bda499571862d40959b18c8055bb00324b8f2701d81c3f133eba0362d0ca78c6

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 02:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_99e0abf0ff77c48653ef7ed17c6c846f_amadey_elex_glassworm_hammertoss_icedid_luca-stealer_njrat.exe
Size 7.3MB
Sample260801-destzacf23
SHA256 bda499571862d40959b18c8055bb00324b8f2701d81c3f133eba0362d0ca78c6
MD5 99e0abf0ff77c48653ef7ed17c6c846f
SHA1 23cb35a873ce02c53baddb500fdad6c40facebc4
SHA512 17a36a9d5034e7db321e7de346d40e28f31a10fbe2d75477ed9ee5acb2b231df19d71dd561a5381bda9c5a9c8cacdcc408bee621ec50344fc7d9dd91374f43f4
SSDEEP 98304:aZ7QkPeU/LGz6I5P6yjwjPgHeKSQIYKViWgEALlBg3tSF:aZ0kGtZjwcH4QlKVKEABBg3i
TLSH
T11676AE06F7E11081F5BAC67584AB3129FD3A74E11324DAC762C25A9E0F21BF4BC3A756
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

costura discovery packer

Malware Config

Signatures

Detects executables manipulated with Fody 3 IoCs

resource	yara_rule
behavioral2/memory/1220-1-0x00000183F4F00000-0x00000183F545A000-memory.dmp	INDICATOR_EXE_Packed_Fody
behavioral2/files/0x000900000001b85a-17.dat	INDICATOR_EXE_Packed_Fody
behavioral2/memory/5700-21-0x000001C2E9E40000-0x000001C2EA39A000-memory.dmp	INDICATOR_EXE_Packed_Fody

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2026-08-01_99e0abf0ff77c48653ef7ed17c6c846f_amadey_elex_glassworm_hammertoss_icedid_luca-stealer_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	pxQT_2fQ6lO_gEE.exe

Deletes itself 1 IoCs

pid	Process
5700	pxQT_2fQ6lO_gEE.exe

Executes dropped EXE 1 IoCs

pid	Process
5700	pxQT_2fQ6lO_gEE.exe

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
behavioral2/files/0x000900000001b85a-17.dat	costura

