Analysis
- max time kernel
149s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/07/2026, 14:01
Behavioral task
behavioral1
Sample
2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 11.7MB
- Sample260711-rbq3vsd13w
- SHA256 abe8db057f45f1c30679e185dd87d309b7ffb22960e4853f4b406d06148d367f
- MD5 02d941f496df812e776882035f1bfadf
- SHA1 fc8907e0f1f91ad917714c670dff4f003831cb4f
- SHA512 dc55329f4577e9a9109b9916bec234929f3c45cbff946a42f0c9cb48d9c3945a2b26aee5daaa822619f0ede11d6230da70ba6ae96706684c765e6434bb1f9224
- SSDEEP 196608:ski9XwgwAMtPdf5P7qAdacItKmd0FTfma:j+Ajxh5OO7qQl
- TLSH T139C68D13B2E00466E1AA9139CE61963597B57C3A4BF1D2DF3240B6D91E73BC07A3A713
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Futurax 3 IoCs
resource yara_rule behavioral2/memory/1164-0-0x0000000000400000-0x0000000000413000-memory.dmp family_futurax behavioral2/files/0x000f00000001c569-5.dat family_futurax behavioral2/memory/1164-288-0x0000000000400000-0x0000000000413000-memory.dmp family_futurax - Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x000f00000001c569-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x000f00000001c569-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Detects executables packed with MEW 3 IoCs
resource yara_rule behavioral2/memory/1164-0-0x0000000000400000-0x0000000000413000-memory.dmp INDICATOR_EXE_Packed_MEW behavioral2/files/0x000f00000001c569-5.dat INDICATOR_EXE_Packed_MEW behavioral2/memory/1164-288-0x0000000000400000-0x0000000000413000-memory.dmp INDICATOR_EXE_Packed_MEW - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ati display driver = "ÔN@" 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\RMActivate.exe 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\Dism.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\System32\DriverStore\FileRepository\kdnic.inf_amd64_a9d04a55194853d2\kdnicctrl.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\dfrgui.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\cacls.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\cmdkey.exe 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\reg.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\Robocopy.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\wusa.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\sethc.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\certreq.exe 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\dllhost.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\driverquery.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\finger.exe 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\perfmon.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\PkgMgr.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\tasklist.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\System32\DriverStore\FileRepository\kdnic.inf_amd64_a9d04a55194853d2\kdnicctrl.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\mmgaserver.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\mode.com 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\net.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\printui.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\tasklist.exe 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\w32tm.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\bthudtask.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\comp.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\convert.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\dialer.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\F12\IEChooser.exe 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\lodctr.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\sc.exe 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\AtBroker.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\iscsicli.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\isoburn.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\xcopy.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\diskperf.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\msdt.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\msdt.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\openfiles.exe 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\taskkill.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\gpscript.exe 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\calc.exe 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\dfrgui.