neshta | 836742330cce5a91784c67fc9048083ee326ccea417dd64c51f77c0a5a19bd63

Analysis

max time kernel
149s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 17:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_f436d533fc03792cbc34f6a95bf855d2_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
Size 3.0MB
Sample260808-vkvdesvxaw
SHA256 836742330cce5a91784c67fc9048083ee326ccea417dd64c51f77c0a5a19bd63
MD5 f436d533fc03792cbc34f6a95bf855d2
SHA1 484a63d3c33ecef68847db167b59d763bb499629
SHA512 b1f7fb6bd568a8bd9bdee86b62ba17c26991b9b1580efb20ba01e5e35b21f83ac7219a0b54e02dde8d78672e05b817194b7aaac346bc81a7fe26247251979013
SSDEEP 49152:068GYrEY5+lh6COpvhdBdy0QHcspePwn13vdyMRnwJfH6sTvh:PYQYKljnFJyvh
TLSH
T170E57C03F2D901E8D06ED2798B568232AAB2BC454B34B6DF0A6077151F7AFE55B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery neshta persistence spyware stealer

Malware Config

Signatures

Family: Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta

Detect Neshta payload 50 IoCs

resource	yara_rule
behavioral1/files/0x00060000000202aa-223.dat	family_neshta
behavioral1/memory/380-688-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/files/0x00010000000230a5-875.dat	family_neshta
behavioral1/files/0x000700000002455a-894.dat	family_neshta
behavioral1/memory/5536-903-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/files/0x00060000000202b9-929.dat	family_neshta
behavioral1/files/0x0004000000020395-928.dat	family_neshta
behavioral1/files/0x000100000002031b-927.dat	family_neshta
behavioral1/files/0x00010000000234ab-939.dat	family_neshta
behavioral1/files/0x000100000002153d-937.dat	family_neshta
behavioral1/files/0x000100000002153c-936.dat	family_neshta
behavioral1/files/0x000100000002153b-935.dat	family_neshta
behavioral1/files/0x00010000000227ad-934.dat	family_neshta
behavioral1/files/0x0001000000021591-933.dat	family_neshta
behavioral1/files/0x0002000000020399-932.dat	family_neshta
behavioral1/files/0x00080000000202c3-931.dat	family_neshta
behavioral1/files/0x00060000000202c1-930.dat	family_neshta
behavioral1/files/0x00040000000203d4-926.dat	family_neshta
behavioral1/files/0x000100000002311f-951.dat	family_neshta
behavioral1/files/0x0001000000023125-953.dat	family_neshta
behavioral1/files/0x000300000001eab2-958.dat	family_neshta
behavioral1/files/0x000300000001eaab-957.dat	family_neshta
behavioral1/files/0x000100000002318d-956.dat	family_neshta
behavioral1/files/0x0001000000023120-952.dat	family_neshta
behavioral1/files/0x000100000002311a-950.dat	family_neshta
behavioral1/files/0x0001000000023118-949.dat	family_neshta
behavioral1/files/0x000100000002315d-948.dat	family_neshta
behavioral1/files/0x00010000000230a0-947.dat	family_neshta
behavioral1/files/0x000100000002309f-946.dat	family_neshta
behavioral1/files/0x0001000000023091-945.dat	family_neshta
behavioral1/files/0x000100000002308f-944.dat	family_neshta
behavioral1/files/0x0001000000020333-925.dat	family_neshta
behavioral1/files/0x00040000000203c2-924.dat	family_neshta
behavioral1/files/0x0001000000020320-923.dat	family_neshta
behavioral1/files/0x00010000000202b1-922.dat	family_neshta
behavioral1/files/0x00060000000203c0-921.dat	family_neshta
behavioral1/files/0x000600000002029e-920.dat	family_neshta
behavioral1/files/0x00060000000202a2-918.dat	family_neshta
behavioral1/files/0x000700000002030a-917.dat	family_neshta
behavioral1/files/0x00040000000203cf-916.dat	family_neshta
behavioral1/memory/380-1116-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/5388-1574-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/380-1612-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/5388-1636-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/380-1639-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/5388-1640-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/380-1641-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/5388-1642-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/380-1646-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/5388-1645-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 5388 created 2876	5388	identity_helper.exe	49

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	2026-08-08_f436d533fc03792cbc34f6a95bf855d2_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	identity_helper.exe

