6bb9652dc18ac191a49638120201cffe8c3262e7decbf7ae11d13d1f26be4eb2

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 10:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_8ea790422059d03953c92eee25ff48e5_cobalt-strike_coinminer_dosia_glassworm_helldown_luca-st.exe
Size 31.6MB
Sample260804-mx13qsdj2w
SHA256 6bb9652dc18ac191a49638120201cffe8c3262e7decbf7ae11d13d1f26be4eb2
MD5 8ea790422059d03953c92eee25ff48e5
SHA1 ba60c69927a36f8234d51e38323eeb33fde3f377
SHA512 d20fbf5f3ed15d0b23bd6bc15f09da132cf908d74db811f4186c3f40fda4d40631be65a3fd63735ab9916acb2a4cbee9a3994d01f25775affb44d41d06006e33
SSDEEP 196608:uRXBv9ppkCrbcciMQZSgKAjGPMtOPlr6ejBjijMAZQJMg88IYwasJ5ggudYc8BtM:OxjpkiQciMQZSyUvrxBWq88IZJegwvC
TLSH
T1CA778D53F09181E9C6DED234C5628262ABB07C849F3067C76A64FA792E36BC45F7D360
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_2047657129\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_2016_938532636\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_979358740\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_852133507\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_979358740\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_852133507\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2016_282379236\_locales\ml\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6884	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303143118766629"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{C9CC49DC-380B-4A86-9397-6D3FA54A403A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6180	msedge.exe
6180	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3732	2026-08-03_8ea790422059d03953c92eee25ff48e5_cobalt-strike_coinminer_dosia_glassworm_helldown_luca-st.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3732	2026-08-03_8ea790422059d03953c92eee25ff48e5_cobalt-strike_coinminer_dosia_glassworm_helldown_luca-st.exe
3732	2026-08-03_8ea790422059d03953c92eee25ff48e5_cobalt-strike_coinminer_dosia_glassworm_helldown_luca-st.exe
3732	2026-08-03_8ea790422059d03953c92eee25ff48e5_cobalt-strike_coinminer_dosia_glassworm_helldown_luca-st.exe
2016	msedge.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3732	2026-08-03_8ea790422059d03953c92eee25ff48e5_cobalt-strike_coinminer_dosia_glassworm_helldown_luca-st.exe
3732	2026-08-03_8ea790422059d03953c92eee25ff48e5_cobalt-strike_coinminer_dosia_glassworm_helldown_luca-st.exe
3732	2026-08-03_8ea790422059d03953c92eee25ff48e5_cobalt-strike_coinminer_dosia_glassworm_helldown_luca-st.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 3732 wrote to memory of 2276	3732	2026-08-03_8ea790422059d03953c92eee25ff48e5_cobalt-strike_coinminer_dosia_glassworm_helldown_luca-st.exe	90
PID 2276 wrote to memory of 2016	2276	rundll32.exe	91
PID 2016 wrote to memory of 1952	2016	msedge.exe	92
PID 2016 wrote to memory of 6928	2016	msedge.exe	94
PID 2016 wrote to memory of 6884	2016	msedge.exe	95
PID 2016 wrote to memory of 6928	2016	msedge.exe	94
PID 2016 wrote to memory of 6928	2016	msedge.exe	94
PID 2016 wrote to memory of 4116	2016	msedge.exe	96
PID 2016 wrote to memory of 4116	2016	msedge.exe	96
PID 2016 wrote to memory of 5924	2016	msedge.exe	97
PID 2016 wrote to memory of 5924	2016	msedge.exe	97
PID 2016 wrote to memory of 5924	2016	msedge.exe	97
PID 2016 wrote to memory of 4548	2016	msedge.exe	98
PID 2016 wrote to memory of 4548	2016	msedge.exe	98
PID 2016 wrote to memory of 4548	2016	msedge.exe	98
PID 2016 wrote to memory of 4612	2016	msedge.exe	99
PID 2016 wrote to memory of 4612	2016	msedge.exe	99
PID 2016 wrote to memory of 4332	2016	msedge.exe	100
PID 2016 wrote to memory of 4332	2016	msedge.exe	100
PID 2016 wrote to memory of 3652	2016	msedge.exe	102
PID 2016 wrote to memory of 7128	2016	msedge.exe	106
PID 2016 wrote to memory of 3000	2016	msedge.exe	107
PID 2016 wrote to memory of 2888	2016	msedge.exe	108
PID 2016 wrote to memory of 1064	2016	msedge.exe	109
PID 2016 wrote to memory of 1064	2016	msedge.exe	109
PID 2016 wrote to memory of 4860	2016	msedge.exe	110
PID 2016 wrote to memory of 4860	2016	msedge.exe	110
PID 2016 wrote to memory of 4540	2016	msedge.exe	111
PID 2016 wrote to memory of 4540	2016	msedge.exe	111
PID 2016 wrote to memory of 3336	2016	msedge.exe	114
PID 2016 wrote to memory of 3336	2016	msedge.exe	114
PID 2016 wrote to memory of 5564	2016	msedge.exe	115
PID 2016 wrote to memory of 5564	2016	msedge.exe	115
PID 2016 wrote to memory of 6988	2016	msedge.exe	116
PID 2016 wrote to memory of 6988	2016	msedge.exe	116
PID 2016 wrote to memory of 6180	2016	msedge.exe	117
PID 2016 wrote to memory of 5332	2016	msedge.exe	118
PID 2016 wrote to memory of 5332	2016	msedge.exe	118