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\net.exe 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\SyncHost.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\verclsid.exe 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\mfpmp.exe 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\ntprint.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Windows Defender\MpCmdRun.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Media Player\setup_wm.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Media Player\setup_wm.exe 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Windows Mail\wab.exe 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaw.exe 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\7-Zip\7zG.exe 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Media Player\wmplayer.exe 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\WindowsBackupClient.exe 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..m-service-migration_31bf3856ad364e35_10.0.26100.1742_none_32a8c94cc5f2eef2\r\ClipUp.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.26100.1742_none_200d0ee10b67fc30\nvspinfo.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.26100.1150_none_160ad4e2bcc0210f\browserexport.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..teelevatedinstaller_31bf3856ad364e35_10.0.26100.1150_none_21762269bb195f5b\r\WindowsUpdateElevatedInstaller.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.26100.1_none_4b983a10daa468ad\odbcad32.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1000_none_5f95cc5803dfafcd\r\mofcomp.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-aarsvc_31bf3856ad364e35_10.0.26100.1591_none_feafa9b0555ef776\agentactivationruntimestarter.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_netfx4-applaunch_exe_b03f5f7f11d50a3a_4.0.15912.0_none_aa82bd90bcd50b03\AppLaunch.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..sionagent-uachelper_31bf3856ad364e35_10.0.26100.1_none_c2022b2202ac5e56\RdpSaUacHelper.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ktmutil_31bf3856ad364e35_10.0.26100.1150_none_24714894b112c0f3\r\ktmutil.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..agespaces-spaceutil_31bf3856ad364e35_10.0.26100.1591_none_782468f07f32b467\r\spaceutil.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_wpf-xamlviewer_31bf3856ad364e35_10.0.26100.1_none_5301f4e1e5797d14\XamlViewer_v0300.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-servicing_31bf3856ad364e35_10.0.26100.1150_none_c1fbd1a9557e5b13\r\bfsvc.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\x86_netfx4-vbc_exe_b03f5f7f11d50a3a_4.0.15912.0_none_e07e7d7d170e8df4\vbc.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_addinprocess32_b77a5c561934e089_10.0.26100.1_none_7e03589d55737e66\AddInProcess32.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audit-component_31bf3856ad364e35_10.0.26100.1_none_a3abe7a4df6b292a\AuditShD.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edge-microsoftedgecp_31bf3856ad364e35_10.0.26100.1150_none_5d1d8fd6c1063afd\MicrosoftEdgeCP.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edp-notify_31bf3856ad364e35_10.0.26100.1591_none_bc8d33c5efdd20ef\edpnotify.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-more_31bf3856ad364e35_10.0.26100.1_none_a94df8cb819b49c2\more.com_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.26100.1591_none_421e63a4855b894f\resmon.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.26100.1742_none_fcf4914266c3a69d\CustomInstallExec.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ldifde_31bf3856ad364e35_10.0.26100.1150_none_bcce913ab8bc643d\ldifde.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_10.0.26100.1591_none_c76d94b08b6db4ab\r\printfilterpipelinesvc.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.26100.1591_none_9e1d25f83a6fdbc2\r\unlodctr.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip_31bf3856ad364e35_10.0.26100.1_none_68cde88f2c470738\netiougc.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_bsdtar_31bf3856ad364e35_10.0.26100.1150_none_f2155cb81beac176\tar.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-eduprintprov_31bf3856ad364e35_10.0.26100.1150_none_4d28a605d2d4d62b\r\EduPrintProv.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..tnet-mua-hostserver_31bf3856ad364e35_10.0.26100.1150_none_6cd729c157564f7c\WinRTNetMUAHostServer.