Executes dropped EXE 6 IoCs

pid	Process
4196	2026-08-08_f436d533fc03792cbc34f6a95bf855d2_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
5364	identity_helper.exe
5388	identity_helper.exe
5536	svchost.com
5576	IDENTI~1.EXE
5164	2026-08-08_f436d533fc03792cbc34f6a95bf855d2_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	2026-08-08_f436d533fc03792cbc34f6a95bf855d2_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\scoped_dir4196_1842415328\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\656b3350-57ac-46a7-99d2-377541cdb760\c0fe86f84e534033_1	msedge.exe
File created	C:\Program Files\scoped_dir4196_1842415328\Default\Cache\Cache_Data\f_00002c	msedge.exe
File opened for modification	C:\Program Files\scoped_dir4196_1842415328\Default\Code Cache\js\46d889db3d2daaa0_0	msedge.exe
File opened for modification	C:\Program Files\scoped_dir4196_1842415328\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\656b3350-57ac-46a7-99d2-377541cdb760\13e83bd1c1ab1541_1	msedge.exe
File created	C:\Program Files\scoped_dir4196_1842415328\Default\Sync Data\LevelDB\000003.log	msedge.exe
File created	C:\Program Files\scoped_dir4196_1842415328\Default\Local Storage\leveldb\MANIFEST-000001	msedge.exe
File created	C:\Program Files\scoped_dir4196_1842415328\Default\Code Cache\js\e9a142a21b9ad9ef_0	msedge.exe
File created	C:\Program Files\scoped_dir4196_1842415328\Default\Code Cache\js\7843150b6dcb4b5d_0	msedge.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	2026-08-08_f436d533fc03792cbc34f6a95bf855d2_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File created	C:\Program Files\scoped_dir4196_1842415328\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\656b3350-57ac-46a7-99d2-377541cdb760\54bfb130d33d0df3_0	msedge.exe
File opened for modification	C:\Program Files\scoped_dir4196_1842415328\Default\Code Cache\js\21f32ab411e66fd9_1	msedge.exe
File opened for modification	C:\Program Files\scoped_dir4196_1842415328\Default\Code Cache\js\bc844fc0c6aff56c_s	msedge.exe
File created	C:\Program Files\scoped_dir4196_1842415328\Default\Cache\Cache_Data\f_00001b	msedge.exe
File opened for modification	C:\Program Files\scoped_dir4196_1842415328\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_s	msedge.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	2026-08-08_f436d533fc03792cbc34f6a95bf855d2_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File created	C:\Program Files\scoped_dir4196_1842415328\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\656b3350-57ac-46a7-99d2-377541cdb760\07414402e2b02be8_0	msedge.exe
File opened for modification	C:\Program Files\scoped_dir4196_1842415328\Default\Code Cache\js\448e0a0ef38b1de6_s	msedge.exe
File opened for modification	C:\Program Files\scoped_dir4196_1842415328\Default\Code Cache\js\599482f29f136204_0	msedge.exe
File created	C:\Program Files\scoped_dir4196_1842415328\Default\Cache\Cache_Data\f_000033	msedge.exe
File created	C:\Program Files\scoped_dir4196_1842415328\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\656b3350-57ac-46a7-99d2-377541cdb760\3b03edf631539a03_0	msedge.exe
File created	C:\Program Files\scoped_dir4196_1842415328\Default\EdgePushStorageWithConnectTokens\LOG	msedge.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe	2026-08-08_f436d533fc03792cbc34f6a95bf855d2_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\Program Files\scoped_dir4196_1842415328\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\656b3350-57ac-46a7-99d2-377541cdb760\54bfb130d33d0df3_1	msedge.exe
File opened for modification	C:\Program Files\scoped_dir4196_1842415328\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\656b3350-57ac-46a7-99d2-377541cdb760\b15bd87405c3b242_1	msedge.exe
File opened for modification	C:\Program Files\scoped_dir4196_1842415328\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\656b3350-57ac-46a7-99d2-377541cdb760\b6a609a2a4d72ee3_0	msedge.exe
File opened for modification	C:\Program Files\scoped_dir4196_1842415328\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\656b3350-57ac-46a7-99d2-377541cdb760\b6a609a2a4d72ee3_s	msedge.exe
File opened for modification	C:\Program Files\scoped_dir4196_1842415328\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\656b3350-57ac-46a7-99d2-377541cdb760\fdf7f1b3277af979_s	msedge.exe
File opened for modification	C:\Program Files\scoped_dir4196_1842415328\Default\HubApps Icons	msedge.exe
File created	C:\Program Files\scoped_dir4196_1842415328\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\temp-index	msedge.exe
File opened for modification	C:\Program Files\scoped_dir4196_1842415328\Default\Cache\Cache_Data\f_000015	msedge.exe
File created	C:\Program Files\scoped_dir4196_1842415328\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\656b3350-57ac-46a7-99d2-377541cdb760\bd3f9ee3f2e520bc_1	msedge.exe
File opened for modification	C:\Program Files\scoped_dir4196_1842415328\Default\Code Cache\js\e11da465fdecaa3f_1	msedge.exe
File opened for modification	C:\Program Files\scoped_dir4196_1842415328\Default\Code Cache\js\33ca4c796610002b_0	msedge.exe
File created	C:\Program Files\scoped_dir4196_1842415328\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\656b3350-57ac-46a7-99d2-377541cdb760\8bfc77f05f6a3cc5_0	msedge.exe
File opened for modification	C:\Program Files\scoped_dir4196_1842415328\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\656b3350-57ac-46a7-99d2-377541cdb760\e86f2befc494797d_s	msedge.exe
File created	C:\Program Files\scoped_dir4196_1842415328\Default\Cache\Cache_Data\f_000016	msedge.exe
File created	C:\Program Files\scoped_dir4196_1842415328\Default\ClientCertificates\LOG	msedge.exe
File created	C:\Program Files\scoped_dir4196_1842415328\Default\GPUCache\data_3	msedge.exe
File opened for modification	C:\Program Files\scoped_dir4196_1842415328\Default\Cache\Cache_Data	msedge.exe
File opened for modification	C:\Program Files\scoped_dir4196_1842415328\Default\SharedStorage-journal	msedge.exe
File opened for modification	C:\Program Files\scoped_dir4196_1842415328\Default\Code Cache\js\fe43979d926f240b_1	msedge.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	2026-08-08_f436d533fc03792cbc34f6a95bf855d2_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MICROS~3.EXE	2026-08-08_f436d533fc03792cbc34f6a95bf855d2_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\Program Files\scoped_dir4196_1842415328\Default\DawnGraphiteCache\data_1	msedge.exe
File opened for modification	C:\Program Files\scoped_dir4196_1842415328\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnWebGPUCache\index	msedge.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MIA062~1.EXE	2026-08-08_f436d533fc03792cbc34f6a95bf855d2_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File created	C:\Program Files\scoped_dir4196_1842415328\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\656b3350-57ac-46a7-99d2-377541cdb760\a3e01eed58a51e5c_0	msedge.exe
File created	C:\Program Files\scoped_dir4196_1842415328\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\656b3350-57ac-46a7-99d2-377541cdb760\e4071f6047faef52_0	msedge.exe
File opened for modification	C:\Program Files\scoped_dir4196_1842415328\Default\Code Cache\js\f5d3d485b75962bb_s	msedge.exe
File opened for modification	C:\Program Files\scoped_dir4196_1842415328\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\656b3350-57ac-46a7-99d2-377541cdb760\a3972e9e39b4462d_1	msedge.exe
File created	C:\Program Files\scoped_dir4196_1842415328\Default\Code Cache\js\648f438c0428b6ef_0	msedge.exe
File created	C:\Program Files\scoped_dir4196_1842415328\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\656b3350-57ac-46a7-99d2-377541cdb760\2a129ff85c6b1559_0	msedge.exe
File opened for modification	C:\Program Files\scoped_dir4196_1842415328\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\656b3350-57ac-46a7-99d2-377541cdb760\8bfc77f05f6a3cc5_0	msedge.exe
File opened for modification	C:\Program Files\scoped_dir4196_1842415328\Default\GPUCache\data_0	msedge.exe
File created	C:\Program Files\scoped_dir4196_1842415328\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\656b3350-57ac-46a7-99d2-377541cdb760\f1b076f89f1cca1b_0	msedge.exe
File opened for modification	C:\Program Files\scoped_dir4196_1842415328\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\656b3350-57ac-46a7-99d2-377541cdb760\37640da1723e1552_s	msedge.exe
File created	C:\Program Files\scoped_dir4196_1842415328\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\656b3350-57ac-46a7-99d2-377541cdb760\834d4a49393b64cb_1	msedge.exe
File opened for modification	C:\Program Files\scoped_dir4196_1842415328\Default\WebAssistDatabase	msedge.exe
File opened for modification	C:\Program Files\scoped_dir4196_1842415328\first_party_sets.db	msedge.exe
File opened for modification	C:\Program Files\scoped_dir4196_1842415328\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\656b3350-57ac-46a7-99d2-377541cdb760\df9f3044c9ae2e2e_s	msedge.exe
File opened for modification	C:\Program Files\scoped_dir4196_1842415328\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\656b3350-57ac-46a7-99d2-377541cdb760\e6504c209cb882d7_1	msedge.exe
File opened for modification	C:\Program Files\scoped_dir4196_1842415328\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\656b3350-57ac-46a7-99d2-377541cdb760\d6af3918ca46ca94_0	msedge.exe
File opened for modification	C:\Program Files\scoped_dir4196_1842415328\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\656b3350-57ac-46a7-99d2-377541cdb760\23a0157058caba46_1	msedge.exe
File opened for modification	C:\Program Files\scoped_dir4196_1842415328\ShaderCache\data_2	msedge.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svchost.com	2026-08-08_f436d533fc03792cbc34f6a95bf855d2_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\Windows\svchost.com	identity_helper.exe
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	identity_helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_f436d533fc03792cbc34f6a95bf855d2_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3528	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306822257454123"	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{EE37BF1F-3D1E-487D-8405-42879C770ACA}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	identity_helper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	2026-08-08_f436d533fc03792cbc34f6a95bf855d2_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4328	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 380 wrote to memory of 4196	380	2026-08-08_f436d533fc03792cbc34f6a95bf855d2_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe	87
PID 4196 wrote to memory of 4328	4196	2026-08-08_f436d533fc03792cbc34f6a95bf855d2_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe	88
PID 4328 wrote to memory of 2816	4328	msedge.exe	89
PID 4328 wrote to memory of 3012	4328	msedge.exe	90
PID 4328 wrote to memory of 3528	4328	msedge.exe	91
PID 4328 wrote to memory of 3012	4328	msedge.exe	90
PID 4328 wrote to memory of 3012	4328	msedge.exe	90
PID 4328 wrote to memory of 1112	4328	msedge.exe	92
PID 4328 wrote to memory of 1112	4328	msedge.exe	92
PID 4328 wrote to memory of 2008	4328	msedge.exe	93
PID 4328 wrote to memory of 2008	4328	msedge.exe	93
PID 4328 wrote to memory of 2008	4328	msedge.exe	93
PID 4328 wrote to memory of 312	4328	msedge.exe	94
PID 4328 wrote to memory of 312	4328	msedge.exe	94
PID 4328 wrote to memory of 312	4328	msedge.exe	94
PID 4328 wrote to memory of 3444	4328	msedge.exe	95
PID 4328 wrote to memory of 3444	4328	msedge.exe	95
PID 4328 wrote to memory of 3444	4328	msedge.exe	95
PID 4328 wrote to memory of 1452	4328	msedge.exe	97
PID 4328 wrote to memory of 1452	4328	msedge.exe	97
PID 4328 wrote to memory of 1452	4328	msedge.exe	97
PID 4328 wrote to memory of 3344	4328	msedge.exe	101
PID 4328 wrote to memory of 3344	4328	msedge.exe	101
PID 4328 wrote to memory of 3344	4328	msedge.exe	101
PID 4328 wrote to memory of 220	4328	msedge.exe	96
PID 4328 wrote to memory of 220	4328	msedge.exe	96
PID 4328 wrote to memory of 220	4328	msedge.exe	96
PID 4328 wrote to memory of 3944	4328	msedge.exe	98
PID 4328 wrote to memory of 3944	4328	msedge.exe	98
PID 4328 wrote to memory of 3944	4328	msedge.exe	98
PID 4328 wrote to memory of 1844	4328	msedge.exe	99
PID 4328 wrote to memory of 1844	4328	msedge.exe	99
PID 4328 wrote to memory of 1844	4328	msedge.exe	99
PID 4328 wrote to memory of 3292	4328	msedge.exe	100
PID 4328 wrote to memory of 3292	4328	msedge.exe	100
PID 4328 wrote to memory of 3292	4328	msedge.exe	100
PID 4328 wrote to memory of 3316	4328	msedge.exe	102
PID 4328 wrote to memory of 3316	4328	msedge.exe	102
PID 4328 wrote to memory of 3316	4328	msedge.exe	102
PID 4328 wrote to memory of 1612	4328	msedge.exe	104
PID 4328 wrote to memory of 3480	4328	msedge.exe	103
PID 4328 wrote to memory of 1612	4328	msedge.exe	104
PID 4328 wrote to memory of 1612	4328	msedge.exe	104
PID 4328 wrote to memory of 3480	4328	msedge.exe	103
PID 4328 wrote to memory of 3480	4328	msedge.exe	103
PID 4328 wrote to memory of 2348	4328	msedge.exe	105
PID 4328 wrote to memory of 2348	4328	msedge.exe	105
PID 4328 wrote to memory of 1424	4328	msedge.exe	109
PID 4328 wrote to memory of 1424	4328	msedge.exe	109
PID 4328 wrote to memory of 1448	4328	msedge.exe	108
PID 4328 wrote to memory of 1448	4328	msedge.exe	108
PID 4328 wrote to memory of 5388	4328	msedge.exe	115
PID 5388 wrote to memory of 5536	5388	identity_helper.exe	117
PID 5536 wrote to memory of 5576	5536	svchost.com	118
PID 4328 wrote to memory of 5144	4328	msedge.exe	121
PID 4328 wrote to memory of 5144	4328	msedge.exe	121
PID 4328 wrote to memory of 5272	4328	msedge.exe	122
PID 4328 wrote to memory of 5272	4328	msedge.exe	122
PID 4328 wrote to memory of 216	4328	msedge.exe	123
PID 4328 wrote to memory of 216	4328	msedge.exe	123
PID 4328 wrote to memory of 608	4328	msedge.exe	124
PID 4328 wrote to memory of 608	4328	msedge.exe	124
PID 4328 wrote to memory of 5480	4328	msedge.exe	125
PID 4328 wrote to memory of 5480	4328	msedge.exe	125