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_360_1414787565\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1210558222\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1210558222\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_2045978448\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping360_1742777172\_locales\gu\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2788	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	2026-08-01_99e0abf0ff77c48653ef7ed17c6c846f_amadey_elex_glassworm_hammertoss_icedid_luca-stealer_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	pxQT_2fQ6lO_gEE.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	2026-08-01_99e0abf0ff77c48653ef7ed17c6c846f_amadey_elex_glassworm_hammertoss_icedid_luca-stealer_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	2026-08-01_99e0abf0ff77c48653ef7ed17c6c846f_amadey_elex_glassworm_hammertoss_icedid_luca-stealer_njrat.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	pxQT_2fQ6lO_gEE.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	pxQT_2fQ6lO_gEE.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134300265922808015"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3611646547-550105268-947503007-1000\{328B5D6D-5585-48E5-93AF-3515060F75AD}	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1220	2026-08-01_99e0abf0ff77c48653ef7ed17c6c846f_amadey_elex_glassworm_hammertoss_icedid_luca-stealer_njrat.exe
5700	pxQT_2fQ6lO_gEE.exe
4120	msedge.exe
4120	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
360	msedge.exe
360	msedge.exe
360	msedge.exe
360	msedge.exe
360	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1220	2026-08-01_99e0abf0ff77c48653ef7ed17c6c846f_amadey_elex_glassworm_hammertoss_icedid_luca-stealer_njrat.exe
Token: SeDebugPrivilege	5700	pxQT_2fQ6lO_gEE.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
360	msedge.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 4816	1220	2026-08-01_99e0abf0ff77c48653ef7ed17c6c846f_amadey_elex_glassworm_hammertoss_icedid_luca-stealer_njrat.exe	89
PID 4816 wrote to memory of 1288	4816	csc.exe	91
PID 1220 wrote to memory of 5700	1220	2026-08-01_99e0abf0ff77c48653ef7ed17c6c846f_amadey_elex_glassworm_hammertoss_icedid_luca-stealer_njrat.exe	92
PID 5700 wrote to memory of 5948	5700	pxQT_2fQ6lO_gEE.exe	93
PID 5948 wrote to memory of 4592	5948	csc.exe	95
PID 5700 wrote to memory of 360	5700	pxQT_2fQ6lO_gEE.exe	96
PID 360 wrote to memory of 3896	360	msedge.exe	97
PID 360 wrote to memory of 4072	360	msedge.exe	99
PID 360 wrote to memory of 2788	360	msedge.exe	100
PID 360 wrote to memory of 4072	360	msedge.exe	99
PID 360 wrote to memory of 4072	360	msedge.exe	99
PID 360 wrote to memory of 1728	360	msedge.exe	101
PID 360 wrote to memory of 1728	360	msedge.exe	101
PID 360 wrote to memory of 5916	360	msedge.exe	102
PID 360 wrote to memory of 5916	360	msedge.exe	102
PID 360 wrote to memory of 5916	360	msedge.exe	102
PID 360 wrote to memory of 5444	360	msedge.exe	103
PID 360 wrote to memory of 5444	360	msedge.exe	103
PID 360 wrote to memory of 5444	360	msedge.exe	103
PID 360 wrote to memory of 4668	360	msedge.exe	105
PID 360 wrote to memory of 4668	360	msedge.exe	105
PID 360 wrote to memory of 4668	360	msedge.exe	105
PID 360 wrote to memory of 1020	360	msedge.exe	104
PID 360 wrote to memory of 1020	360	msedge.exe	104
PID 360 wrote to memory of 1020	360	msedge.exe	104
PID 360 wrote to memory of 5408	360	msedge.exe	106
PID 360 wrote to memory of 5408	360	msedge.exe	106
PID 360 wrote to memory of 4900	360	msedge.exe	108
PID 360 wrote to memory of 4804	360	msedge.exe	109
PID 360 wrote to memory of 4900	360	msedge.exe	108
PID 360 wrote to memory of 4804	360	msedge.exe	109
PID 360 wrote to memory of 2288	360	msedge.exe	111
PID 360 wrote to memory of 4712	360	msedge.exe	112
PID 360 wrote to memory of 4712	360	msedge.exe	112
PID 360 wrote to memory of 2544	360	msedge.exe	113
PID 360 wrote to memory of 2544	360	msedge.exe	113
PID 360 wrote to memory of 5888	360	msedge.exe	116
PID 360 wrote to memory of 5888	360	msedge.exe	116
PID 360 wrote to memory of 492	360	msedge.exe	117
PID 360 wrote to memory of 492	360	msedge.exe	117
PID 360 wrote to memory of 5472	360	msedge.exe	119
PID 360 wrote to memory of 4840	360	msedge.exe	120
PID 360 wrote to memory of 1460	360	msedge.exe	121
PID 360 wrote to memory of 2912	360	msedge.exe	122
PID 360 wrote to memory of 2912	360	msedge.exe	122
PID 360 wrote to memory of 1188	360	msedge.exe	126
PID 360 wrote to memory of 1188	360	msedge.exe	126
PID 360 wrote to memory of 5020	360	msedge.exe	127
PID 360 wrote to memory of 5020	360	msedge.exe	127
PID 360 wrote to memory of 4120	360	msedge.exe	128
PID 360 wrote to memory of 3484	360	msedge.exe	129
PID 360 wrote to memory of 3484	360	msedge.exe	129

