7ebc3e101b7a669774c7e2103727fa78a2c8ed93534f8abbe79946036e17a4a0

Analysis

max time kernel
149s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 01:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_3ddb512dfb05f5fb0eeb14ae0ee6fbf0_akira_amadey_elex_glassworm.exe
Size 5.3MB
Sample260729-btejsattcx
SHA256 7ebc3e101b7a669774c7e2103727fa78a2c8ed93534f8abbe79946036e17a4a0
MD5 3ddb512dfb05f5fb0eeb14ae0ee6fbf0
SHA1 4ec2ad4c0bfa030ed8d012f152ad9aca90d28dce
SHA512 ccaad6757b9647d0a8da9bb11de9d872db6ab8dbfcb4fb5bb4baa44fce197a8502e03962cba2e45359870bb194acaf894fa10d44b93779ab87cb1ca1564676ae
SSDEEP 49152:0FpJBA5+RcleUCcrlUtt7/QiGtBHFrupfnW9uMELKYroNtj85JU6kRgf9UIvP9N0:2vAwRsIlQvVFg5JU6kRgf/Vtvh/Tc
TLSH
T19A46AF82FAC341F6D98B0470302FF33FDB36590A8215CBA7EBE44D61F966321599A25D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access discovery execution spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1372	powershell.exe
6140	powershell.exe
5232	powershell.exe
1492	powershell.exe
1168	powershell.exe