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2876
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\IDENTI~1.EXE" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4196_1842415328" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2056,i,1682743777626057861,17399818904875578858,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=7500 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5536
- - C:\Users\Admin\AppData\Local\Temp\3582-490\IDENTI~1.EXE
    C:\Users\Admin\AppData\Local\Temp\3582-490\IDENTI~1.EXE --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4196_1842415328" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2056,i,1682743777626057861,17399818904875578858,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=7500 /prefetch:8
    3⤵
    - Executes dropped EXE
    PID:5576

C:\Users\Admin\AppData\Local\Temp\2026-08-08_f436d533fc03792cbc34f6a95bf855d2_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_f436d533fc03792cbc34f6a95bf855d2_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe"
1⤵
- Checks computer location settings
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:380
- C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-08_f436d533fc03792cbc34f6a95bf855d2_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-08_f436d533fc03792cbc34f6a95bf855d2_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless=new --user-data-dir="C:\Program Files\scoped_dir4196_1842415328"
    3⤵
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Program Files\scoped_dir4196_1842415328" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\scoped_dir4196_1842415328\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x244,0x7ffd22afc188,0x7ffd22afc194,0x7ffd22afc1a0
      4⤵
      PID:2816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4196_1842415328" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --field-trial-handle=2056,i,1682743777626057861,17399818904875578858,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:2
      4⤵
      PID:3012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4196_1842415328" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2056,i,1682743777626057861,17399818904875578858,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:3
      4⤵
      Drops file in Program Files directory
      System Time Discovery
      PID:3528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4196_1842415328" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2056,i,1682743777626057861,17399818904875578858,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:8
      4⤵
      PID:1112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4196_1842415328" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2056,i,1682743777626057861,17399818904875578858,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3368 /prefetch:1
      4⤵
      PID:2008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4196_1842415328" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2056,i,1682743777626057861,17399818904875578858,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:1
      4⤵
      PID:312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4196_1842415328" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2056,i,1682743777626057861,17399818904875578858,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:1
      4⤵
      PID:3444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4196_1842415328" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2056,i,1682743777626057861,17399818904875578858,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:2
      4⤵
      PID:220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4196_1842415328" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=2056,i,1682743777626057861,17399818904875578858,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:1
      4⤵
      PID:1452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4196_1842415328" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=2056,i,1682743777626057861,17399818904875578858,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3888 /prefetch:2
      4⤵
      PID:3944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4196_1842415328" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=2056,i,1682743777626057861,17399818904875578858,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3980 /prefetch:1
      4⤵
      PID:1844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4196_1842415328" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=2056,i,1682743777626057861,17399818904875578858,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3904 /prefetch:2
      4⤵
      PID:3292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4196_1842415328" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=2056,i,1682743777626057861,17399818904875578858,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4064 /prefetch:2
      4⤵
      PID:3344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4196_1842415328" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=2056,i,1682743777626057861,17399818904875578858,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3988 /prefetch:1
      4⤵
      PID:3316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4196_1842415328" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=2056,i,1682743777626057861,17399818904875578858,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4048 /prefetch:1
      4⤵
      PID:3480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4196_1842415328" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=2056,i,1682743777626057861,17399818904875578858,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:2
      4⤵
      PID:1612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4196_1842415328" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2056,i,1682743777626057861,17399818904875578858,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:8
      4⤵
      PID:2348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4196_1842415328" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2056,i,1682743777626057861,17399818904875578858,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
      4⤵
      PID:1448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4196_1842415328" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2056,i,1682743777626057861,17399818904875578858,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
      4⤵
      PID:1424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4196_1842415328" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2056,i,1682743777626057861,17399818904875578858,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=7500 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:5364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4196_1842415328" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2056,i,1682743777626057861,17399818904875578858,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=7500 /prefetch:8
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Checks computer location settings
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:5388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4196_1842415328" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2056,i,1682743777626057861,17399818904875578858,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:8
      4⤵
      PID:5144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4196_1842415328" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2056,i,1682743777626057861,17399818904875578858,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:8
      4⤵
      PID:5272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4196_1842415328" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2056,i,1682743777626057861,17399818904875578858,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=7288 /prefetch:8
      4⤵
      PID:216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4196_1842415328" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2056,i,1682743777626057861,17399818904875578858,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:8
      4⤵
      PID:608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Program Files\scoped_dir4196_1842415328" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2056,i,1682743777626057861,17399818904875578858,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:8
      4⤵
      PID:5480

C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-08_f436d533fc03792cbc34f6a95bf855d2_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-08_f436d533fc03792cbc34f6a95bf855d2_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
1⤵
- Executes dropped EXE
PID:5164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ACROBR~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE
Size 328KB
SHA256 888a1dd0033e5d758a4e731e3e55357de866e80d03b1b194375f714e1fd4351d
MD5 39c8a4c2c3984b64b701b85cb724533b
SHA1 c911f4c4070dfe9a35d9adcb7de6e6fb1482ce00
SHA512 f42ca2962fe60cff1a13dea8b81ff0647b317c785ee4f5159c38487c34d33aecba8478757047d31ab2ee893fbdcb91a21655353456ba6a018fc71b2278db4db2
SSDEEP 6144:k9x6edjvw6L6jAVnhH1Am2ZBU4M528hW8Bi7Q5VYN9:Y6exwI1oB8RZ4Q5VYH
TLSH
T1DC645B017F908EB6F5A2807F5D7A631D5A6ABA221B10E2C373703B5DCD321C59A3E356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ACROTE~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
Size 86KB
SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
MD5 3b73078a714bf61d1c19ebc3afc0e454
SHA1 9abeabd74613a2f533e2244c9ee6f967188e4e7e
SHA512 75959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4
SSDEEP 1536:JxqjQ+P04wsmJCNgh/sE/EkHd0Ci2zkQASqk+H6L2C:sr85CysEM6GC+QA8+HlC
TLSH
T17493AE13FAF18872D1621BF89C29E359C93F7A306E3056A7A3E40D5D5D747C26C2924B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ADOBEC~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE
Size 5.7MB
SHA256 1b5c715d71384f043843ea1785a6873a9f39d2daae112ccdeffcd88b10a3a403
MD5 09acdc5bbec5a47e8ae47f4a348541e2
SHA1 658f64967b2a9372c1c0bdd59c6fb2a18301d891
SHA512 3867bf98e1a0e253114a98b78b047b0d8282b5abf4aaf836f31cc0e26224e2a1b802c65df9d90dc7696a6dbcb9a8e4b900f1d1299e1b11e36f095ebaf8a2e5b8
SSDEEP 49152:DmlI9H9rY654KYroYJqkhWFUBlNwnFq3kXRsPI6BRY20YZAliDgFL2YmXZjU2P38:oiH9MfT3NwMkKhBRr0yAk6qkKvq
TLSH
T1F3567C22B902C139E15102B159ECBFE9C49D99348FB105DFBAC41F6E9A613E33931E67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ADelRCP.exe

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe
Size 175KB
SHA256 3f00404dd591c2856e6f71bd78423ed47199902e0b85f228e6c4de72c59ddffe
MD5 576410de51e63c3b5442540c8fdacbee
SHA1 8de673b679e0fee6e460cbf4f21ab728e41e0973
SHA512 f7761f3878775b30cc3d756fa122e74548dfc0a27e38fa4109e34a59a009df333d074bf14a227549ae347605f271be47984c55148685faac479aeb481f7191db
SSDEEP 3072:sr85CnHb5CZCq5DACsVlNl7HIJ1PcJ7LxnkdA53Pa4sjSTX4:k9n4N5QVrZZ7Lxkmsjj
TLSH
T119045C22BBC09075E69317723EFC79E44BF6BC319AA410ABF318495B197E350963931B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RdrCEF.exe