C:\Users\Admin\AppData\Local\Temp\2026-08-01_99e0abf0ff77c48653ef7ed17c6c846f_amadey_elex_glassworm_hammertoss_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_99e0abf0ff77c48653ef7ed17c6c846f_amadey_elex_glassworm_hammertoss_icedid_luca-stealer_njrat.exe"
1⤵
- Checks BIOS information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\2026-08-01_99e0abf0ff77c48653ef7ed17c6c846f_amadey_elex_glassworm_hammertoss_icedid_luca-stealer_njrat.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_741eba03e6244439bc79cf8544f7d431.cs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4816
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6027.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCDB9157B896A64ED6982F99A62DD2CA11.TMP"
    3⤵
    PID:1288
- C:\Users\Admin\AppData\Local\Temp\pxQT_2fQ6lO_gEE.exe
  "C:\Users\Admin\AppData\Local\Temp\pxQT_2fQ6lO_gEE.exe" --is-new-copy "C:\Users\Admin\AppData\Local\Temp\2026-08-01_99e0abf0ff77c48653ef7ed17c6c846f_amadey_elex_glassworm_hammertoss_icedid_luca-stealer_njrat.exe"
  2⤵
  - Checks BIOS information in registry
  - Deletes itself
  - Executes dropped EXE
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5700
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\pxQT_2fQ6lO_gEE.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_4555fcb846484770a66011c345ef8e54.cs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5948
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6C3D.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC1772DF65229D47DD926BE16A44D254F2.TMP"
      4⤵
      PID:4592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://v0-helper-setup-guide.vercel.app/
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2cc,0x2f4,0x2f8,0x2c8,0x318,0x7ffc1ce6c188,0x7ffc1ce6c194,0x7ffc1ce6c1a0
      4⤵
      PID:3896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1972,i,6715847010991567288,1047186825165867498,262144 --field-trial-handle=2788,i,1640284841198428422,3690945679458218200,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:2
      4⤵
      PID:4072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2172,i,5836656458245967884,447244706076580985,524288 --field-trial-handle=2788,i,1640284841198428422,3690945679458218200,262144 --variations-seed-version --mojo-platform-channel-handle=2804 /prefetch:11
      4⤵
      System Time Discovery
      PID:2788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,3561828709807694252,966521933285157670,524288 --field-trial-handle=2788,i,1640284841198428422,3690945679458218200,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:13
      4⤵
      PID:1728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,8472424152539077847,8314725733559737755,2097152 --field-trial-handle=2788,i,1640284841198428422,3690945679458218200,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      PID:5916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,10023439211714360856,12675860542430778350,2097152 --field-trial-handle=2788,i,1640284841198428422,3690945679458218200,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
      4⤵
      PID:5444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,13397598571451290845,2214276835051901610,2097152 --field-trial-handle=2788,i,1640284841198428422,3690945679458218200,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:1
      4⤵
      PID:1020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,247209501813704640,1552501684132165843,2097152 --field-trial-handle=2788,i,1640284841198428422,3690945679458218200,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:9
      4⤵
      PID:4668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,10168483075067957284,3487251309745756064,524288 --field-trial-handle=2788,i,1640284841198428422,3690945679458218200,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:14
      4⤵
      PID:5408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,11618858573371825073,3445239406353820725,524288 --field-trial-handle=2788,i,1640284841198428422,3690945679458218200,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
      4⤵
      PID:4900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,10022798582490739442,13561728914641500427,524288 --field-trial-handle=2788,i,1640284841198428422,3690945679458218200,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:14
      4⤵
      PID:4804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,12907204234021528636,13304430195124851580,524288 --field-trial-handle=2788,i,1640284841198428422,3690945679458218200,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
      4⤵
      PID:5840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,12907204234021528636,13304430195124851580,524288 --field-trial-handle=2788,i,1640284841198428422,3690945679458218200,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
      4⤵
      PID:2288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,1803431327210466176,11250068722422713330,524288 --field-trial-handle=2788,i,1640284841198428422,3690945679458218200,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:14
      4⤵
      PID:4712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,8289491940394799501,7038205652414417397,524288 --field-trial-handle=2788,i,1640284841198428422,3690945679458218200,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:14
      4⤵
      PID:2544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,14779558634405535266,1529023523930366935,524288 --field-trial-handle=2788,i,1640284841198428422,3690945679458218200,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:14
      4⤵
      PID:5888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6772,i,16757391474344401791,1775164293307045616,524288 --field-trial-handle=2788,i,1640284841198428422,3690945679458218200,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:14
      4⤵
      PID:492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4820,i,13357734678744523269,15587460663624865111,524288 --field-trial-handle=2788,i,1640284841198428422,3690945679458218200,262144 --variations-seed-version --mojo-platform-channel-handle=1280 /prefetch:14
      4⤵
      PID:5472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4768,i,10458393446953432976,14360754713108894703,524288 --field-trial-handle=2788,i,1640284841198428422,3690945679458218200,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:14
      4⤵
      PID:4840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4844,i,8381830641521733850,7055992102829267445,524288 --field-trial-handle=2788,i,1640284841198428422,3690945679458218200,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
      4⤵
      PID:1460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1276,i,2017678686120435577,17036675749978681390,524288 --field-trial-handle=2788,i,1640284841198428422,3690945679458218200,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
      4⤵
      PID:2912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,18184135657873500249,12330745335233334858,524288 --field-trial-handle=2788,i,1640284841198428422,3690945679458218200,262144 --variations-seed-version --mojo-platform-channel-handle=1288 /prefetch:14
      4⤵
      PID:1188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4812,i,12376391589521305744,16225686886817108519,524288 --field-trial-handle=2788,i,1640284841198428422,3690945679458218200,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
      4⤵
      PID:5020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5292,i,5428803578955692022,1464436907045711244,262144 --field-trial-handle=2788,i,1640284841198428422,3690945679458218200,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,6218617864009429474,12052939647681856200,524288 --field-trial-handle=2788,i,1640284841198428422,3690945679458218200,262144 --variations-seed-version --mojo-platform-channel-handle=1284 /prefetch:14
      4⤵
      PID:3484

