHA512 08414069979823b5afe2b5b14fff3c43dc6752db2fe446e72c3685b3f266729f3c9e32046cc86cfed65a90c02d581cdc3da1b5878ce65a208068d0837745083a
SSDEEP 768:pPsF1j+913J5wg4kFrDxpi0RoG4+AMUem29M0:J7913JgArDxpfRLW2+0
TLSH
T1F6D24A36E864CEB7EDE74F99B74A3A57EEF012A785C84AC4DAD85D0C01D71AC0307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 7b75dbc2595f01febc00d3f2e8681fa53818669708d546d4220501448c078c71
MD5 8bf3f63db51119ed316e10b5c41c852e
SHA1 0d42e4b7a1742a338902b887bd9381f2d66aa70e
SHA512 87513ce1b5b0a4c853b44af0e5b812d09fe253141b19f69e1a24ccf64f56b86b911f3a4a9bcea1109b3827d8de67a34ec42c46cfe74993db5eae1564b6566843
SSDEEP 768:/sF1j+913J5wg4kFr9xpi0RoG4+AMUem29M0:/7913JgAr9xpfRLW2+0
TLSH
T141D23A36E864CEB7EDE74F99B74A3A57EEF012A785C849C4DAD85D0C01D31AD0307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 aebe710a3ae26d32a7612b343c92ab288cd7001bf295e9dd81076bb666ef1048
MD5 26ef4c4fe780732f88e99da438a61584
SHA1 6ca65f82c70cc8bc70619859db2ca2d85ea2fee0
SHA512 34423077b971fed457386e75fdf8687c7b5847d4d0afa1a364a1bf045536763bf4a6be2bef11d33600cd1a13c4812a8a94aaad62aa1e072ad8755beca1c796aa
SSDEEP 768:pesFccps355wgbkUaVq40KoG4+AMremI8p0nLP:wss35j0VqBKLJI8p0nLP
TLSH
T144C25B36EC64CEB7EDE64F89B74A3A43DEE0526785D889E4DAD81D0D00D71ED130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.7.11.1\typosquatting_list.pb
Size 713KB
SHA256 7c99eba9e3fae4c14308b5d58902e5edd6e11f864ded930c70e625756c916b37
MD5 d5d6de318daa53b466cbd23c49350d5a
SHA1 4cbf25e540962c61b87a9bb26382522e238d1a31
SHA512 9aa19bfc6101cbebc7346d609488b825937c334af3759c994a8f9883787960a360a75183891bf54ceb27421ac85e65c539b2892701e382e49f7e158d3fba65fe
SSDEEP 6144:yDBMg6Kh+9j66p13jbh3dJdTjOIsoAq3o2CZxSQk+PNLemXT1+A8hrI:UBMg6Kh+F66pvNCIBn3o5f9T1+A8hrI
TLSH
T13DF4C6B9DFC00194DB78112D20BE71D8181412A580E9DFEAFE7C855F2BC2AC977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 6c3893077d0d3b2250645d1870370bb1847e8b6b953a2a3cd390dd6a818dd8d5
MD5 72875748e3329b8fe4077703870c3394
SHA1 3dfcf73764df2b70406b792726205b28430f2891
SHA512 b257435e3a32c86a6080d25e34ad7ead50df57c49bb39f8b968b42ec4dd64c160ded01ac090eaa15496925df75692e6dad59ad07ea9cf426f175946900d258e7
TLSH
T1BC4133E15C381AE1D4BD0E7EB4D778FC98E8D62AF5A0347E2858DA944B3DA0D648143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 14f35ec7b58aed84db5865e482d1758b3ab8f73734f321dc1dfe70f8d6c41133
MD5 1e87c35fd0979dc081ee539945000f40
SHA1 7288cd61033108306bf372e20c3809496f3622fc
SHA512 b1d850e81f53efb8feabfffe937863acd33910ecf4c4c7f8bb2ad0323cd78b870a8330a459fee91325b82c0bc79a6d862d81133f717d03fb7345a671671a0a75
TLSH
T1854141D15C381AE2C4BD0EBEB49739FC85E8D725F1A0347D6898EA940B7D94E648143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 515863988c367e2fb6ebc8b877d02cd863f624b7796eddb56364e144028f2925
MD5 71aa552a0816f2b6856812934a68bc9d
SHA1 d7cd41578fd80bf2f9bbc8997f36dabb66958bec
SHA512 ce36feb9184b470904e5ec31b39f2383ed9eadb0d8055525ac1296e3e1f723196eca0d048196e5079c352d1e7e68aecb913f545177a7f12b5d4c61a4fb198061
TLSH
T1024143D15C385AD1C4BD0E7EB49738FC84E8D626F5A0347D6858EA940A2D90D708143F
MD5 SHA1 SHA512 TLSH