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe
Size 9.4MB
SHA256 31da9632f5d25806b77b617d48da52a14afc574bbe1653120f97705284ea566c
MD5 322302633e36360a24252f6291cdfc91
SHA1 238ed62353776c646957efefc0174c545c2afa3d
SHA512 5a1f7c44ce7f5036bffc18ebac39e2bf70e6f35fa252617d665b26448f4c4473adfa115467b7e2d9b7068823e448f74410cdcdfef1ac1c09021e051921787373
SSDEEP 98304:FrbT5JhEP+SuC0qyLfPeLDo/uLGM7gbl91hxkPZTA:lXnfW/JLGMcblLheTA
TLSH
T186A6AF1D7BE21036CD732176AF4FA104E739D007A215C6977ADC83981FB1AA152B6FE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcroRd32.exe

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
Size 2.4MB
SHA256 8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6
MD5 8ffc3bdf4a1903d9e28b99d1643fc9c7
SHA1 919ba8594db0ae245a8abd80f9f3698826fc6fe5
SHA512 0b94ead97374d74eaee87e7614ddd3911d2cf66d4c49abbfd06b02c03e5dd56fd00993b4947e8a4bcd9d891fa39cab18cc6b61efc7d0812e91eb3aea9cd1a427
SSDEEP 49152:oTfiUEWo6zuEz439z99akTBc4O8b8ITDnlT4NvJX:oTfiG/nzU90T
TLSH
T179C59226A2C8C0EBE5642170CC59BBF900546D78DBA2CDD7BD447E16BA307D29533A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WCCHRO~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE
Size 183KB
SHA256 ecd5e94da88c653e4c34b6ab325e0aca8824247b290336f75c410caa16381bc5
MD5 9dfcdd1ab508b26917bb2461488d8605
SHA1 4ba6342bcf4942ade05fb12db83da89dc8c56a21
SHA512 1afc1b95f160333f1ff2fa14b3f22a28ae33850699c6b5498915a8b6bec1cfc40f33cb69583240aa9206bc2ea7ab14e05e071275b836502a92aa8c529fc1b137
SSDEEP 3072:sr85Cl8pIsfHwCbf9MFdRvyAgnz8n/dfQ7PjFKq23T/h:k9KbfHwCbyFdAafCPc53T/h
TLSH
T177046B51F7C7C9B2E09206704C2AAF6541B9FE381F7105EBF3E87A1E5A713C2182566B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eula.exe

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe
Size 131KB
SHA256 5c3ef3ec7594c040146e908014791dd15201ba58b4d70032770bb661b6a0e394
MD5 5791075058b526842f4601c46abd59f5
SHA1 b2748f7542e2eebcd0353c3720d92bbffad8678f
SHA512 83e303971ed64019fde9e4ba6f6e889f8fb105088490dfa7dcf579a12baff20ef491f563d132d60c7b24a4fd3cac29bd9dc974571cd162000fae8fba4e0e54fb
SSDEEP 3072:sr85Ciq9YnyoRmLisiselSsONt3F7oQGO7M1bp:k9kgLHvld2
TLSH
T19CD37C13BBE0C872D66207785D25F36696AFF6305E74CB677B880B0E9DB46824D0C64A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FULLTR~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE
Size 254KB
SHA256 16d65f2463658a72dba205dcaa18bc3d0bab4453e726233d68bc176e69db0950
MD5 4ddc609ae13a777493f3eeda70a81d40
SHA1 8957c390f9b2c136d37190e32bccae3ae671c80a
SHA512 9d7f90d1529cab20078c2690bf7bffab5a451a41d8993781effe807e619da0e7292f991da2f0c5c131b111d028b3e6084e5648c90816e74dfb664e7f78181bc5
SSDEEP 3072:sr85CYl4dsOc6v2vTzwU+Pho86meq+FaSoB2+vSHr8qcVz5fzsC:k9r3PiY+Fa7BdvG1cT7
TLSH
T128446B307B86C53BE66301718CF8EBBF942EBA150F6851D7B3984B5E5EA05D32E31846
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOGTRA~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE
Size 386KB
SHA256 473eb551101caeaf2d18f811342e21de323c8dd19ed21011997716871defe997
MD5 8c753d6448183dea5269445738486e01
SHA1 ebbbdc0022ca7487cd6294714cd3fbcb70923af9
SHA512 4f6fddefc42455540448eac0b693a4847e21b68467486376a4186776bfe137337733d3075b7b87ed7dac532478dc9afc63883607ec8205df3f155fee64c7a9be
SSDEEP 6144:k9W3n0dK2NP0RHx8D98WTBPW8fF8oABm1nKZ0RsrI:WKhHSDeWTRW8fdebmqI
TLSH
T16A84AE11FB86C172D96602728DAAA35CC4BDB5714F314BD3E3DC6F0D9E601D2A932B86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

READER~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE
Size 92KB
SHA256 2f947e3ca624ce7373080b4a3934e21644fb070a53feeaae442b15b849c2954f
MD5 176436d406fd1aabebae353963b3ebcf
SHA1 9ffdfdb8cc832a0c6501c4c0e85b23a0f7eff57a
SHA512 a2d1a714e0c1e5463260c64048ba8fd5064cfa06d4a43d02fc04a30748102ff5ba86d20a08e611e200dc778e2b7b3ae808da48132a05a61aa09ac424a182a06a
SSDEEP 1536:JxqjQ+P04wsmJC66w8MghW4wNlu9HQIXsW/44:sr85C66w8oFlKwW//
TLSH
T1E1936C13BB928E33D4204AB91C6997B8D4BEF5306F1556E367650A4E8DBC3C22C3925F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WOW_HE~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE
Size 147KB
SHA256 750824b5f75c91a6c2eeb8c5e60ae28d7a81e323d3762c8652255bfea5cba0bb
MD5 3b35b268659965ab93b6ee42f8193395
SHA1 8faefc346e99c9b2488f2414234c9e4740b96d88
SHA512 035259a7598584ddb770db3da4e066b64dc65638501cdd8ff9f8e2646f23b76e3dfffa1fb5ed57c9bd15bb4efa3f7dd33fdc2e769e5cc195c25de0e340eb89ab
SSDEEP 3072:sr85Ce6l8TRpR+EMucyaGoS43IIJNdS3UA:k9e6l8aGo/3VL4kA
TLSH
T15EE38C57B7E134F8E1768A78CC615608EB32B8352A319BAF03A4065A5F273C05E3DF25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arh.exe

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe
Size 125KB
SHA256 fe44ca8d5050932851aa54c23133277e66db939501af58e5aeb7b67ec1dde7b5
MD5 cce8964848413b49f18a44da9cb0a79b
SHA1 0b7452100d400acebb1c1887542f322a92cbd7ae
SHA512 bf8fc270229d46a083ced30da6637f3ca510b0ce44624a9b21ec6aacac81666dffd41855053a936aa9e8ea6e745a09b820b506ec7bf1173b6f1837828a35103d
SSDEEP 1536:JxqjQ+P04wsmJCWM2D57Kykf8d/R8Tyr5J5is7MDjrXDyO4zkm8dbHVLokF8iJTp:sr85CCQw/STyr5Jks7MvrMzkm8PL3Eo
TLSH
T127C3AE22F6A1C432D4920D788919C3B18E3F7D3169A99957F7E80B5E9E607C0EA1D31F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32BITM~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE
Size 142KB
SHA256 3e9da97a7106122245e77f13f3f3cc96c055d732ab841eb848d03ac25401c1bc
MD5 92dc0a5b61c98ac6ca3c9e09711e0a5d
SHA1 f809f50cfdfbc469561bced921d0bad343a0d7b4
SHA512 d9eefb19f82e0786d9be0dbe5e339d25473fb3a09682f40c6d190d4c320cca5556abb72b5d97c6b0da4f8faefdc6d39ac9d0415fdf94ebcc90ecdf2e513c6a31
SSDEEP 1536:JxqjQ+P04wsmJC9S7UmwuBLAefbVH8x+FOI31EmkIY2d5J6WUghEuireklhKsikg:sr85Cs7HN9fN8sFOE1Z5Y2966ilU9xL
TLSH
T1F2E38D21F5C188B2E67205B54D2AA79E942CF6340F3194E3B3E84F2D9D342C39F765A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

64BITM~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE
Size 278KB
SHA256 22a585c183e27b3c732028ff193733c2f9d03700a0e95e65c556b0592c43d880
MD5 12c29dd57aa69f45ddd2e47620e0a8d9
SHA1 ba297aa3fe237ca916257bc46370b360a2db2223
SHA512 255176cd1a88dfa2af3838769cc20dc7ad9d969344801f07b9ebb372c12cee3f47f2dba3559f391deab10650875cad245d9724acfa23a42b336bfa96559a5488
SSDEEP 6144:k9P1UKupTu8ffMb0/GxsZfcJtqQ1UBZ6g:jK+HMYcytZh
TLSH
T105546C1A77D84CF5E467C23DCD528642E2B278551B34D7CB6760022AAF637E0AE3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ADOBEA~1.EXE

Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE
Size 454KB
SHA256 bb07d817b8b1b6b4c25e62b6120e51dec10118557d7b6b696ad084a5ba5bfdeb
MD5 bcd0f32f28d3c2ba8f53d1052d05252d
SHA1 c29b4591df930dabc1a4bd0fa2c0ad91500eafb2
SHA512 79f407735853f82f46870c52058ceee4d91857a89db14868ee1169abd5c0fd2e3fa1ed230ab90b5f479a9581b88998643d69b0df498defea29e73b0d487f3b10
SSDEEP 6144:k9sQsSVWSLjX2PxPNMRyfn7LzPdKblt0K+HAfh0v8axsbQuXYvr6yIll6Jf:+VWnxlMSn7nFKbltn+Ch/m6Xl6l
TLSH
T1E1A47C1077D0C036F1B329768A7FE728546DB9715F6881CFE3881A6E4E706E0AA3571B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.exe

Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe
Size 1.2MB
SHA256 b1ec065f71cc40f400e006586d370997102860504fd643b235e8ed9f5607262a
MD5 d47ed8961782d9e27f359447fa86c266
SHA1 d37d3f962c8d302b18ec468b4abe94f792f72a3b
SHA512 3e33f2cdf35024868b183449019de9278035e7966b342ba320a6c601b5629792cbb98a19850d4ca80b906c85d10e8503b0193794d1f1efa849fa33d26cff0669
SSDEEP 12288:M0ZRHkXVfeeO4LMneqyQsWSjGQCfLBlS7guN1AnQ6i12NI+03Sgouvb:M0ZRHkFfenxyQZXS7gZnQh2NIDSgouvb
TLSH
T19D45E50267F94129F1F37B71EEB993645A77BC61AE39C50E5284025E0DB4A90EE31B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaureg.exe

Path C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe
Size 555KB
SHA256 c5a99f42100834599e4995d0a178b32b772a6e774a4050a6bb00438af0a6a1f3
MD5 ce82862ca68d666d7aa47acc514c3e3d
SHA1 f458c7f43372dbcdac8257b1639e0fe51f592e28
SHA512 bca7afd6589c3215c92fdaca552ad3380f53d3db8c4b69329a1fa81528dd952a14bf012321de92ad1d20e5c1888eab3dd512b1ac80a406baccc37ee6ff4a90dc
SSDEEP 12288:PKv89GDYikjjqggz7/PtFxRNWBYrpkQJ7u:PKqjjg/PzNWyr9J7u
TLSH
T1A5C4BF2079A0C032D17311344D6AE794A63EF6700E7249E777D46FBD7E346C1EB28AA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOIN~1.EXE

Path C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE
Size 121KB
SHA256 405b8bd647fa703e233b8b609a18999abe465a8458168f1daf23197bd2ea36aa
MD5 cbd96ba6abe7564cb5980502eec0b5f6
SHA1 74e1fe1429cec3e91f55364e5cb8385a64bb0006
SHA512 a551001853f6b93dfbc6cf6a681820af31330a19d5411076ff3dbce90937b3d92173085a15f29ebf56f2ef12a4e86860ac6723ebc89c98ea31ea7a6c7e3d7cdc
SSDEEP 3072:sr85CqPo10JOSdhuPlur1Vg9uCRFRzsxeZ:k9qg1MOc4iVmRFJs0Z
TLSH
T114C37C22F9E0C032D4A219B88DACD261593E7A721B3589C337A41BDDDDB03C1AE79357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe
Size 325KB
SHA256 5e2e22ead49ce9cc11141dbeebbe5b93a530c966695d8efc2083f00e6be53423
MD5 9a8d683f9f884ddd9160a5912ca06995
SHA1 98dc8682a0c44727ee039298665f5d95b057c854
SHA512 6aecf8c5cb5796d6879f8643e20c653f58bad70820896b0019c39623604d5b3c8a4420562ab051c6685edce60aa068d9c2dbb4413a7b16c6d01a9ac10dc22c12
SSDEEP 6144:k9/jbN5zFEjGkqkAJHyEzYV/PvyeWPZw22b:GjzzFEoS2cPvyeiZwbb
TLSH
T19D649EA5B3901CF4EC63453ECC258916D6B27C2A0B70C65F13A8366A5F733911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe
Size 325KB
SHA256 e2262c798729169f697e6c30e5211cde604fd8b14769311ff4ea81abba8c2781
MD5 892cf4fc5398e07bf652c50ef2aa3b88
SHA1 c399e55756b23938057a0ecae597bd9dbe481866
SHA512 f16a9e4b1150098c5936ec6107c36d47246dafd5a43e9f4ad9a31ecab69cc789c768691fa23a1440fae7f6e93e8e62566b5c86f7ed6bb4cfe26368149ea8c167
SSDEEP 6144:k9/eWYoTOLHIsPPzAdnz0YutYPDvh2AHdwSc:GeWYoaLHF3z0z04PDvh2Cd9c
TLSH
T15A649EA5B3901CF4EC67853ECC258916D6B27C2A0B70C65F13B8366A5F333911D2DB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe
Size 505KB
SHA256 da73b6e071788372702104b9c72b6697e84e7c75e248e964996700b77c6b6f1c
MD5 452c3ce70edba3c6e358fad9fb47eb4c
SHA1 d24ea3b642f385a666159ef4c39714bec2b08636
SHA512 fe8a0b9b1386d6931dc7b646d0dd99c3d1b44bd40698b33077e7eeba877b53e5cb39ff2aa0f6919ccab62953a674577bc1b2516d9cadc0c051009b2083a08085
SSDEEP 6144:k9/4aKTRnXtTkCgwCzUg/HpjN4IBwu7QTLbpqmHdIvWTiYB2n5:GHWRdTfgwCHKy7GLbbdIvWTi4e5
TLSH
T178B43990F3E414F4F0B79A3589764511DAB67C6A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DISABL~1.EXE

Path C:\PROGRA~2\Google\Update\DISABL~1.EXE
Size 5.7MB
SHA256 3acf99624820fd862ac30780021108f0ff2df60db3df351cd17400404f279d3c
MD5 e63e539e0f0393fdea9da0d6ee80ac45
SHA1 027c8609ca7bb42b61256abb3269e1babce0141b
SHA512 f4d0458b8bfe5a66254cb85b8ba3859c9d6a937e6d14f8e15b95b7e131aaeff8a1be39f0eee3939e305901797d98dd2c5aac1837873a49f786cfcac0c9b1e6d6
SSDEEP 98304:Fog5HQ+hDHQTW6Af4fF7KkOuYO6IgF+IAMk/JexMXP8iuHG9XXYXQz7w7:Fog1P9fIlOuz6IgF+I3m2MXP6HG8QzU
TLSH
T133567C23A4E08034E5F732756D2CA73959327BA29F3145CB86946C946FB83D3293936F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IE_TO_~1.EXE

Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\BHO\IE_TO_~1.EXE
Size 557KB
SHA256 6bb357968887ad126579fb157f455e359ea036a4960a9f98f5cec1fe53931c98
MD5 2b03f86c9209825849c716434fb730bf
SHA1 1148f00cf40b0872e08f47b38bbd0c9858802aa3
SHA512 8d9b5be64e9843ec8d05af21a951e8a7501fc8fb1fc4179959ec60ea150810c0db83b7e8cedb32c44b58a0f81d09c13c4d9d8b0536711978accf47709382e71a
SSDEEP 6144:k9gGr2dzO3/lSs3AaNCaBVSa+FvChdrNSuhwK5i43FvGvu6SiZ9aD:ZGr2d29S4AaQtMhdrNSuvt+WDin2
TLSH
T1C7C49D41B3E846F9E06AC534CA438642EA7278560F34E6DF02E492792F37BE55F3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