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3a279abf-228b-414f-ba08-c6ae1e43ae15.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3a279abf-228b-414f-ba08-c6ae1e43ae15.tmp
Size 43KB
SHA256 4e52297d1b65a027d3c12f6b03df7221003a3bb1e421bf8ff883579fda45db1a
MD5 243ee4ee98ec9bf44d28d8304710f933
SHA1 e691909bef8738324d7541d4547dd59c84564ecf
SHA512 35968abe012df2936f4df89cbbd70011e491ec120d9b1ccf51437b0319287df756b16eac47e57f09a2422c1d2931c47665526a53b62733968fb02b4445833b64
SSDEEP 768:e+FQv3VwgS/yPT7Hucys6BRvi82oP4/z6himo6I2ewBKZOMh:eVv3u3imOz6ImoL2evZ5h
TLSH
T1BF134AF498D78936D89E8787A77D6E429AFCD163B4885894F7D95E0CCC821BFC30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 22c1d58ffa7df77a7e0440ce3b2c474b1e03f30b60355bbf5dd6392fefb641fd
MD5 b9f45a900b1f64efbf90731f41c6ad44
SHA1 0c28e85e464e328fbbc07373b05113d39f83bdcc
SHA512 132313545c55ea809da0e811d6d5d324ecf5b6cfaefadb3fa4a29df5e6266dfeca7cffa4daf21754b4b37771504d3692189b5660a468784b5eaf80bf92f59ae0
TLSH
T11ED02BA033044C0CCE40203215B9A210720484204849031A8E41F02C8C6FD4387161F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee3af991fa1719733ca1e3ac746d5b605f4205e269bf244bd9ae780ceadb9bd8
MD5 a044f6413820c4c3fbd300ee9b379ebc
SHA1 94fc91536a25274f06d3a6e89322dec7fde7912e
SHA512 ced4374c54d7b4ea2b76afe4ca5d8841dfb55d8cb5db96de4ed49e64bd3850a817db5301787c268756641c94c0bf85eb4ee188f04fc891fa2e45ad48284985a5
TLSH
T13AD02BA433044D0CCE40203215B8A210720484209C49031A8D41B01C8C6FD4387171FB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 126818607da525424246b7c002f869382fd8049fb0c5541a8add405efd9b6e45
MD5 0eb0856c150e467946a4b43bb53ff9f0
SHA1 b399c43dfc3b3d7543e585d7e9d1adfa8bf59fe9
SHA512 d71811261ed5ddd53193b7f3e5f3d3ca9e40b6e38bc4a54ffb58bab55650228ba79233cfbc53adddc9a0836fe82c7cbb3ef1e5b231b766e96eb37ac2b4d3182c
TLSH
T1497153F2A3602DC2FBA2597401E5A8683BF440D97E071F2587C0AE369909F6562F271F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59eda2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59eda2.TMP
Size 3KB
SHA256 26350bcaf6d58388b357ad5daebac24ea338b886a27da04c6ee8fd15b647117d
MD5 b298f2e5ee66a2882ea6e517a7afc399
SHA1 07e1d3e3a89dcf7ca202a9d020a95c664fb18c08
SHA512 90d14dab2cf27439084b7a9a79e76cdbb02d501869fd9783cf94c0ff5c8ad842bb32d949abe2aee2cc4948533bbc39542cfec5e4fa64aaa97f5ac33405914202
TLSH
T199613EF263202DC2FBA6997001F5B4683BF484DA6E071F2583806E765A09F5562F272F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 bd3a20d1fff41e989d13fd33141c63ec13644e03655b7682413acb9caecb9a7b
MD5 c6bb8e5304c0fa7e08131fa30e11248a
SHA1 484eb79adc34c8b6e650a5ac81640f85f41620ce
SHA512 65c04ebdcf1b20cddd0efae32e818636a8253244c3e145c2955b8090c53b0a6fa270eca0be13b28697a42993b621c84c8e10f68ae577f85dd76d91fd46fbd79c
TLSH
T17A819DF3C3E8856DD90256F0EB147E2BCE6D0925433C3D5988E4AF5BA3E24B1D241A5E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 12bdeaba3312b4b74b2634fabfdd8a5eab2e59bd458f7ae79fa7a270d38f72b0
MD5 8c937d4635276ba4f31962cec9f269e9
SHA1 c43d417b128cd31e317176ee9a3121aa2dba97ce
SHA512 5413127ec561f39800c478d47deed9be3f626673d1409fe589ea7deca29dd245e7e5978edfc740e8bfd2c332605dfa31ad9a8684873aa0889c82a0c685946bde
SSDEEP 192:sxRN1AR4YCIa/f1SsC/xZ9ZUVAMaFdHdzoD8pkNB/g6+WNiNIZj/YGN0k4EGrIgB:sxRoiR/fwsC/f92VAMa3Ze/59/5QB
TLSH
T18142C716A938693B9CCBE21DFA557F53E2FD5032A1D41E58A7FC9A1C00EB6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 3cb5f50a51068a949c61d96c6f84b949eecb23dc7347751ec52f8c2bafbd0418
MD5 742928a36b34333b3b76da0626f7c398
SHA1 53bdf5afdd8c30ade3451fb1da1a03199a68de2c