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_a5031b637767a4e7\poqexec.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1591_none_4aa2580f59a05075\r\wuauclt.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wusa_31bf3856ad364e35_10.0.26100.1_none_b448e42fb58a37ac\wusa.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ng-server-isolation_31bf3856ad364e35_10.0.26100.1591_none_386f0e150ea90546\PrintIsolationHost.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_netfx-mscorsvw_exe_b03f5f7f11d50a3a_10.0.26100.1_none_7c88976e8785ad0a\mscorsvw.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_wcf-servicemodelreg_b03f5f7f11d50a3a_10.0.26100.1_none_10dfbabc1234526e\ServiceModelReg.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.26100.1591_none_7e19f7088f522c23\r\rundll32.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-htmlhelp_31bf3856ad364e35_10.0.26100.1591_none_6415f1d934c35258\r\hh.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-csp_31bf3856ad364e35_10.0.26100.1591_none_83cfa386bbdf1361\hvsievaluator.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sensors-runtimebroker_31bf3856ad364e35_10.0.26100.1591_none_4483428c4f7fb3a1\SensorRuntimeBroker.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-workspaceruntime_31bf3856ad364e35_10.0.26100.1150_none_c24c8b338d2c21f3\wksprt.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mapi_31bf3856ad364e35_10.0.26100.1591_none_5161e6c7fe274864\fixmapi.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\x86_microsoft-windows-sxs_31bf3856ad364e35_10.0.26100.1_none_4f21a8f907d2e489\sxstrace.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1150_none_553b538bcf828876\mofcomp.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-pnp-drvinst_31bf3856ad364e35_10.0.26100.1591_none_f11dd8b719f1a6f5\r\drvinst.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nbtstat_31bf3856ad364e35_10.0.26100.1150_none_39f7d4e8ce48dadd\nbtstat.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-thumbexthost_31bf3856ad364e35_10.0.26100.1150_none_8c544950ed549bc8\ThumbnailExtractionHost.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userdeviceregistration_31bf3856ad364e35_10.0.26100.1591_none_b519370a5498ebc4\dsregcmd.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_netfx4-ngentask_exe_b03f5f7f11d50a3a_4.0.15912.0_none_d5e7146d665097c0\ngentask.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_b184dc3c337d380b\r\wmpconfig.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.26100.1_none_620ce84c3dbaadff\fsquirt.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.26100.1150_none_e04006fcf72e00e6\ShellLauncherConfig.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.26100.1591_none_ffa10fa7b29d4d78\r\hvsiproxyapp.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_a5031b637767a4e7\TiWorker.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wimgapi_31bf3856ad364e35_10.0.26100.1150_none_24e2f2e0c4c87239\r\wimserv.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_msbuild_b03f5f7f11d50a3a_3.5.26100.1_none_97b37ed8879d1c57\MSBuild.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-edge-webview_31bf3856ad364e35_10.0.26100.1_none_8fe1c356f34a19ca\show_third_party_software_licenses.bat- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.26100.1591_none_2204fa419ae7b594\r\msinfo32.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.26100.1150_none_5404854ee1749b61\shrpubw.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.26100.1591_none_ef25a80363f3d9ea\r\XblGameSaveTask.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.26100.1150_none_db80809a7f5d5459\dsdbutil.exe- 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.26100.1591_none_4593139f0a8d3490\fontdrvhost.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.26100.1591_none_300773bc06dfa2f0\NarratorQuickStart.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.26100.1150_none_5404854ee1749b61\r\shrpubw.exe_ 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2628 msedge.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" IEXPLORE.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134282521025133411" msedge.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{6E2BB91D-5393-4750-B01F-304DB012C99B} msedge.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4952 msedge.exe 4952 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 5148 msedge.exe 5148 msedge.exe 5148 msedge.exe 5148 msedge.exe 5148 msedge.exe 5148 msedge.exe 5148 msedge.exe 5148 msedge.exe 5148 msedge.exe 5148 msedge.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5148 msedge.exe - Suspicious use of WriteProcessMemory 61 IoCs