COOKIE~1.EXE

Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\COOKIE~1.EXE
Size 161KB
SHA256 5fee43e3295682e179d6e10c568aeb640bbbcf0d6b962fd27f5b372a45fc272d
MD5 b67dba91dd68c0c9c7c78899faf33033
SHA1 4374c00761ec34d6416096524eedf439636baa94
SHA512 7065a8c6552d7dff816e288056cc2bb371bbe078798df471369382a6620c0702020102f1c39485e0c57b65279a6f0484385944f7874575d8b4351c9fa03fd8f6
SSDEEP 3072:sr85CRJjEt/g/ptvjGL/PQQpbsZAk/kJHLRdtIJsF4FxFVN:k9RJjEt/gHGrtRtIJD1N
TLSH
T134F38C57B3E430F9E2364A78C8118645EB37B8310B21AFEF07A446591E277C59E3DB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\BHO\ie_to_edge_stub.exe
Size 562KB
SHA256 533d6da98378d3b1bb120b192bc5bd20bbeed6e123fe9fc6c15a4a3504932c71
MD5 dc797b816795fbca95de068b5fe4d089
SHA1 f5ed348926dd8c5b235dcac434bf3d7fba6b32fc
SHA512 e44d5b42d408ba7ad2c8c4b6f7af9f27650ab540afb68bc79f8bce4ad0b2843c67ab050b9d9568e9006756862199a90c6bf28483f889bf09257ed28af665147c
SSDEEP 6144:k9bLO76tlVr1Il5HlrJHU7kfLeeHVlK8SQBJ9LBKJwgdAmKa5rl6C:0S86nHrUA9HVlK8SQBJ9t4f15rR
TLSH
T161C48E41F3E847F8E07AC534CE528646EA7278960B61A6DF03A0527A2F376E55F3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\INSTAL~1\setup.exe
Size 7.1MB
SHA256 70c13c14a682d65fd82ec72f578e160617f8b7c164414bcce613a9b9ebd0c878
MD5 f80dd7e28ac5795b9cff0de19ea24bd3
SHA1 eb68d7d26bd4f849cefe6638bf4a3b73e3ce7a20
SHA512 af6ebd45c716d5c50395705dfa80c94c17fda338db24046051e82515b742cdc4f0503d2726278ba40a3b77e9b358f2b74704c851f28a8539dd77bee34b0e4fd4
SSDEEP 98304:V6CZetahq+WZxcpwCsJB2++fGOOxRj2vJzRN+T6frL:gCZetaEMGIG5xVqzRdDL
TLSH
T1A8766C47E3E600A8E46ED970CF2A9521DA353C8E47B492EF169476E41A32FD47B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cookie_exporter.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\cookie_exporter.exe
Size 155KB
SHA256 30d26d2f766f716cd6b21cdc15065ee4191760ef0d37de51f67dead898fb8e7c
MD5 ea213110894b1ad78e8e13686ff682c4
SHA1 49ea3bc31236ae9a32c600f7bb5cd66c49dafbdc
SHA512 77ec20210cffff94cf85ea1efb0551bc38000928b2af5f125b0597a281a3489f44d55b97dbbffba4f25e7f996a1d23d8734644f1cbd81ff3f8da42db6c9e64d9
SSDEEP 3072:sr85Co/5vndNI3Kk4+NLlzt4++++YdbeBGnRppeQBMWRywl9:k9ohvndNIaINY++++YtBnRpAFWcwl9
TLSH
T1B3F37B57B2E870F9E1324A78C8118605EB37B8711B21AFEF07A4065A1F277D19E3DB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevated_tracing_service.exe
Size 3.8MB
SHA256 c13ce5f473ff68ffdea61e8a4800008f527054f4561f2bf7853f6769d0c02dc5
MD5 b1de16babff63db612506d5dfcdd28f2
SHA1 4615a0df5812fc95be0f836b9d29a454da5bc67a
SHA512 5b3694c0a5f69d7ac74efe66a5b61f0b85cc73127a7805c0e93b8a368e0ee03eb72920d12988731cd9e43d7166e2cbe743deeeff02dc51a18301c14cfd394579
SSDEEP 49152:g6gu3VyrBme/hqvxbmhLbKqm006NPpIupEoEVu+e6NqcXToRzvUqIzYHBigdQBW:N3mMsYvRmCCENUhIUBbF
TLSH
T1A8063903F29900E8E05DD578CB568122EAB2BC854B35B2DF0750B7562E7BEE4AB3D750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevation_service.exe
Size 2.2MB
SHA256 8c53985c403e44c0c899c2d1f2a0b8afb1f17fb928ff866271de7952c9ff7c66
MD5 0db104178cbb26201b06ca53a8c18e39
SHA1 36cd76eb3cf04bd3cdf0fc3be4ec84fc52663040
SHA512 7c7871ad15851162facfb71f854f72869c833a68ed26c331d21c7900ac4fd87a5dcd9fc7ea2f494155b51d9b2f7c40a29dcd0cf06215ed7255c376106120dfe2
SSDEEP 49152:pb+632BuPkFKRrdE6oh2stBhuXjfS4LWxn9:/3q6DjBK
TLSH
T1A4B56B03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge.exe
Size 4.0MB
SHA256 18f4157c2dabb39cf84662e17c471f69f679840a70be3a4685e0c4ed8ccc207a
MD5 48d1aea6577f190f1e31b4ce9c2c3a83
SHA1 7bc44982c5a6bf7506d6f2dc4b2630caf0b263ce
SHA512 be71c8f0481b619aceb33b32a9222b0b6909fd07866f01374fc92fa08632ff01b7708166239c284bd1429a6b44f3edc351db346d877f174a369be9edb61dbbd5
SSDEEP 49152:GudQuVyBvNszCnSgVdQM3/+TjER7zExldDwUIDtaZHWRdpev2y/BaK:iijnUdYd+RaAK
TLSH
T121164903B29940D8D059C074CE5AD232EB617C8947F162EF3690B7EA2A73AD47B3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge_proxy.exe
Size 1.5MB
SHA256 b4bdab2b2c7731923854f254ba1494c25a11331293c0ee4939afd10ba1e2b575
MD5 8042d50db625ec28b95ecd7911222ac0
SHA1 a485755c8216c717a446bce8f2a7644328c59d1c
SHA512 8a0e4a53bb43933937d588fe6bf4754245136995d2603c4e3fcb8dd66cc8714b80255a52e75a31aac09223ed7b2f8d49594c20288aa2beeb802136f0f5f9b799
SSDEEP 24576:ryoteh6euUHmEhK7eTuNdfxINakEtv9kWG2L1oaedpEukUoygGmq/SJ:rfehjvHHKTdfxINPEt99G2Bo7EukU16
TLSH
T14C657B03F2D801E8D069D1B8C7568536E9B2BC450B24AAEF0B90B6591F7BFE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge_pwa_launcher.exe
Size 1.8MB
SHA256 2c31887681976e9691cfed32b98a9f81898beaaee9ea3f7a90fe695b84190511
MD5 650cdf4a369b08768ceaa48a2cfd7fdb
SHA1 d105394f9f806863e3d4a8611c76f291e13fe588
SHA512 4679c6a80bedb2de0d405037277b3c32cf04223e048ca90b79d3d709face5240cc8ad97d9bebd5f53617ce06b551421569a9e5434e68b4d6a5b7b8284155c1b6
SSDEEP 24576:Z5kAGu6McqpA7D9ruO3O7Q7OBLLMdus7CtW7KSdHBxmRkkkkkkklQXBysWAk:ZZGu6qG13O7Q7gLYduZrSdHBAVfk
TLSH
T142957C03F6DA80E5E05DC2B8CB768B35EA717C554F20A6DF0680BA652E77AD04B3D394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedgewebview2.exe
Size 3.4MB
SHA256 c0566225b047e50773acde8ada568ef7612809e74f2cc200504e60cf7a917c68
MD5 12403afd3d0b104f1d0f6cf034ed01f7
SHA1 08a9a2c1962f9f522c841dad14a55400a2b9e25b
SHA512 29a14f52b706b966361d9875ef3904560b41924fa959ce90985dd5e694d2ca9d0181509309bcb512563479fd5b5286cbef216e3ed5ed90cc170105f6dd13ec1c
SSDEEP 49152:DuZgk07G0auOj85q7aGScYbb6YErz7z4AkOuaRoBISCaQZCLlrrW:lo/Yhy8OnZ9
TLSH
T16CF54903A29900D8D059D074CF4A9223EBA27C8D47F566EF3690B6D52A77EE47B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_click_helper.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\notification_click_helper.exe
Size 1.6MB
SHA256 0faa9f1f62a95136d454efa51e6f8e8ff06a08d344fd26dc2216de09f6fbee4e
MD5 3b9687342c1ebc56dfa598bf9f0f8358
SHA1 794bcee37bfdcd2e8df01f9773c277629c5891b0
SHA512 addf3d1844271b0e54e8c665df1f85f521f0f14bd66bbf8fdd00eeee46315c294830d6d95e441cddbe6843b230064759e0d12e70b32690a431afdd45ee3aefbf
SSDEEP 24576:pnh1d46If99L9KA4uaiXJVB6HveuTJb9HxeQuJXlPnyF4mfHU9YawsNk:34hoNiZVB6PeuT5lxeHX04mfHIk
TLSH
T145856903F2D841E8D06DD2B8CB568122EAB27C450B34A6DF0791B65A1F7BEE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PWAHEL~1.EXE