SHA512 618e1dff52450a1bf492a7652c640b57dddb3b9ffd35d7084215b60f014dfaa150de8a548398e4d78a1ae98c415fa52900a6c9e51fe0d2832b0d613551980c09
SSDEEP 192:sxRNsAR4YCIa/f1SsdLxZ9ZUVAMaFdHdzoD8pkNB/g6+WNiNIZj/YGN1kk4EGrIc:sxRPiR/fwsdLf92VAMa3Ze/59/vQ5
TLSH
T18E42C6166938A93B8CCBD21DFA557F53D2FD5032A1D41E58A7FC9A1C04EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f871c411854ac95ae4edad7365eed7cbb6c21abcdf5237007327ae9d5baea24b
MD5 299195cd65d13c9e7f8d56151ae28a0b
SHA1 ef077e0b507810d17f89956b301a327a813a2180
SHA512 f4e77210fb8a9951cd250fafccab775a887287c2b7906fccd4f914c0bda2aa7bfb79b3c2ef864f04e9c364e501c2b755cc80e24fe398bd46b7c2c89865805362
SSDEEP 192:sxRN1AR4YCIa/f1SsCLxZ9ZUVAMaFdHdzoD8pkNB/g6+WNiNIZj/YGN1kk4EGrIU:sxRoiR/fwsCLf92VAMa3Ze/59/vQz
TLSH
T1D842C616A938A93B8CCBD21DFA557F53D2FD5032A1D41E58A7FC9A1C04EB6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 89fb7a588428bca344fbcbcc081f5e5d98ffb5c1002e0a1d1b5c922837c0e74b
MD5 b8655182ea4e086ebaedef95c8adb500
SHA1 59671e188aa84408658233806bc6930db63b42be
SHA512 ff3677d66ddc12b8e0f8b1256c563c120e579a4598c266f9dcd3ae8fa1cbb79c36e191b5a4850f7a1a6e1f1e6b70d4ffd9280e0aadf40e9c1328b656f0977e1f
SSDEEP 768:UQYiUU7pLuLfONWgv7fxJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEp5pNKJro8:UQYiUYEfONWgv7fxJu1jazp5fKi8
TLSH
T125D2EA7B640CCA7E4F804A9DEC197E9F6DA802CB95D8CD9047FE941C02C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a7149.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a7149.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 1c942b2c8cf4856d77f6ff7c2e7007963d9caf61d2c970a1511778a18cf80c9b
MD5 857e872aa6ab97406f8a2a13528e9503
SHA1 34b1884e2ecbc509083abe7a8a2994651bd42409
SHA512 99a1cd32e1e118b5db3e0c658086afa198fcb095386dc1e90f13eae6295a883c7906f90dca258bf7b81d9e478067cac9b2b6c194a6bd71c629b4747c3b9e604c
SSDEEP 768:hA+3QClYyrN7Hucys6BRvi82oP4/z6himo6I2ewBKZOMh:hA+3y3imOz6ImoL2evZ5h
TLSH
T1F3F2BF70A8299D73DCEBD248F5463B836EE4217394CC2D64EAEE9F0D118365D171BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 3b33d23ca8f838747c91e0abbd677a8aff56572ff1bc6f2f5e9121c2450f4a6d
MD5 9b01ec96b40698a0347943290cffb214
SHA1 b60980e6d4d113adb0c89ce815a168ccf958d3d1
SHA512 9d290b5d52648dd40d743cea52e1d8287ddfb99cb3a30670b0374e3a7f4caf4b1309b763c63cb63e01610d5ab28100e5043eea683a6307dd565dbe4b91b87635
SSDEEP 768:mA+3JClYyrN7Hucys6BRvi82oP4/z6himo6I2ewBKZOMh:mA+3f3imOz6ImoL2evZ5h
TLSH
T1F0F2B070A8299D73DCDBD288F5463A836EE4617394CC2D64EAEE9F0D118365D171BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 b34b41ce83c58b06c35797639d541064d257f7426f63ed7f9b3af085de324c53
MD5 fed420311dc6eea842f83f207af1d5be
SHA1 6e3a377db3fc396424e7813b967f304d5549eb8d
SHA512 25d564a5056e35c0715ce1b285b7be6da0ff1883733a601004a5d32075d17a4030461b532d2d7ec4185fbdcc3612b710eea54dbf53a66c7e274b4cca26476b4b
SSDEEP 768:hkrv+4UNbd934ClYyrs7Hucys6BRvi82oP4/z6himo6I2ewBKZOMG:hkbsbb3f3imOz6ImoL2evZ5G
TLSH
T13813BF30E42DDD73DDE79288B04B7A937FE8217394C81DA4EADA5B1D118769D131BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 144304bf41c97f12979ebeff9aa6086976ae1a93eed7b4513b1c9bd362707d34
MD5 bcdaf2b763e7e2b56004833783d05ce4
SHA1 cc54766bfb1940396e0355cb98c5ddd616451d6f
SHA512 8d19f983bebda1007b741eafd82879555ea9abc8e76453ba2e6a62f6140ec746218d93917bd53bd72c000ccd412475a511dccabf9924bac63471de2febd16370
SSDEEP 768:xGrv+4UNbdS35EJlYyr77Hucys6BRvi82oP4/z6himo+42bwn+h:xGbsbw35z3imOz6Imob0w+
TLSH
T12403C031E4549D73DCEBC288B1467A973FF4522345C91AC0E6DE6B0E029B99E531BC63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