description pid Process procid_target PID 1164 wrote to memory of 5976 1164 2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe 87 PID 5976 wrote to memory of 5148 5976 IEXPLORE.exe 88 PID 5148 wrote to memory of 3668 5148 msedge.exe 89 PID 5148 wrote to memory of 2628 5148 msedge.exe 90 PID 5148 wrote to memory of 1712 5148 msedge.exe 91 PID 5148 wrote to memory of 1712 5148 msedge.exe 91 PID 5148 wrote to memory of 5828 5148 msedge.exe 92 PID 5148 wrote to memory of 5828 5148 msedge.exe 92 PID 5148 wrote to memory of 5828 5148 msedge.exe 92 PID 5148 wrote to memory of 4388 5148 msedge.exe 94 PID 5148 wrote to memory of 4388 5148 msedge.exe 94 PID 5148 wrote to memory of 4388 5148 msedge.exe 94 PID 5148 wrote to memory of 4840 5148 msedge.exe 95 PID 5148 wrote to memory of 4840 5148 msedge.exe 95 PID 5148 wrote to memory of 4840 5148 msedge.exe 95 PID 5148 wrote to memory of 5772 5148 msedge.exe 96 PID 5148 wrote to memory of 5772 5148 msedge.exe 96 PID 5148 wrote to memory of 5772 5148 msedge.exe 96 PID 5148 wrote to memory of 1268 5148 msedge.exe 97 PID 5148 wrote to memory of 1268 5148 msedge.exe 97 PID 5148 wrote to memory of 1268 5148 msedge.exe 97 PID 5148 wrote to memory of 4664 5148 msedge.exe 98 PID 5148 wrote to memory of 4664 5148 msedge.exe 98 PID 5148 wrote to memory of 2088 5148 msedge.exe 100 PID 5148 wrote to memory of 1456 5148 msedge.exe 101 PID 5148 wrote to memory of 2088 5148 msedge.exe 100 PID 5148 wrote to memory of 1456 5148 msedge.exe 101 PID 5148 wrote to memory of 4576 5148 msedge.exe 103 PID 5148 wrote to memory of 3228 5148 msedge.exe 104 PID 5148 wrote to memory of 3228 5148 msedge.exe 104 PID 5148 wrote to memory of 4320 5148 msedge.exe 107 PID 5148 wrote to memory of 4320 5148 msedge.exe 107 PID 5148 wrote to memory of 4852 5148 msedge.exe 108 PID 5148 wrote to memory of 4852 5148 msedge.exe 108 PID 5148 wrote to memory of 4852 5148 msedge.exe 108 PID 5148 wrote to memory of 3004 5148 msedge.exe 109 PID 5148 wrote to memory of 3004 5148 msedge.exe 109 PID 5148 wrote to memory of 3004 5148 msedge.exe 109 PID 5148 wrote to memory of 2640 5148 msedge.exe 110 PID 5148 wrote to memory of 2640 5148 msedge.exe 110 PID 5148 wrote to memory of 2640 5148 msedge.exe 110 PID 5148 wrote to memory of 956 5148 msedge.exe 112 PID 5148 wrote to memory of 2500 5148 msedge.exe 113 PID 5148 wrote to memory of 4992 5148 msedge.exe 114 PID 5148 wrote to memory of 2624 5148 msedge.exe 115 PID 5148 wrote to memory of 2624 5148 msedge.exe 115 PID 5148 wrote to memory of 2624 5148 msedge.exe 115 PID 5148 wrote to memory of 4608 5148 msedge.exe 116 PID 5148 wrote to memory of 4608 5148 msedge.exe 116 PID 5148 wrote to memory of 4320 5148 msedge.exe 120 PID 5148 wrote to memory of 4320 5148 msedge.exe 120 PID 5148 wrote to memory of 2460 5148 msedge.exe 121 PID 5148 wrote to memory of 2460 5148 msedge.exe 121 PID 5148 wrote to memory of 5088 5148 msedge.exe 122 PID 5148 wrote to memory of 5088 5148 msedge.exe 122 PID 5148 wrote to memory of 4952 5148 msedge.exe 123 PID 5148 wrote to memory of 4288 5148 msedge.exe 124 PID 5148 wrote to memory of 4288 5148 msedge.exe 124 PID 5148 wrote to memory of 4288 5148 msedge.exe 124 PID 5148 wrote to memory of 3696 5148 msedge.exe 125 PID 5148 wrote to memory of 3696 5148 msedge.exe 125
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-11_02d941f496df812e776882035f1bfadf_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Program Files\Internet Explorer\IEXPLORE.exe"C:\Program Files\Internet Explorer\IEXPLORE" 212.33.237.86/images/1/report.php2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://212.33.237.86/images/1/report.php"3⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5148 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7fff8ba3c188,0x7fff8ba3c194,0x7fff8ba3c1a04⤵PID:3668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,12611937932870789561,16167883215860881280,524288 --field-trial-handle=2520,i,4711614735436251905,16596843210713349502,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:114⤵