C:\Users\Admin\AppData\Local\Temp\2026-08-03_8ea790422059d03953c92eee25ff48e5_cobalt-strike_coinminer_dosia_glassworm_helldown_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_8ea790422059d03953c92eee25ff48e5_cobalt-strike_coinminer_dosia_glassworm_helldown_luca-st.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3732
- C:\Windows\system32\rundll32.exe
  rundll32 url.dll,FileProtocolHandler http://localhost:36898
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://localhost:36898/
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffd8e03c188,0x7ffd8e03c194,0x7ffd8e03c1a0
      4⤵
      PID:1952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1988,i,7742275030267469836,4154337483609043054,262144 --field-trial-handle=2528,i,3107769525574096512,1408382246823050091,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:2
      4⤵
      PID:6928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2168,i,10970923307512255800,11258860607726802042,524288 --field-trial-handle=2528,i,3107769525574096512,1408382246823050091,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:11
      4⤵
      System Time Discovery
      PID:6884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2508,i,9091831694803426656,17642892697131520615,524288 --field-trial-handle=2528,i,3107769525574096512,1408382246823050091,262144 --variations-seed-version --mojo-platform-channel-handle=3188 /prefetch:13
      4⤵
      PID:4116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,1957928646377877411,8902264635548878838,2097152 --field-trial-handle=2528,i,3107769525574096512,1408382246823050091,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
      4⤵
      PID:5924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,11408658288897806374,5380547655065088944,2097152 --field-trial-handle=2528,i,3107769525574096512,1408382246823050091,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
      4⤵
      PID:4548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,452032503417961014,15653447159740761536,524288 --field-trial-handle=2528,i,3107769525574096512,1408382246823050091,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
      4⤵
      PID:4612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,11267189043511053403,11521122245100025082,524288 --field-trial-handle=2528,i,3107769525574096512,1408382246823050091,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
      4⤵
      PID:4332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,16730631092109823623,12855446591508261512,524288 --field-trial-handle=2528,i,3107769525574096512,1408382246823050091,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
      4⤵
      PID:3488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,16730631092109823623,12855446591508261512,524288 --field-trial-handle=2528,i,3107769525574096512,1408382246823050091,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
      4⤵
      PID:3652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1428,i,5672680513974445272,434372149861580872,524288 --field-trial-handle=2528,i,3107769525574096512,1408382246823050091,262144 --variations-seed-version --mojo-platform-channel-handle=1444 /prefetch:14
      4⤵
      PID:7128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1436,i,5568859726305111737,15640977308393354455,524288 --field-trial-handle=2528,i,3107769525574096512,1408382246823050091,262144 --variations-seed-version --mojo-platform-channel-handle=1452 /prefetch:14
      4⤵
      PID:3000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1292,i,9664078004362138612,10330582743489791958,524288 --field-trial-handle=2528,i,3107769525574096512,1408382246823050091,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
      4⤵
      PID:2888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,2122912326252487900,7453601368181779681,524288 --field-trial-handle=2528,i,3107769525574096512,1408382246823050091,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
      4⤵
      PID:1064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,13756970652804689292,5360224989905941545,524288 --field-trial-handle=2528,i,3107769525574096512,1408382246823050091,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:14
      4⤵
      PID:4860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6708,i,8572495982861949466,10971090860373016792,524288 --field-trial-handle=2528,i,3107769525574096512,1408382246823050091,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:14
      4⤵
      PID:4540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,9838792568247999921,9488178512363946365,524288 --field-trial-handle=2528,i,3107769525574096512,1408382246823050091,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:14
      4⤵
      PID:3336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,13731596553259234366,2831134579654176482,524288 --field-trial-handle=2528,i,3107769525574096512,1408382246823050091,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:14
      4⤵
      PID:5564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,7973760220770491139,1530333662539104865,524288 --field-trial-handle=2528,i,3107769525574096512,1408382246823050091,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:14
      4⤵
      PID:6988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6616,i,5032431828640610814,15093043884508111346,262144 --field-trial-handle=2528,i,3107769525574096512,1408382246823050091,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,1905416008460334246,11637331311876015866,524288 --field-trial-handle=2528,i,3107769525574096512,1408382246823050091,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:14
      4⤵
      PID:5332