RES6027.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6027.tmp
Size 2KB
SHA256 b49da17abf1f293b4f63e889b50ab721e3af7d001a70e97189edf92a744fa756
MD5 ebd4ace2e9d205ad777bb08616202df9
SHA1 d0fd13b42b8ba9b82f6b80681fd9656d46a25d37
SHA512 908eab2367bc9bd59899e6ddc40362bb4484168d2673004692d920059a5a3da2c74cfdc598fa49653d472284d97ee67018e8703f18b8dcbaf691fbba1a5649da
TLSH
T14E410F4483D84B5BF1334B306DF6D317AA74B9D16D69979E7184132E0E12740DCC3672
MD5 SHA1 SHA512 TLSH

Submit Download

RES6C3D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6C3D.tmp
Size 1KB
SHA256 0ec68866757da915ba0ac8662eff43d3c4f7000921617549f9e98f31fbd2c993
MD5 a905aaa4b7cfb746c97007a5383f6153
SHA1 865d7c42c6ef654c9f09ac3f47ebd5cb3e027f0d
SHA512 c3980d1fc0fc1e94be2259c95df153fcc972824d3edb49f31f058f428b5b44e007b5493b57ca64528be610bd141640b293e0e84f41dd9b7259ce71359b512b25
TLSH
T1A441144093D9871EF17283316DF79315A678FD959F9E535DB484122E1E02740DEC36B2
MD5 SHA1 SHA512 TLSH