- System Time Discovery
PID:2628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2184,i,1368210367581338727,9089577216896294259,524288 --field-trial-handle=2520,i,4711614735436251905,16596843210713349502,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:134⤵PID:1712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,12826582664496423753,13855214794249134582,262144 --field-trial-handle=2520,i,4711614735436251905,16596843210713349502,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:24⤵PID:5828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3516,i,17827563127091858640,7929141552967647239,2097152 --field-trial-handle=2520,i,4711614735436251905,16596843210713349502,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:14⤵PID:4388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3568,i,16774703252723627595,17851961129342596928,2097152 --field-trial-handle=2520,i,4711614735436251905,16596843210713349502,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:14⤵PID:4840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,5792932570644016072,9408776996506157477,2097152 --field-trial-handle=2520,i,4711614735436251905,16596843210713349502,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:14⤵PID:5772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,1473651168087800969,13887770636546336956,2097152 --field-trial-handle=2520,i,4711614735436251905,16596843210713349502,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:94⤵PID:1268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3716,i,7666970384165760432,12825084330748626120,524288 --field-trial-handle=2520,i,4711614735436251905,16596843210713349502,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:144⤵PID:4664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,11640185187048583382,5044930117307340972,524288 --field-trial-handle=2520,i,4711614735436251905,16596843210713349502,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:144⤵PID:2088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,3013481346288113403,8227268955835439773,524288 --field-trial-handle=2520,i,4711614735436251905,16596843210713349502,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:144⤵PID:1456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,14718649251433860741,3052409368655755524,524288 --field-trial-handle=2520,i,4711614735436251905,16596843210713349502,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:144⤵PID:2524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,14718649251433860741,3052409368655755524,524288 --field-trial-handle=2520,i,4711614735436251905,16596843210713349502,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:144⤵PID:4576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,14011749354446431851,9973103711560463302,524288 --field-trial-handle=2520,i,4711614735436251905,16596843210713349502,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:144⤵PID:3228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,12616315158995876313,3628591353942083181,524288 --field-trial-handle=2520,i,4711614735436251905,16596843210713349502,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:144⤵PID:4320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6268,i,16211200397206366363,9637502550903572798,2097152 --field-trial-handle=2520,i,4711614735436251905,16596843210713349502,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:14⤵PID:4852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4340,i,3341715767012196256,15078944971214656639,2097152 --field-trial-handle=2520,i,4711614735436251905,16596843210713349502,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14⤵PID:3004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6080,i,2693995418335143956,4406825755651393348,2097152 --field-trial-handle=2520,i,4711614735436251905,16596843210713349502,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14⤵PID:2640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3588,i,7972532142562735272,11646563132868025148,524288 --field-trial-handle=2520,i,4711614735436251905,16596843210713349502,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:144⤵PID:956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6784,i,4720395319079934223,1527829752628168052,524288 --field-trial-handle=2520,i,4711614735436251905,16596843210713349502,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:144⤵PID:2500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6844,i,11416048626634861838,3615313869200674426,524288 --field-trial-handle=2520,i,4711614735436251905,16596843210713349502,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:144⤵PID:4992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5404,i,18431835217776809141,4043236914722834613,2097152 --field-trial-handle=2520,i,4711614735436251905,16596843210713349502,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14⤵PID:2624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,17832440460731750303,14308610166795705423,524288 --field-trial-handle=2520,i,4711614735436251905,16596843210713349502,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:144⤵PID:4608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,15407976644617627492,63812551343550808,524288 --field-trial-handle=2520,i,4711614735436251905,16596843210713349502,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:144⤵PID:4320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2984,i,3233770991552169794,5503212246535611424,524288 --field-trial-handle=2520,i,4711614735436251905,16596843210713349502,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:144⤵PID:2460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6776,i,16107957187328835981,12214827029241077457,524288 --field-trial-handle=2520,i,4711614735436251905,16596843210713349502,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:144⤵PID:5088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6776,i,15477798210064546331,11558714684214006390,262144 --field-trial-handle=2520,i,4711614735436251905,16596843210713349502,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:104⤵
- Suspicious behavior: EnumeratesProcesses
PID:4952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6404,i,9556737969051492794,15685295194811858464,2097152 --field-trial-handle=2520,i,4711614735436251905,16596843210713349502,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14⤵PID:4288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2992,i,6443161168676391869,11719373041001637424,524288 --field-trial-handle=2520,i,4711614735436251905,16596843210713349502,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:144⤵PID:3696
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:2528
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵PID:4432
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 12.6MB
- SHA256 b2b6debc7a381da76b7563a93b850181e4b951d8eaa8fe86a9c172e7926af720
- MD5 68cefd897c5c07248156897568fb503d
- SHA1 5eed08c21a8c8cc4f627e23b1ef4419b8467b561
- SHA512 0de80b669a3b2ebb2746c92b5cc0b051b925924bb082e964491941b65952943dcb261e88336d255b6d3c7bc970224ddba01b7d28eb89a4bb8092236111dde4fa
- SSDEEP 196608:ski9XwgwAMtPdf5P7qAdacItKmd0FTfmQt:j+Ajxh5OO7qQL
- TLSH T136D68D13B2E40566E1AAD139CE619635ABB17C294BF1C2DF3240B6D92E737C07A36713
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
- Size 105KB
- SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
- MD5 8be6e81804d8b903ae07c11b2e53e3d9
- SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
- SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
- SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
- TLSH T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 b53c58762bff2a5723ae446675e8f65fd50818b95383c8f3c7efef01af06e466
- MD5 629a18fe1b7a241215c77a30d7d8d7ee
- SHA1 5e7bd5b514f4e46a4b986c8b89d0025cf81a1f36
- SHA512 04fd58619789dc107f680a57dba3aec42e4bab7c29c0defd7e1b8ca2d078ca4c91317932ff076171bae60d370b28de32c94039c6ab690d5004ddcb857977f38a
- TLSH T182D09BD575146914C5A1303E21D2935392504835601945874051E56D5C5479743FB5AD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 c36ac766a384a109222b8b647d2f5c1c2e6c4672a4a2c6b8a01f6eac0a5df074
- MD5 f9f896b0e6f281d55b1ca3fa3c1ccdcd
- SHA1 db44df3874cd86a961c82d25f3ae2004f249b2df
- SHA512 6b8c8d305c2d7e4a3b5efb6e1967d7db1b1ffdb7979edd315013037da369c923060dae4ef8a7219176aa7e0bc1fa4cb98e48470ea2f569243a95d3301f5a40bd
- TLSH T160D09BD575046A14C5A1303A21D1935392604835741945874051E55D5C5479743FB5BD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 3KB
- SHA256 3b53785e7301e8cb51fbb73a34e404c640c7a8e3f55e4807018af6a60d86d0be
- MD5 993f32eaa63743e4d7b9c9f53155bb6e
- SHA1 7fb207d05e476501e17dba776da6d731ac3d7f45
- SHA512 c04ba7e1bdf18ad6a9e5a670061f102307d658ec0cb56948856af129966083cd42a3230be497a8914c140b954719ca4b3a83b1f6366997c507f4caa5ec3c5c0a