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE
Size 1.4MB
SHA256 df233ebee614cd9117f7e467f16f4c2225aadbc59213a5695913a4a87f792d6a
MD5 67a7c8fa88aa1c40a5715ad4e0f8c4f0
SHA1 3d61b3c5b653549b835cbb5cae396e0e7b435b4e
SHA512 fbce329738386cc1670b58ea7c58d67cef047977d831af84e50cb811dd6cffdda5552156a0e1756d60fde2c67f3cd672bc4b6e12e2728eec70d4288e49f5efbb
SSDEEP 24576:WZGY26UEU3RyRPW+uSmS86IU8Gc7QGsVa4i6h27d3WlE:1Y2fF8FhmS86IUJWQn+6h27d/
TLSH
T152657C03F29940E8D059D1B8CB56853AEAB27C450B34A6EF0B90B7552F7BEE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
Size 1.4MB
SHA256 cd0adfcf43373e05fcf8836cc998cb17e3aaade9f8b190e28ce4331bd026f23c
MD5 aeb91dca670fae787b272163af7828ca
SHA1 a40927cc53e24d516f86042279684973fc85b77a
SHA512 f7a6aac88fcc029cd551cb4f336fb860d06b4f0094fea7a38a70aa8f25aa1f17300fda60a989ae89e558be15dc4e31dd74365e53ed44d3a3a41126e191297833
SSDEEP 24576:YmjDvw6qZ04SuTjPn68TQuD3g9gZLfChjyosZ9HT1zYeHNrk9NrfZ3:BDvwZ2XuTjPb33g9gZLfCdW9HTlXrk9T
TLSH
T113657B03F29900E9D059D1B8C7568536EAB2BC450B34A6EF0B90B7552E3BFE46B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Program Files\scoped_dir4196_1842415328\Crashpad\settings.dat
Size 280B
SHA256 f32cf1e4b5fa33eb2f754a22f50350146c19ffa952261df812cad264c7571d72
MD5 7fb738bd465dec62d832dcdb07545c87
SHA1 a17f5fc87e66750bf9c676b81237ef33fac16a06
SHA512 c4707467d928fae3c49b63692bc5d308681177ec79e8719e745885c6d20b84c062c011df73a5d5bbb97ba7c20bdbf86f9619affb3cbe273ac259ea2759c8f8a7
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Program Files\scoped_dir4196_1842415328\Crashpad\settings.dat
Size 280B
SHA256 9fe8e7925089fda723ef6a668e2a504389848dada45c0eaeecc4100eb4056f6c
MD5 b122923ff2a8d2ef0f2f14bc7e41c7c2
SHA1 a5aea76899054e592c7e428fa86ec3488340669b
SHA512 67a146b596476e128f31a068b83bb32dab1961f3194f9b81083a93ab3d90564a743118b577b209ff142f1ec58b0767aff38560a0e4be6db9f780ba8787d33c47
TLSH
T175D02202F3308A0CE8C220322083BA03AB00F20E02033FA08200C0823F0333A80000C0
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Program Files\scoped_dir4196_1842415328\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

31b5cbc9-03b7-40ec-86fe-746ad8053e70.tmp

Path C:\Program Files\scoped_dir4196_1842415328\Default\31b5cbc9-03b7-40ec-86fe-746ad8053e70.tmp
Size 29KB
SHA256 5ed4efbf8259821458aa695624ac0c6e0ef658207fd76f0ed175738538f24190
MD5 102898273846583c8b9308088c3dcedf
SHA1 929e2b570263acb52c165bbd835bc905a4557a13
SHA512 c94ec3b007394e21410e09c29ffd5f135742030001b75f016a2d7b355510699ba80e6d9c0b09a70ec26ba2d4b781a240c55e2685d82442226f1aa8620031a3fb
SSDEEP 768:plOb4w7pLuLfSuWDuCfk68F1+UoAYDCx9Tuqh0VfUC9xbog/OV1y3ySNlro0q:plOb48EfSuWDuCfk6u1jauy3nNez
TLSH
T14CD2DA7B640CCB7E4F804ADDDC2ABE9A6DA8028B95D8C95047FA941C03C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Program Files\scoped_dir4196_1842415328\Default\DawnGraphiteCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Program Files\scoped_dir4196_1842415328\Default\DawnGraphiteCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Program Files\scoped_dir4196_1842415328\Default\DawnGraphiteCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Program Files\scoped_dir4196_1842415328\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Program Files\scoped_dir4196_1842415328\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Program Files\scoped_dir4196_1842415328\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Program Files\scoped_dir4196_1842415328\Default\Preferences
Size 10KB
SHA256 6a61cfd7a187c845d54956461400c679a7e503e3286e52b058d288c7761cc464
MD5 e4fa140593911b9abcac9be29da7a06c
SHA1 0c91b8a1f1153418bd9579434c862e46e99d6d13
SHA512 1c910b54b13b2b4bfbe1526b4fb50e1e14da916da04072a578e493f0b1dfd87949cbf2fa323e57d41fd1ace749c21d52cf58139129019c0ea3f5358266de8409
SSDEEP 192:sxR92nbRUMFnP/f0sYg8ng87PbBGUdpPb/gb+WN4Xf/dZm4+2Ig5/J:sxRiDp/f0sYgHUD/cY/lXr
TLSH
T14522E7116E28693B5CD7E219FA35BB63E6F8507294D01E5CE2FCE61C08F66CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe589ce7.TMP

Path C:\Program Files\scoped_dir4196_1842415328\Default\Preferences~RFe589ce7.TMP
Size 10KB
SHA256 67c409f3f96dd436b2fdd92b414eb1ee0e382feded47982a6c2c6db155d730c8
MD5 c1496ba9cfa33f248bc72844787cba78
SHA1 c49a569f068d52974c0526a8a995f266f2b517da
SHA512 45a8d219bd64a647f3b64224067758aa472d41f66fe27a9dd04799602788b7414b2f5b4330b40c5660ac4df2f15bb18b90775139f715f7b29ad461f96f243cf4
SSDEEP 192:sxR92nbRUMFnP/f0s0g8ng87PbBGUdpPb/gb+WN4Xf/dZm4+2IgmJ:sxRiDp/f0s0gHUD/cY/lXy
TLSH
T1FD22E6116E28693B4CD7E219EE35BB63E6F9503294D41E5CE2FCA65C08F66CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Program Files\scoped_dir4196_1842415328\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a18d4fda-7378-437b-bb3f-d8e11c8b4b08\index-dir\the-real-index
Size 72B
SHA256 3eb149aa763f6a5aca3947b8b553460cd88796e5b4e4d694c81dcc07f7435542
MD5 392744940b6a8b4ed3efc6f92d2b844f
SHA1 c5a81895b3134376fc4db0ac3609230172261fc7
SHA512 2fa6cd1b65dde105ba504b9660d175ff5748b5ce8590611c1587610bbf2e4204ce9e77d680bf56e19cd1237d7f74fa1685bf4eb690fe2e682a11117f2f75cffb
TLSH
T114A0022983C14053D00612B079F6426227204E54F359531995901255CCDC5AA654300C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b38c.TMP

Path C:\Program Files\scoped_dir4196_1842415328\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a18d4fda-7378-437b-bb3f-d8e11c8b4b08\index-dir\the-real-index~RFe58b38c.TMP
Size 48B
SHA256 3665e1f2924ceaf78e55b1cd393429deeaf4a9809ce50191ddd3e159b18a8bf1
MD5 a61bce3607297662f82c15d628374204
SHA1 741df8b99606ae1362e0134b2595cb14b1ed0d34
SHA512 42539edc52a1399b092423caa5e9457aac7c3c7ca95e3d9edfc9cf92cf53b79fccea93f80a31c2908f5a3d6e4dc2cbde290a3b702a231e2d4ced499d00260f25
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Program Files\scoped_dir4196_1842415328\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 279B
SHA256 fd465183d92f067fc431e98fa7afcb611bd264c66d150fd9770f3edba836bc64
MD5 46823da19d9af1458257b1bd2d8f2a8d
SHA1 df9e35f9f4eeb0c76972f801d539f27d508c0fd9
SHA512 c8b430a227b9250c08b3e6e17f6e4ef8ccbdd33a1720a023a5b842c013da41eb1473ed70085fc6438698e3c57c62df9e963d21df55d3d74a300f7db42adcedf1
TLSH
T1A2D02BFA1C5A0868AABF83E3787158E101127CA58E0AFC4D115CB6C730712117916C22
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Program Files\scoped_dir4196_1842415328\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 375B
SHA256 bd5d25a9a9651a4cfeb18f4b66902e7e6c63572fb5f480fb5666317f783ad5de
MD5 442ab68f265ea810d1b3d992acfeaf20
SHA1 92fd2a143cef332e920f100d87842b2034de1beb
SHA512 a7ae7ad41a616c81be8156ae3c9709d7224e571cfa0ed525340bee17140862ef6b8bf35fc9624083ea8f35b9da0ecf14937e203628f72dc1b044625a2d722566
TLSH
T13EE068F62CAB0C28FA6F83D7347258E100043C958A07FC8F9429B6C73072210281DC22
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe586404.TMP