Uses browser remote debugging 2 TTPs 5 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
2688	msedge.exe
5472	msedge.exe
2512	msedge.exe
1788	msedge.exe
4164	msedge.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	2026-07-28_3ddb512dfb05f5fb0eeb14ae0ee6fbf0_akira_amadey_elex_glassworm.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
37	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_3ddb512dfb05f5fb0eeb14ae0ee6fbf0_akira_amadey_elex_glassworm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5892	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
1372	powershell.exe
1492	powershell.exe
1492	powershell.exe
1372	powershell.exe
1372	powershell.exe
1492	powershell.exe
1168	powershell.exe
1168	powershell.exe
1168	powershell.exe
3440	2026-07-28_3ddb512dfb05f5fb0eeb14ae0ee6fbf0_akira_amadey_elex_glassworm.exe
3440	2026-07-28_3ddb512dfb05f5fb0eeb14ae0ee6fbf0_akira_amadey_elex_glassworm.exe
3440	2026-07-28_3ddb512dfb05f5fb0eeb14ae0ee6fbf0_akira_amadey_elex_glassworm.exe
3440	2026-07-28_3ddb512dfb05f5fb0eeb14ae0ee6fbf0_akira_amadey_elex_glassworm.exe
3440	2026-07-28_3ddb512dfb05f5fb0eeb14ae0ee6fbf0_akira_amadey_elex_glassworm.exe
3440	2026-07-28_3ddb512dfb05f5fb0eeb14ae0ee6fbf0_akira_amadey_elex_glassworm.exe
6140	powershell.exe
6140	powershell.exe
6140	powershell.exe
3440	2026-07-28_3ddb512dfb05f5fb0eeb14ae0ee6fbf0_akira_amadey_elex_glassworm.exe
3440	2026-07-28_3ddb512dfb05f5fb0eeb14ae0ee6fbf0_akira_amadey_elex_glassworm.exe
3440	2026-07-28_3ddb512dfb05f5fb0eeb14ae0ee6fbf0_akira_amadey_elex_glassworm.exe
3440	2026-07-28_3ddb512dfb05f5fb0eeb14ae0ee6fbf0_akira_amadey_elex_glassworm.exe
3440	2026-07-28_3ddb512dfb05f5fb0eeb14ae0ee6fbf0_akira_amadey_elex_glassworm.exe
3440	2026-07-28_3ddb512dfb05f5fb0eeb14ae0ee6fbf0_akira_amadey_elex_glassworm.exe
5232	powershell.exe
5232	powershell.exe
5232	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	1372	powershell.exe
Token: SeDebugPrivilege	1492	powershell.exe
Token: SeIncreaseQuotaPrivilege	1372	powershell.exe
Token: SeSecurityPrivilege	1372	powershell.exe
Token: SeTakeOwnershipPrivilege	1372	powershell.exe
Token: SeLoadDriverPrivilege	1372	powershell.exe
Token: SeSystemProfilePrivilege	1372	powershell.exe
Token: SeSystemtimePrivilege	1372	powershell.exe
Token: SeProfSingleProcessPrivilege	1372	powershell.exe
Token: SeIncBasePriorityPrivilege	1372	powershell.exe
Token: SeCreatePagefilePrivilege	1372	powershell.exe
Token: SeBackupPrivilege	1372	powershell.exe
Token: SeRestorePrivilege	1372	powershell.exe
Token: SeShutdownPrivilege	1372	powershell.exe
Token: SeDebugPrivilege	1372	powershell.exe
Token: SeSystemEnvironmentPrivilege	1372	powershell.exe
Token: SeRemoteShutdownPrivilege	1372	powershell.exe
Token: SeUndockPrivilege	1372	powershell.exe
Token: SeManageVolumePrivilege	1372	powershell.exe
Token: 33	1372	powershell.exe
Token: 34	1372	powershell.exe
Token: 35	1372	powershell.exe
Token: 36	1372	powershell.exe
Token: SeDebugPrivilege	1168	powershell.exe
Token: SeDebugPrivilege	6140	powershell.exe
Token: SeDebugPrivilege	5232	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2688	msedge.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3440 wrote to memory of 1372	3440	2026-07-28_3ddb512dfb05f5fb0eeb14ae0ee6fbf0_akira_amadey_elex_glassworm.exe	90
PID 3440 wrote to memory of 1492	3440	2026-07-28_3ddb512dfb05f5fb0eeb14ae0ee6fbf0_akira_amadey_elex_glassworm.exe	93
PID 3440 wrote to memory of 1168	3440	2026-07-28_3ddb512dfb05f5fb0eeb14ae0ee6fbf0_akira_amadey_elex_glassworm.exe	95
PID 3440 wrote to memory of 6140	3440	2026-07-28_3ddb512dfb05f5fb0eeb14ae0ee6fbf0_akira_amadey_elex_glassworm.exe	98
PID 3440 wrote to memory of 2688	3440	2026-07-28_3ddb512dfb05f5fb0eeb14ae0ee6fbf0_akira_amadey_elex_glassworm.exe	100
PID 2688 wrote to memory of 2368	2688	msedge.exe	101
PID 2688 wrote to memory of 1112	2688	msedge.exe	103
PID 2688 wrote to memory of 5892	2688	msedge.exe	104
PID 2688 wrote to memory of 1112	2688	msedge.exe	103
PID 2688 wrote to memory of 1112	2688	msedge.exe	103
PID 2688 wrote to memory of 5096	2688	msedge.exe	105
PID 2688 wrote to memory of 5096	2688	msedge.exe	105
PID 2688 wrote to memory of 2512	2688	msedge.exe	106