- TLSH T12C6181E4EF2E19F3D32590B753E086D936B0A891B6272EBAC174503F8C46F186C4C453
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5934a3.TMP
- Size 3KB
- SHA256 4af9420f5bc92369ff941fbdbbb6d203018bdac62c9a256ee3797e1733c5f753
- MD5 948f4fd2b79777f7ef16792c05191263
- SHA1 7b3b9057c1d6a4eddd7ad5c314d352e98a311d7c
- SHA512 5b5759ee236da9e423311ab69fdc567cdf6520e913d42d30cd519a5077a1366e3c4e88e74ab968c96001d8f4daac0c424cd28521c32b232dc798ab251cef4120
- TLSH T1F86181E4EF2D19F3D325A0B753E086D936B0A895BA272EBAC170513F9C46F186C8C453
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
- Size 70KB
- SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
- MD5 efe54a870e0f5ff28d7e00036b861065
- SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
- SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
- SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
- TLSH T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
- Size 106KB
- SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
- MD5 25dca813dd764f2197142ef84bc5ce66
- SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
- SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
- SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
- TLSH T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 142dd0396b10db5996bb3e8a7802dc73c763578432feac0cdacbd430bf99d689
- MD5 87ba5d127a3dccb4f97c10348e0e6da5
- SHA1 595feb663730d5237402b77d5e32e22737f9792a
- SHA512 466cdda1fed311d6a8dd96d4c1ea48f9f5c8cca0b5ff3c01e7c43ea12a45e57df7b48261034281dfdd3418795af61f5f7d7c4a311e357544a83c972bb0ef1c5b
- TLSH T1F9217CB3C3E4856E890156F0AA28AE6BCE1D0905832C3D59C5D4EF1B93F3475D10189F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
- Size 40B
- SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
- MD5 20d4b8fa017a12a108c87f540836e250
- SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
- SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 14KB
- SHA256 6d6f219c10a173b91447b52123c4b2e8741e4caed9a2bfcce9ca7d4e505cbf89
- MD5 ed5f01e63db2361357b2d18097c0c42e
- SHA1 192e3059c3a23f240abfe725581b12c6699a04ee
- SHA512 5b5cc5a3fc05bf95ae9d63fcf5cd244a4d8a6b0dfd296c31bfa9ee1d43eaae0383bf543d402b0027426bb08ba0118787be32441565a04266d05b8bb0ad111dd9
- SSDEEP 192:sxRfRuyM/jK1Ml8wC4/fysUQe/Z7llzoA8pMt/te6+WNIYxzJaGVIgtJ:sxRfE84/fysU9h+A/lIuL3
- TLSH T1E052E916AA34597BCCDBD209FA517F93D6F81533E1900E449AFC9B1C44E66EC221382F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 14KB
- SHA256 8d3d8035778f2af60e671192369b1363ebd6ca65500e7830922a80c05136277b
- MD5 f51a48de8b8b220d19c4e0c37d2f1f84
- SHA1 fce8d7e4779d936c997995b028f7474366220674
- SHA512 1a7f8bffb86bb0161cddfe5cc20cabdac39939201fe17387e3bf5f828f0c740b0f8819934924f0dd776831918de3ebbe3ecc0bb1b3567bd0ac2dfefea0815f29
- SSDEEP 192:sxRwRuyM/jK1Ml8wC4/fysAQe/Z7llzoA8pMt/ty6+WNIYxzJaGVIgDBJ:sxRwE84/fysA9h+A/pIuLf
- TLSH T12462F916AA34597BCCDBD209FA517F93D6F81573E2900E44AAFC9B1C44E66DC221382F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 14KB
- SHA256 95ddc9b0be1c52711399801b04534bb36590ea6afe420636ed64c7951c4e21fe
- MD5 ffd28ed9000fdd558ab507189a1c4090
- SHA1 0ae536d804c81184eea3738379e6268b556c0fc4
- SHA512 64a6050e4838e74fc71a73d8365ce5a593850d9116642037a7608b810caffb6414399777bbce8a83831a9f8c1c47be716e26a09ac83e9e09e7d1de5498414331
- SSDEEP 192:sxRwRuyM/jK1Ml8UQiC4/fysAQ//Z7llzoA8pOt/tm6+WNIYx9JaGVIgDzJ:sxRwEqV4/fysA4h+q/tI2Lp
- TLSH T10862E816AA389977CCDBD209FA517F93D6F81572E1900E44AAFC8B0C40E76DD221382F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 32KB
- SHA256 8485487f4c07cf8484f8e352433da3f58236b0cce08de331b458e943a2077a63
- MD5 17f9cf455f8fbe8888c86d027917c37a
- SHA1 88a2693e9e5a2a3caa263e6d1d8d56d0a002d7c5
- SHA512 fb6ead0711406a8d428840c469acdbf9271c7e01f88a53b2c793a464553ea03401b306f5969b9c0f3c9bac2bd57143012d195ff00d130460dc3ae2c8ed5bd0c4
- SSDEEP 768:0xCyDs7pLuL7ijWgbrfM18F1+UoAYDCx9Tuqh0VfUC9xbog/OVRh4rVAEroJqL9h:0xCyDQE7ijWgbrfM1u1jaGh4pAPJqJh
- TLSH T1B5E2DC7B680CCB7E4F404A9DEC297EDAADE802CB96D8CD5447EA480C03C66EB51165DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 5KB
- SHA256 14c99d1f02c4a1ce12e653f6aa0e8525e1ae6f216eae4bf285a699fb8d77a4b9
- MD5 523bb77ffc3536838b1e1ec995b0acc9
- SHA1 5e6fd6dfc0922773acef8decd97d9e4187818797
- SHA512 7fe5e141274044ad1c5d0cdfc5b823ee0a42908893523879d1e809ec9475664b8cbcde266861c640137cc3d8905ec1d99322e91069e7da283b4e87e533a17507
- SSDEEP 48:KccIfKF+cXyRAInKVecV1I9K+wIHyhOIXKTKQ4:KccwKF+OCAwKVeK1GK+wCyO8KTKn