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 04e83b0f56c43697248425267fc2d0451269a96d76f9d76fa3265ebd70f488fd
MD5 46d9ff7e10c533568119f54f5a7333cb
SHA1 32b2628106ced07aa9f7109c4278280888ff8570
SHA512 b100b2606b34a7fa1f4dc5d6552c5a6994c08270a3ef6d06cc688aff7e262973eada79d85b59009e1f65e8df3397a1b80a435e71888b178d83fb0460592cb1a2
TLSH
T1EEF0CDAAD921BC3719FC1B1860984B4BE751136B3B51989B3F3D921C4FB563B8646C1C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000064

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000064
Size 64KB
SHA256 d577d686b14bb5dc93dec9c9d634c02eccb547176a459484ff1442c09ec50227
MD5 9534f7022e45c908bfa7b88e37c16330
SHA1 4164bbc9fbec5a071a205dd1f4014cb37f9d3fd7
SHA512 91d039b1b31bfbd9d659df60796be9df59f50ab735001d03c2381cd939b86ebd35643ad771d196be16886eca6b26e700536cf3fabe75ff2c289a2f6a500381b0
SSDEEP 1536:XHiwNeM+lNcLbW7XQwoaWv8lpq5evsAOmEgKavp2O14bfisc:XXNeBNM67XQw0v4qI8Jcc0
TLSH
T19F535DC1ECC01B6518358A32642B9ED6417F5FF68AB13060BE91B666B0BBC4B9737713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 ea6605c8f6b2b597e5a803c3b12be1a6b30d9865f8b8413c970a039edc0a6e73
MD5 67a9195efbc3e14d45258ed10204c9e1
SHA1 a9a8b730cf17dc1a600c53369965f0426d9e17d6
SHA512 672c74f4b3205468439933146962d90a2d9ef6b49dd31c00652a7c6091d26b263e58281b1f5eab0674d2e5057417935d18d7a91d0ac6de4c8a406f903a9f8c5d
TLSH
T10F61EEF7C7F8866DC90196F0EA14BE1BCE1D0515432C3D5A89E4AF1B93E2471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 21f1ce155393c7f8b2b1d95d9d44804b4a408b1491069984798b698236040d49
MD5 f79dcec8d1632613769898c63903483e
SHA1 b9ccc39fdd2711ad354650fe1c09f8daf483345f
SHA512 71518709adcf0a980b42a68ee51ece421189ce13ae6baf8a906b8038c71469ad61aa63835b3adeacfe56dfa4dcf558b21d5929218ec53b6e733c25e2fc9c436b
SSDEEP 384:sxRqX8F/fes+mTN/RI+Vl/5s/Wf0sGQDvjE:sOsF/fIm5WE/5OWf0sGQ0
TLSH
T1E672FA0969349D3B8CDBD209FA957F93D2F9117391905E54AAFCDA1C04E67EC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 b944e316df5ba69024a8763976ad6c57c101f0fd6d3b8e0fb5dc349e5a9d1370
MD5 e1d8dc977187a5af62b183308cc8052e
SHA1 3ce3f91c7654ac79a2cdab0decec3240d8534515
SHA512 3f76df308f59fad5782426f1a121e2f2e98ce02ce8739ba519ada16269a53637302fec8ae61c3fcd1355ba2b86feba8b13550122409d74949720f266694556f4
SSDEEP 384:sxRqXqKF/fes9mfN/RI+Vl/5s/Wfk4sGQDvxY:sO6KF/f/m1WE/5OWfk4sGQq
TLSH
T19672E9199A349D7B8CDBD209FA957F93D2F9116391901E44AAFCCE1C00E67ED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 b7c0c779ea8717083ac51db564b35e308c535ba08740c3934096dd360683ef8b
MD5 bb70dd1c38e4d3b29fd6673f83a7605a
SHA1 a2c248415e8abd2edfd5d474784ebea4a8f13710