PID 2688 wrote to memory of 2512	2688	msedge.exe	106
PID 2688 wrote to memory of 2512	2688	msedge.exe	106
PID 2688 wrote to memory of 5472	2688	msedge.exe	107
PID 2688 wrote to memory of 5472	2688	msedge.exe	107
PID 2688 wrote to memory of 5472	2688	msedge.exe	107
PID 2688 wrote to memory of 4164	2688	msedge.exe	108
PID 2688 wrote to memory of 1788	2688	msedge.exe	109
PID 2688 wrote to memory of 4164	2688	msedge.exe	108
PID 2688 wrote to memory of 4164	2688	msedge.exe	108
PID 2688 wrote to memory of 1788	2688	msedge.exe	109
PID 2688 wrote to memory of 1788	2688	msedge.exe	109
PID 3440 wrote to memory of 5232	3440	2026-07-28_3ddb512dfb05f5fb0eeb14ae0ee6fbf0_akira_amadey_elex_glassworm.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-07-28_3ddb512dfb05f5fb0eeb14ae0ee6fbf0_akira_amadey_elex_glassworm.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_3ddb512dfb05f5fb0eeb14ae0ee6fbf0_akira_amadey_elex_glassworm.exe"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -WindowStyle Hidden -Command "Set-MpPreference -ExclusionPath" C:\
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1372
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -NoLogo -Command "[Console]::OutputEncoding = [System.Text.Encoding]::UTF8; Get-Culture | Select -ExpandProperty DisplayName"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1492
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "[System.Diagnostics.FileVersionInfo]::GetVersionInfo('C:\Program Files\Google\Chrome\Application\chrome.exe').ProductVersion"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1168
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "[System.Diagnostics.FileVersionInfo]::GetVersionInfo('C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe').ProductVersion"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=24240 --new-window --window-position=-2400,-2400 --profile-directory=Default
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x228,0x264,0x268,0x224,0x288,0x7ffc824dc188,0x7ffc824dc194,0x7ffc824dc1a0
    3⤵
    PID:2368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2000,i,3407251704238336456,11499244121921989529,262144 --field-trial-handle=2480,i,8922036204764630631,6966188471356097685,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:2
    3⤵
    PID:1112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2168,i,17954836445533578359,14029099830152641739,524288 --field-trial-handle=2480,i,8922036204764630631,6966188471356097685,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2656,i,12165186308616312338,9626828352536964438,524288 --field-trial-handle=2480,i,8922036204764630631,6966188471356097685,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:13
    3⤵
    PID:5096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=24240 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3640,i,17654848774692807753,438707037794265473,2097152 --field-trial-handle=2480,i,8922036204764630631,6966188471356097685,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=24240 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3644,i,10308449994833558048,8713959620400857852,2097152 --field-trial-handle=2480,i,8922036204764630631,6966188471356097685,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:5472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=24240 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4328,i,7334575066564230373,5449003188769898531,2097152 --field-trial-handle=2480,i,8922036204764630631,6966188471356097685,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:4164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=24240 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4336,i,17932640168410186469,1407038607223260040,2097152 --field-trial-handle=2480,i,8922036204764630631,6966188471356097685,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:9
    3⤵
    - Uses browser remote debugging
    PID:1788
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command "[System.Diagnostics.FileVersionInfo]::GetVersionInfo('C:\Program Files\Mozilla Firefox\firefox.exe').ProductVersion"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5232