- TLSH T15EC10E52B13A465138BD69198190C627DAC2F077311AA82B7FE855B20F7FF029EBC4DD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\7927a6d4-b6a5-480a-97be-9d9bd26a01a0.tmp
- Size 22KB
- SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
- MD5 f768bcb451a187c18099961c484eef8b
- SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
- SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
- SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
- TLSH T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 38KB
- SHA256 933e142f87b2dc5b99b3f49b0d4b51045809431976ddd40413d3201dc4464a1e
- MD5 2fed19c7c9d87bcef8f337dc863fed92
- SHA1 5fd3a681c021124919aecfad314ddbd8fdac762a
- SHA512 f5dc253a452983abc65085f1a49cfd45c1daf95afbb69402c273b736888c0e9a5829135c045c4d159987a8019a8c3a3895f14ac22c61fe7b6b1a8caa809c6fbe
- SSDEEP 768:rrv+4UNbd03VZckKL2StGjF669yrqUjWiIwwxMtkigU:rbsbK3VpRjF66INWZTMarU
- TLSH T19203BE70A8688AB3C9F6D785F10337C3BFB411A386C50F98DAC8A70D455B4D9274B92B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 38KB
- SHA256 66a2733e9144ab78201e7c33a662b30b397b5ad02f9fad0031c77a6ee82ee16c
- MD5 09a1ae41eb2f632953683a901abb4392
- SHA1 0f5ef6649546b5f76d841eda9fc685bafc379589
- SHA512 d79867f6b46084b8da3806cbe89a1f353973d4825d19bf324fa70c8cbd76033a6f4cb7138d8b251940b46715cb58350261c44ff79ea16a3c089f66c2700a41aa
- SSDEEP 768:arv+4UNbdl3zPkKL2StsjF669yrqUjWiIwwxMRNUiler:absbX3IdjF66INWZTM7UsQ
- TLSH T1A303CE30AC588AB7CCF2D68672433783BFB4509396C50B88CADD670D469B4DD2347A2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 35KB
- SHA256 78755e4e4eb2236611e09e0658e35a028ea8b4e602b8cbcfb98cd04aacfc933a
- MD5 1e1e534f22dd4a39f61bac42ffbcacb7
- SHA1 3b2e98441c46b1460c91cb282f10afa4a75e0a90
- SHA512 4603e8c84341331f4433b887065f06fca43d7c93745df691b05f960fa60a8b16c9058eae03552ba0b92856d3c540f631eaf410880a68cf94c16f8f2873c153c2
- SSDEEP 768:Aj+9O3VMckKL2StGjF669yrqUjWiIwwxMtkb9MA:/9O3VIRjF66INWZTMab+A
- TLSH T16EF2AE70AC654EB388F6D785B21337D6EFB011A7C6C50E88DADCAB0E45875DC274782A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 38KB
- SHA256 3bee4de7bef57d93c5a21d862f88e838dc027fd4720e95917b6c662c29672296
- MD5 ef461d1ba5291af8dfeea9c6cf637fef
- SHA1 cb36145dce582629292e38e7d29e0c66f8ffa3cc
- SHA512 d457254f0d17950878ca877a151fc6e8b229ad93c3675ca3a13b51b29c1dd0337224ef54849ff9a222bf4d2d4782401d0f328290b91b41dcd0745991d743f76d
- SSDEEP 768:9F1j+9v3Xwg8MJwtQnF669yrqUjWiIwwxMtkb9MA:U9v3y6nF66INWZTMab+A
- TLSH T167037B75EC55CABBD9F6CB85B3123786EEE011A3C6C84EC8DAC8AE0D01871DD1747829
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 252B
- SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
- MD5 551baa462724351873ccd655a8b64ea3
- SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
- SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
- TLSH T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 492B
- SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
- MD5 2012d4de563c653f56f62ccbf46db598
- SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
- SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
- TLSH T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 132B
- SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
- MD5 f5a3b29f9a977e23d6ca4eb728238f9f
- SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
- SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
- TLSH T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 372B
- SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
- MD5 2a1939fc3b2926cf2b82fae71c5f6bee
- SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
- SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
- TLSH T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\267b2868-fd9a-49b1-a76c-2ce1aa575cd3.tmp
- Size 13B
- SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
- MD5 2aa9e263ee3796d9ce358460a2451b4c
- SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
- SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5148_1973795947\CRX_INSTALL\content_new.js
- Size 10KB
- SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
- MD5 3de1e7d989c232fc1b58f4e32de15d64
- SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
- SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
- SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
- TLSH T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
- MD5 SHA1 SHA512 SSDEEP TLSH