Submit Download

e5279bd9-4939-4a08-9d95-7bfde6ce89c7.tmp

Path C:\Users\Admin\AppData\Local\Temp\e5279bd9-4939-4a08-9d95-7bfde6ce89c7.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

pxQT_2fQ6lO_gEE.exe

Path C:\Users\Admin\AppData\Local\Temp\pxQT_2fQ6lO_gEE.exe
Size 7.9MB
SHA256 50397dd1eded93d9304ed99bc9cc13d3c9db0bb8b104bdb2188a306fa2c46a70
MD5 b3b49a4be31fa09d051fc39e5d153493
SHA1 cb722e99ed3ae0ec87c78edfe203c7c18f0ae551
SHA512 2055b599748213e0d81322b2ae0c91031e9e48a6c75c64704a295912fb12bb073c4beb66d1506cb34ab347de0ad815435b0e2eb4f1bd2f6ceaf7484b985585f4
SSDEEP 98304:KZ7QkPeU/LGz6I5P6y3wjPgHeKSQIYKViWgEALlBg3tSg9/Mb:KZ0kGtZ3wcH4QlKVKEABBg3l90b
TLSH
T1A186AE06F7E11081F5BAC67584AB3129FD3A74E11324DAC762C25A9E0F21BF4BC3A756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir360_401320824\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC1772DF65229D47DD926BE16A44D254F2.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC1772DF65229D47DD926BE16A44D254F2.TMP
Size 1KB
SHA256 08e17a5d0c6955fc5cfc6d67d0df442a895a430e47c8b2848843454054109510
MD5 cf4cc3c16e87b1c4725b2858823cf302
SHA1 ae65db2e5c66b2bac4ac6a2d2c2f527311251dd1
SHA512 e43a48d0584befdf1c98fb29d8a5d14d81d89578545edb93e802d2f724ffc0aa5f3bfb40e08d7c13b7dec0fb56727777cca3a5ae3759e0703c3612e6b548296a
TLSH
T12A21EF84A3E8421EF1B387307DF6C362A16DBE929D7E53DC7888175F1F266008583AB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSCDB9157B896A64ED6982F99A62DD2CA11.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSCDB9157B896A64ED6982F99A62DD2CA11.TMP
Size 1KB
SHA256 1ac364903e14dca0a30411611d378c0a76d8a15ddb8cc9886094016eb499c140
MD5 fa8a72c8ee27ab730379d577daf8f4fb
SHA1 a4c3aa5efc208ea083eac0850b97893279ed16da
SHA512 1105c2a892a108b7f05935ce8991c40c8ba58aacd79e61e13077d3d6e9b76fa29313b4200d7d48c467ee1dcfd6f36148f6d0832f23be9c8653efd424fa16b0c8
TLSH
T13C31CC5593E8025BF1B34B30BDF5D263956879D26C79879D3088170E0E22B51CC93A72
MD5 SHA1 SHA512 TLSH

Submit Download

guardian_src_741eba03e6244439bc79cf8544f7d431.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\guardian_src_741eba03e6244439bc79cf8544f7d431.cs
Size 4KB
SHA256 3ee1bf1ab210527e7543dc78ca3511904bf7770d571eb0d11746edd9f5bf814a
MD5 b7d40eb7e1328728d647678e1ea0a4dc
SHA1 43850a88c7f012df9e7349886497271c83e2bdaa
SHA512 a531df01588357b0d669d563fada88e78b0b3d1453e40605a872e9fba6091bb46a623b0817aafab946b01f92d5810ed7eb97ed9373eaeacb9970b316278667a4
SSDEEP 96:noO1V0E4Yt1YOC3idfygNzkfK1Sg5vpVIHZZ:jl481hC3i1ygNzw5g5vpVw3
TLSH
T19F911298954DA2D69872223AFB03D15BF603103322FF9A20FEADD3505F3D0018678F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1220-11-0x00007FFC1C4F0000-0x00007FFC1CE94000-memory.dmp

Download

memory/1220-12-0x00007FFC1C4F0000-0x00007FFC1CE94000-memory.dmp

Download

memory/1220-0-0x00007FFC1C67F000-0x00007FFC1C680000-memory.dmp

Download

memory/1220-22-0x00007FFC1C4F0000-0x00007FFC1CE94000-memory.dmp

Download

memory/1220-4-0x00007FFC1C4F0000-0x00007FFC1CE94000-memory.dmp

Download

memory/1220-2-0x00007FFC1C4F0000-0x00007FFC1CE94000-memory.dmp

Download

memory/1220-1-0x00000183F4F00000-0x00000183F545A000-memory.dmp

Download

memory/5700-21-0x000001C2E9E40000-0x000001C2EA39A000-memory.dmp

Download