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ffe13798c5910685872d371e84c30baa9eefaaa5db1419603eb30d473d7b2e37
MD5 03c111f9396889c77f6d9883c5df333f
SHA1 be65300843096dba92c5695fd35e2dffcbb7eb0a
SHA512 a77dfe3b48fcb72648f1adfafbf0d0fcd4d88690dcf41609a03e1d6b645d1336b6e322931b2205673283b920d20ed0225c6aa320a83a2d3a410771f18d120c19
TLSH
T1B1D09BD079145D78C4C1353231A773155A516435865C46481151F3BACD65141667E59D
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7add6572365d752d8c3a090b9a256c43e3c5ff716f29ed7aa3c53dc57a08ba60
MD5 0da70f521ac5aee3489abf6e3eb4e375
SHA1 0f3cd9919820116ecc86bab93f4712c08485dc56
SHA512 a9cddd04863b2ac842fe4f91265c19a41d8b7442be8f07a91747705beca52c1e1d563e3c46cf68e1b73606695624f13ca69a8246653c2535d0684ced42c37d33
TLSH
T182D09BD479045D78C4C1353231A673155A616435DA5C46481051F3AACD65141667F5AD
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 222c8e9a8608e4fd06548d536b8eabce4d520dcccac23aa667f5c60c12283c42
MD5 0e8f69a4821af00c55bf2d086aeb9657
SHA1 621ea788e187c350d65457947b3b3b4475ae8f01
SHA512 c6a6823ebc76d703a2fd8146f9079c33a0e785536b34b0599a7020a9ad0789e0aa07d0750d9af2a7d85584ff4c6e91025f9b4234f25da206ea27fe68c7ea6d60
TLSH
T12B31BFF7C7F8967D8A0185F4BB043E1BCE2D0855432C3DAAC4E46E1B97E2471D18095E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 769a3eb5e4f91baf54eacfea3aa594d2de7b961d6407012165522c65e4984319
MD5 7905b6971cf61198bbe95dc79cdd5c3c
SHA1 acf6558e10d0cbd5dc41618b784e1aabd29124e8
SHA512 5398f7e446fdc9a685d78a63f9361275c394ac62f781a691c95472931813b62944b8ccd5e47542cfa3f5a783ea346681b06c6b115ca5235e0053866cbf9bde6c
SSDEEP 384:DNrRZyCSDnxTICYMEhIKyll7svbFKfk7:xFZJSDniwyI1l7svbF9
TLSH
T1EC44640A7B747001EDE2D9725CB080771E3CA16E8F22E6815DB654694EB3853A63D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0b2c22dcdba1cd0538fd705ca3ebee9bc31dd97d49c81940fde21a8ad06c7347
MD5 1c1f8dacfbd1cde945ef3bec8dc9d90b
SHA1 906b478a576917b13e88600d9ae97a0539b85dec
SHA512 4371f872c5b61b9817fea5f273527ea15e5ca50b6c79267904cb2cd89810af0aad49c86742e7e860f0a78b62931d0f9ac7fefe62cd54b8c3a8bcb8c8686dc8cd
SSDEEP 768:arv+4UNbdM35LEiJbh3NHXmTWTbc+/WeVH1SvyZ:absb+32IeWn1OEH1dZ
TLSH
T18003BF319CA98F37ADF65788718BBA573EB9016389C40684C9D97B4E428748D170BD3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 17KB
SHA256 c1da08197b1b8adb6ed7a4b1df2d042c4031496ee8db65ac97f3124089616c62
MD5 b6cea62f526d31f2edb1bc70f1858056
SHA1 5b8176289c80c0087a4f79b9ca1a73d83457d8ee
SHA512 2577f50e5263d40671d60de349e7d74d07ee490df848ac2481d1b687eae5acc21bffcb977c176becd32b6f0ac5e02e472bc934e5d07a7d8847ec14502924a029
SSDEEP 384:6SEnGx1i0GW14blyln2U01/+ce3rY2PnZIAEFWQDwlsW8oBlnv5bhNSWVSjVq:OGz6Wihen7s/+pNRIAEWQDO9xbhNhMj8
TLSH
T1AC8296A8217F6DC7D89122B050D602E7FBE4D0899F755158FE27CE2F5C90EB74B60520
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 289e13aca84335efa1d28439fd00c498bfb7e7b4a485526e7af1212bdcd05364
MD5 f17001213e5df6d19153acc53b767580
SHA1 f5c3afb17750c9aa93464cf6ae88b0b911e597a2
SHA512 166ebff1b69e9adf462b6382328f9c90e7178ee2d34bca825ac7fbe2b273237f2faa44c007facbd03e84e5fe74fd15d9da03d9c0ca552f4603a00ff92a067393
SSDEEP 384:+1eBaoT1iBGNy4bV2Ehg0A+WeCqeG2PnOIAXr4B+FWbCIzKWkvYbhNaPwlRteltj:uexZ6GNrBPhg5+3gGIAXrq+9ebbhNaPr
TLSH
T14AA2C578213F6DC7D8D226B010D20AF7FBE4D489DAF651D4AF1BDE2F4C90AB64A60524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 12KB
SHA256 70c3b8b29e517bd23f7e962ae39f830ab1c5746deb619b3da209497d740ec5be
MD5 3cd18784a1cb302b3f7fdb279be0b1e3
SHA1 e609564e4b40492f995cee12df458133f7b5f353
SHA512 b7093f810c7549c2024cab6b2d1894da81cd64d5dab62cb6bd20f6687bd3cfb275aff5169383df4f205f1459ffb66344228c0532bc195c36789ce998883806c8
SSDEEP 384:pSEFGYGWYgjzNi/e7c10UgeXv6P2kMzdCw8KbFHSa+LW6ISN/q:P4zWYgjE+c1n9v6uZCwnHr4LN/q
TLSH
T14A42B614712F5DCBECA261B45085079BEBA4C08F53B252D9AEA7CE2F6C11F798B505F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Edge_Default.txt