SHA512 d69b79f8402aa2131cbc7b2ef81491414ecd1e9393e464ef98c578467023663d5b0c0e00517ca726bb34a0dff1039df1a0fd984b70609907adcaf58dfb5f56ca
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVxobbDwzror4S:Ob4YZnE7yTWg1NfwBu1jaWobHwAMS
TLSH
T13FE2FC3B280CCB7E4F804ADDEC29BD8A6DA801CF56D8C95447FA850C03C6BEB551A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 0b315c69dd1611d20a10544d5203c658559327fc3b1ec2921d603e0f449cd679
MD5 64687cd99c7bdd46bb14487e678f3ebe
SHA1 e0adf1cccbb91fc853c629e9f96ece45a87460fc
SHA512 7ab66b84397a2fdb394fcb1260c0186685e3b3567399e572f7dc368ab54208257ee915df67f6c447672f14bdcb37a4e3f6e3fbeba3ab54058985c3c78a9da8fe
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9EgCBdvbHAbcJVphBnQ9d8v96BW1:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDR9
TLSH
T19CB24D51713F4680387EB90C9178D82F96C2B4A37419E52F7B6801A65F6BE039DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 ad46c73ff629de839148495bbf86856861f31943580375370f7219590f33f403
MD5 f7e42d7563a87aa2ba41a6f910dd2abd
SHA1 cf74672a231ec1ea59060e87f7321aaafe55b744
SHA512 1130a0378556a52d80dadae971d5ae50d841c3ad33d9ce34092422252ca9acbd3971abd1106b79245d8efa2892ce356c9bef54422414b6ebfb54760d3fd51c13
SSDEEP 384:n1iFjZcIF8NLM8TUNTUlIRrPvuTHN5Eqf+GGCxm+4Ro9mAABeRs9JKgqijUnp8Lh:8F7FQMwgNuJxGCY/RocAATjKgqmUnG
TLSH
T14BF2B3F198D78573E8AE5B87A37D6E469AFCD053B4884994B7C95D0CCC821BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 e68076378c292a126ed85528b8078a678284e6e63270e7903dd53e1f78afb30f
MD5 2c31fe26c1941c90559cc8069c960bc2
SHA1 59e59137a1e2d5d663879068ada5d04367504f52
SHA512 a0c9136f5b8e942363b28cbc46803e90c6176c5d5e521f9c7e0d2a5605bc00f95c9dfd4f8e380de052ec91884b663ff919fe5c13eeeb083368f6b324a4ae9b94
SSDEEP 384:nciF1tNn/s3n9Sn8Ng18TUNTUlIRiPvuTuKREqf+GGCxm+vLXOObjI9G6w7BZ8Li:HF1j+9SX1wgUu7ZGCYwX29Mt
TLSH
T1D6C26B36E899CEB7EDE74F98B74A7A56EEE01167859C59C8DAC85D0C00C71ED0307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 15502d31c788b2f31b15599615c4c069435c50ab5429436124db49a8c0661cdb
MD5 9439da7571e749607b8c71ed30de8045
SHA1 826bb902219eb6a2bcb34fa2cdd09a85a2e09af9
SHA512 eaa4bfd0370e1c803fa09a1bf6fb4c9a92bec8d114ec57a2c6f9fd60c7caf6724584f92ac7eef376a71b093dd5da1d24309819480aa1aa1a02a42cc869ec5a44
SSDEEP 384:nsiFjZcIn8NLM8TUNTUlIRrPvuTHj5Eqf+GGCxm+4Rp+AABeRs9JKgqijUnp8LEo:XF7nQMwgNuXxGCY/RQAATjKgqmUnG
TLSH
T126D26C31E8A8DAB7E8EA9FC4B74A7696DEF01063C5888ED4E6D95D0C00871DD170BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 beab8d5c91b1e450a23e9ecf7e132875c777d5121d8bc5b2d90c589f7a41b5a4
MD5 f37f83584bf3d0bae51e92a42d24d503
SHA1 41e10874e150c3de7627ad428f54a19a1596b898