Submit Download

f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
Size 152KB
SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
MD5 d2e80cd29c43ea745d16284dc1f58ea6
SHA1 53fe0165f9f303b333be9284865c8a74f3553c0b
SHA512 375fd3e65b12f80b92a63c1cf6f0ace9fe878c1a0cb5179d869c99aad0cfde14715fd1499eab22a04f353e5f292c19d6a5aeccb43ec2ff5cd6878a5226b005ca
SSDEEP 3072:bHVqfst2F+fBXzSKmg3n0OIH1iCylcLMLgaK9enj59Ah8MuBX8Yk17CF:b1qkfBXG801idlcLMLgaOeV9A2XdBkda
TLSH
T1DBE3E13C3EDACD26C21B20F97F287587C54D8F17A10BA50BE14A84015A76B5E17E2DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 9ba64fdf12690bc24af750ffc8e144edc5fda28e40b47c6637e36760d82fc03a
MD5 b0d6f081a0ecbbc24e15755ca2fb45ea
SHA1 92ee094a6b43e98dd7623b28cbb7fcb000238278
SHA512 8252bfe20cf5e10b6bc5333ccffb4a04e1081c086c5d0829e42bfdb5244de2fdc17055e3dda4c6ab82361d61e7c8e22b872e1bdd79d193206eb97be324035628
TLSH
T1A4C02B0F187E08C48C06903AA40D0A5B06E0394020101176847F780000B421CC30096B
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6a37f8b1ec3bc86540b98d8ed54f0abbd310d012f061725a74119c038f9b30d6
MD5 f787c566d067bd2d372656e0965c6b16
SHA1 a4c3902a71926bd522fd6666c75029096b8b7c80
SHA512 f7ed6bb71614902d398315acf888b0886d80729550f5b61bdfb6f1d286396048520c8a397dde081cb62f7da059666cb423a10cf193fedc761e36ea6988fd2ef0
TLSH
T10D41265DB6F91148B3B76E56ABF6A8AE487FB8272E07D45D10010E8F0663A41CC71737
MD5 SHA1 SHA512 TLSH

Submit Download

log_1.log

Path C:\Users\Admin\AppData\Roaming\IDM\DwnlData\Admin\www_internetdownloadmanager_com_1\log_1.log
Size 1KB
SHA256 887e621f82e1a4beee560a789549098d551fa617123cd254c3f9449591fc6f62
MD5 f05398380d26b48997669e4390c04245
SHA1 9f132df461c60390f860545a5130f80fdc1d52f2
SHA512 44d37599375cac1380488a6aadd324f4a6901db7df4ab052a6d38ad1deb0a0f37556392ff3c209315203671ffecf7310517539c2263d4fd262997ec2b90ad8d4
TLSH
T16831430BE27AB0099603A95307E1EC08D13137518F71AB609017833FF8BADC0ECA66CA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1352-188-0x0000027B1C4F0000-0x0000027B1D4F0000-memory.dmp

Download

memory/1864-520-0x0000000000400000-0x00000000007CA000-memory.dmp

Download

memory/1864-0-0x0000000000400000-0x00000000007CA000-memory.dmp

Download