Path C:\Users\Admin\AppData\Local\Temp\PxenjyEdtLiz3YntqbuGcT6tL0If2r\History\Edge_Default.txt
Size 64B
SHA256 08a42a41027a52387f840e4d4aca4834588e5a6dedc132c018fa64043eeb79c4
MD5 417eba82a2744cb9b1b80cafdf10b9b6
SHA1 edac2550594bea536f5179a83141360fcc0bca98
SHA512 4fba98ff8cf007903fd8822ad459c83749b3f750258b64a301594b47a4277f77148cd594a2727b290588e35f9bb40ad1d119e9922b4c2d371ec42d5dd1eaa1ab
TLSH
T177A02200E32000C2030C8C28BCAB0008282CB02B2B80002220C00CC0FC08C230300CF3
MD5 SHA1 SHA512 TLSH

Submit Download

screen1.png

Path C:\Users\Admin\AppData\Local\Temp\PxenjyEdtLiz3YntqbuGcT6tL0If2r\screen1.png
Size 671KB
SHA256 19c54591b30f9ff1c1a240b285beada6455c7e2300a104eb8ca980ae5da3f665
MD5 b3a1f790ab721b75133a62cb7e62a667
SHA1 bb3e5b1a17ceed9f583e70f1e8f63350a2b1a34a
SHA512 d31919b7551d75a4c1bbcaecca64067e3aee584a71a251ef91b1449dcbeb27da7e9650988737493cc609adb67229dc91cd56f9b4420c3433c5c96fa7ce55e0e0
SSDEEP 12288:9Q2fmgthlbc6af4G3cqx1vNUoyr2fLKsmKUGueegjIb4bESB:5egz9cZ3c01vNUpGLwK2eJjCSB
TLSH
T11BE4DFF2BF8F789733AF6EC9578A43726331A1E18FE1346464AD12A39105547D832C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

user_info.txt

Path C:\Users\Admin\AppData\Local\Temp\PxenjyEdtLiz3YntqbuGcT6tL0If2r\user_info.txt
Size 971B
SHA256 5b3f265a4ea9bfbd548fd73f20c534abf301e1766af7c516b4905f184c67144b
MD5 5b627f7f37c2277744bfc3f536248bd9
SHA1 cb41e7fb876395ce0c955f39b69f84d9d9f122dd
SHA512 ba37186a85d7a6ee914fe108337598e042fa0e686d0f34804dc8454d803baf350bbe077a8d635fd95ae0bd08ffdc06af7e5b7c5a9d2e6651f4ab0cc2acdf2473
TLSH
T12B11542446C964A9BA1C916E2232811D7727924FA15C637B398893FD1FBC17CD65CA0E
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_bntohhwj.j05.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bntohhwj.j05.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