SHA512 6090a41247740505626dc98e1a30fc7456144e8f96ca57f62e4304f37cefc31bec74d9100c6ee20241fba27455e7077dc46fd389df3a49a2e4da5e92e6e4145a
SSDEEP 384:nXiFjZcIn8NLM8TUNTUlIRrPvuTHj5Eqf+GGCxm+4Rp+AABeRs9JKgqijUnp8LEo:SF7nQMwgNuXxGCY/RQAATjKgqmUnG
TLSH
T1CED26C31E8A4DAB7E8EA9FC4B74A7696DEF01063C5889ED4E6D95D0C00871DD170BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 7ab666075886fb0aacd3cf7fd09f7a5157fe68c7a0213b64b71b5ae944e64c80
MD5 24ca5d2e2a19742dfdd73c50ac79304d
SHA1 ebbb802a9693a4e1acd64e779000785b8881fe6a
SHA512 e795092d6ec8b2847b95793009f3267be0c67f741c07d01a8b0059627113ffba2e3b9ed1d8d8b4734c13b6931e243b05e8b22117b219708980332cacebe0bb9d
SSDEEP 384:nXiFiZcIn8NLM8TUNTUlIRvPvuTHj5Eqf+GGCxm+4Rp+AABeRs9JKgqijUnp8LEo:SFQnQMwgNuXxGCY/RQAATjKgqmUnG
TLSH
T1E8D26C31E8A4DAB7F9EA9FC4B74A7686DEF01063C5889AD4E5D95D0C00871DD170BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da8b17a4-15e0-4762-8b4a-8fe62fe79e1a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\da8b17a4-15e0-4762-8b4a-8fe62fe79e1a.tmp
Size 2KB
SHA256 462d7e808963e2604c30ade17e2177d755e533a3d5aafcfbd2a338e44dc14cbc
MD5 4f68dd1a44247528a0d6d45f87ce7cac
SHA1 915377a893f8c5ecd5719a8c912769fc0dcc13d7
SHA512 a6b09d5a431c47f0a1fa3a5c33b691431b8ae6599019bd7234d89ea7c4b0db1b23099541e7816a87f856c0237ad1af9b703afe90f4f88c203704e09c67a9d5bd
TLSH
T1724163D04C391AC1D4BD0E6FB45B29FC94ECD726F490347C2858EA98567E65E314083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 69f9b19ad38d0fac00d81c082a9edad990625a7e91bf59a7fe298a21bb5ede13
MD5 15d7bb4c99112787aa3d6c1ec59c417e
SHA1 87edbc35c3ee4838cf9ab5fa41f4379941215906
SHA512 83d0b36762a8e855e49acdea6a71799dd7fcc9b02e527e8efde1673f5118bb3d7aa4fd62594c1195c72df876151b3fadd1f58a32504a1b16f500e78b12c63d46
TLSH
T1D6410FE04C391AD1D4FD0E6EB48B39FC95E89722F894343828A8EA58557A25E258483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 a3278f957234771d848a4b3ee9901aeec341d2434b924c995300d2e0713b1b7b
MD5 893e4b2373eda936d6ab8fb4a1e8c47b
SHA1 5dfe17ef2f135c6fe6fcf58b53b0628e776e1f54
SHA512 1a716a864fce6b95f1feb9176544c1cf943db5897e41d0030e0c9ace03815ee6a21880b6a9211f32946768874b0c281da0606c7d4c602fd416ce3f6e05c06a5e
TLSH
T119412FE04C391AD1D4BE0E6EB45729FC94EC9726F89434382858EA98967A65E358083F
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3732-452-0x00007FF6E44A0000-0x00007FF6E64C2000-memory.dmp

Download

memory/3732-142-0x00007FF6E44A0000-0x00007FF6E64C2000-memory.dmp

Download

memory/3732-180-0x00007FF6E44A0000-0x00007FF6E64C2000-memory.dmp

Download

memory/3732-163-0x00007FF6E44A0000-0x00007FF6E64C2000-memory.dmp

Download

memory/3732-548-0x00007FF6E44A0000-0x00007FF6E64C2000-memory.dmp

Download