sensitive-files.zip

Path C:\Users\Admin\AppData\Local\Temp\sensitive-files.zip
Size 5.1MB
SHA256 575d24fa7e9b32ae4141cc30827642cb74495f3c1fbf0e2714ba2adc627d406b
MD5 6f4c2ee27ca09792e7d76f594bb69a0a
SHA1 a909d4025a410281801db47caee5ed62cf4806a8
SHA512 c5ae0c39f39df67602130f3eb9296232b53995ef81b41d9bb842d82f50177658a5680fc468eb8d964147224dc18f62dbbffc6c9e82981122585b597fb6e8b0b1
SSDEEP 98304:YYW5519v5Amis8avyp3x0hWQM6J9TJCvg0cTHfdq88ZsDxl8cF:YYW551Os8avyxOhlxJ9JCaTH/xl8O
TLSH
T18F4633C02D34B058D04434C23DFA3A2418AB19A7BE689F3E59B3697D19E2F95E2F40DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1372-17-0x0000000005FD0000-0x000000000601C000-memory.dmp

Download

memory/1372-18-0x0000000074960000-0x000000007511C000-memory.dmp

Download

memory/1372-23-0x0000000007130000-0x0000000007150000-memory.dmp

Download

memory/1372-24-0x0000000074960000-0x000000007511C000-memory.dmp

Download

memory/1372-25-0x0000000007150000-0x00000000071F3000-memory.dmp

Download

memory/1372-27-0x00000000072E0000-0x00000000072FA000-memory.dmp

Download

memory/1372-26-0x0000000007920000-0x0000000007F9C000-memory.dmp

Download

memory/1372-28-0x0000000007350000-0x000000000735A000-memory.dmp

Download

memory/1372-29-0x0000000007550000-0x00000000075E6000-memory.dmp

Download

memory/1372-5-0x00000000051A0000-0x00000000051C2000-memory.dmp

Download

memory/1372-35-0x0000000074960000-0x000000007511C000-memory.dmp

Download

memory/1372-34-0x0000000074972000-0x0000000074973000-memory.dmp

Download

memory/1372-20-0x0000000070A60000-0x0000000070AAC000-memory.dmp

Download

memory/1372-37-0x0000000074960000-0x000000007511C000-memory.dmp

Download

memory/1372-39-0x0000000074960000-0x000000007511C000-memory.dmp

Download

memory/1372-4-0x0000000074960000-0x000000007511C000-memory.dmp

Download

memory/1372-42-0x0000000074960000-0x000000007511C000-memory.dmp

Download

memory/1372-1-0x0000000002A90000-0x0000000002AC6000-memory.dmp

Download

memory/1372-2-0x0000000074960000-0x000000007511C000-memory.dmp

Download

memory/1372-0-0x0000000074972000-0x0000000074973000-memory.dmp

Download

memory/1372-16-0x0000000005F50000-0x0000000005F6E000-memory.dmp

Download

memory/1372-7-0x00000000059D0000-0x0000000005A36000-memory.dmp

Download

memory/1372-3-0x0000000005380000-0x00000000059CA000-memory.dmp

Download

memory/1372-6-0x0000000005240000-0x00000000052A6000-memory.dmp

Download

memory/1372-10-0x0000000005B70000-0x0000000005ECB000-memory.dmp

Download

memory/1372-19-0x0000000006540000-0x0000000006576000-memory.dmp

Download

memory/1492-11-0x0000000074960000-0x000000007511C000-memory.dmp

Download

memory/1492-12-0x0000000074960000-0x000000007511C000-memory.dmp

Download

memory/1492-15-0x0000000074960000-0x000000007511C000-memory.dmp

Download

memory/1492-31-0x0000000074960000-0x000000007511C000-memory.dmp

Download

memory/5232-89-0x0000000006650000-0x00000000069AB000-memory.dmp

Download

memory/5232-91-0x0000000006AF0000-0x0000000006B3C000-memory.dmp

Download

memory/6140-47-0x00000000065D0000-0x000000000661C000-memory.dmp

Download

memory/6140-45-0x00000000060C0000-0x000000000641B000-memory.dmp

Download