Path C:\Program Files\scoped_dir4196_1842415328\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe586404.TMP
Size 153B
SHA256 c76b0db9f72507f36ab8f19a0a6edd67775a98407e58740d13c78be8d10c6644
MD5 c502f58d93c4b4737e24f95e32dabe7d
SHA1 cbfd06444d53a5501751bef1447efe76558a3a86
SHA512 b381b3259c8d89716eade69b2b8df7669e930e2dafc0f5a2ea82a794a8b4e934df1aa4e5d08d06a63a07c45bdb62aa1e5a9aadc25f0ae5ac8ded7d66fff6b2e4
TLSH
T126C08CF71858084CAB6B52C260712CE982126CC44E4AEC4D402DB6C33170122BA22C21
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Program Files\scoped_dir4196_1842415328\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 f0967e6419bbc8480665098f3aecf899145d5f8b89a9d31dac58d8d1e387dea6
MD5 f6e9bfe94a888e41d9daf15e22418590
SHA1 655dd08f2f5c8c22349d7656d105f32347067903
SHA512 61af7a86d2da43e0654fe268abd9950da660b05277638b374c9db10c0fec553206b60980fd4ab67428b22f11ba33fceb37b7ea97fc95e0ef5251cf499671a6a1
TLSH
T1E7A0022D9F898191D04003F42865028C7A506EBD8946B3018E98528ECCE61505195064
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b38c.TMP

Path C:\Program Files\scoped_dir4196_1842415328\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58b38c.TMP
Size 48B
SHA256 b38c77f7a6755ddfd49e65f7c4f2c93453e2427ff90df1caef82c7aa4049ddc8
MD5 95c4659a1bbdab00e12bd7cd4e43d7d5
SHA1 7c274af1b721ec4047dbda35998c686f0ce356ff
SHA512 8026e56943990eb9e0f217404530f5fadfcd5f127192f8672a79efa3f069a7d13eb171046ec0780f3f156d1e5edbfab79043ab77fdda63dd119fc3ed70185394
MD5 SHA1 SHA512

Submit Download

index

Path C:\Program Files\scoped_dir4196_1842415328\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Program Files\scoped_dir4196_1842415328\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 3bb2cea36338db8afbcd354e2bcc2e52af2be0b70cf5c077361ea394c3f2727b
MD5 adeedb25d7033fbca3bb0cbe49f74415
SHA1 f5ed4127d3bcae845c0c01785b811eb7f4ffc3fc
SHA512 40be200af129ba0c60201d0e3488cb847ed6ef97de8af04028a49fa987a6fc25a5fc4e763388c8f718a344a22271fdaf5e379a3e33804259156cd92a8c2845a0
TLSH
T157A0027446CA4715E95206F021861D9433204C57914BC31B59D004E8E9532F06341404
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a090.TMP

Path C:\Program Files\scoped_dir4196_1842415328\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index~RFe58a090.TMP
Size 48B
SHA256 a9529e0bae7f624685bd6d59b535a71a61855b1ccdaa06cedbdb564c58a71835
MD5 b07566d3aacad61538a8bdf7ba5ee833
SHA1 df43d947470435877b78ddb43a3edd192150c9da
SHA512 d4a1da218131c043c412cf89572404cbd02290de512f76eb643f0e06ba20473231694786286e00ae7abf9f765c2298da3b2b8242e334713f0cf261fc47160d14
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Program Files\scoped_dir4196_1842415328\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Program Files\scoped_dir4196_1842415328\Local State
Size 8KB
SHA256 3c57daa963729a0962714d254aea2d0d393bf70b207e8397e481b9dccc858347
MD5 5f401d8c713f3474a5f847b31a304799
SHA1 cff095e3e08f75bb6fd237041c846c22f88e7a8a
SHA512 75997b9a81e068ea94a15f937f9103bb3642296b5c01052a4815a822d79310f0f5193629d170eb2e1eba79fc5c42664c7c9e99a00393e8f6f7fd5ea0da1edd90
SSDEEP 192:vONGV6Db6QmiUyCBHBa+jx+FdCYHojkgKipe:vONY6uNHBa+SdPIhfpe
TLSH
T16F02E93568786CB79AF26E49F8872B239FD4107BDA962B45DAEC5F0C00D765C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Program Files\scoped_dir4196_1842415328\Local State
Size 8KB
SHA256 2c7523726ecc7b58580551942fb6b9c74de6642a3e176a200f128abfb04e7374
MD5 4c5431c8d8e21d55fb26960741b34a0e
SHA1 f1800d870ee895e86fcb389bebf2f5b7296df758
SHA512 1b98cc249a6d4f00f617ebfcd7767f6f261e27d231988d16cff33ca52f18ff1a74267fcd26daa7bbd3b6094ac4d76d3697cfdd4b08eea77bf85274cf7c0b8b10
SSDEEP 192:GONj6DboQmiUy2KdBa+jx+FdCYHojRzJ1qe:GONj6wMdBa+SdPIJ2e
TLSH
T182020A366878AC7B5EE36985F88736139EA44127DA8A7F51D6EC6F0C00EF55C130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Program Files\scoped_dir4196_1842415328\Local State
Size 10KB
SHA256 3fd24464fd2a7fadbd45eeaee3f8fd269332f1c4aabcfe999e93b18876f347bc
MD5 7b5923c485459512e80bae2cbab5761c
SHA1 6f3a249dd81aead57232e3325af71e2086521fdc
SHA512 4c102bed315474179a3a2cab8ee6b2fa4b78e8615724a760b6c3dff2be5c1bd759583b273f5adcb18f00a92bb5593aa781718848edcbef717b7e912ef9664843
SSDEEP 192:uuRLsN1UkTHbiedHmiU12UwTEa+jx+FdCYHojOmJ1qQMZIOt:ntsN1UkTmbH4Ea+SdPIJ28Ot
TLSH
T142322B3268789D775DF3B585F48736138EB881679A892F54D6DD6F0C01DB1AC2307817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Program Files\scoped_dir4196_1842415328\Local State
Size 17KB
SHA256 56a33f5b7b2c496c6774a8ba659160aee71233bd59141ea5d4494de95bb046f9
MD5 14d14baa8417c13a2b32a83264e5093a
SHA1 85e05a21b69b8d5b65f501d83dbc473e1f5062e5
SHA512 0cdcd493caecb9aa39743a32df8e49f06a9b2d5eb63245fbb8eb68d1ef298ef43f650cb4558f4506fe2c3045d73a527d26ba8e7c870b586ad764b0984a4c37a2
SSDEEP 384:nyZcIhsN1UkTmbH4Ea+SdPIJ2nTKwBODNZOCy0O:AhFban2J2newBKZO/0O
TLSH
T14C827C3259386D775DF2B549F88B36138EF89163E5C83B54DAEDBB0C00EA558130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1314ec41-1c5c-4102-95ba-684f25a723b6.tmp

Path C:\Program Files\scoped_dir4196_1842415328\extensions_crx_cache\1314ec41-1c5c-4102-95ba-684f25a723b6.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c9a6fb1fcc017a9da29b323390e76116c2c45af16e87dc23d0a3b79dc377b918
MD5 cb6927934dbffb62dd2ae1664ddb1a4a
SHA1 b243b3ba73c72f7b451c77963cc262bed2aad774
SHA512 c173ae517b37be4f7add3495f719ea1745f92881bfbc397eb81663142623c2677be9c84a009c519befddda6cf879441b166c149ac526f7159b40a5bd74a305d4
TLSH
T18A412D5CB6FA1158B3776E5AABF7A86D487FBC372F0AE05D10110E4E0622A40D861B37
MD5 SHA1 SHA512 TLSH

Submit Download

2026-08-08_f436d533fc03792cbc34f6a95bf855d2_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe

Path C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-08_f436d533fc03792cbc34f6a95bf855d2_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
Size 2.9MB
SHA256 914dbc194343978d8e908ecfe05ffefc0adbaac3656021e0fbfdd3d3962a768a
MD5 9a4ef568bdcd6662e8fe20e8a37217dd
SHA1 c68a6cf061fb7c19a2e7b4641b25263536812b11
SHA512 48703c677f03bcb19e4aa3a8b494907c26656f26ffcaab44749db4f64f1720e359fe80263fe6b05a7c5708c1059d82e1137796947f2916dd5c1879c21112004d
SSDEEP 49152:W68GYrEY5+lh6COpvhdBdy0QHcspePwn13vdyMRnwJfH6sTv:dYQYKljnFJyv
TLSH
T1AAE57C03F2D901E8D06ED27987568232AAB2BC454B34B6DF0A6077152F7AFE55B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Users\Admin\AppData\Local\Temp\3582-490\identity_helper.exe
Size 1.4MB
SHA256 4cd3e95e38df0cfb094ceedc26a43312d71f71e1361b3f8498f4996fdef2c73a
MD5 e9eff67e5bcb8b27e3109516d470fc56
SHA1 56a3e9b944260a05f25eacf55ac49af1aadf55b3
SHA512 85832d93f4354a63e39428f7cd80413aa5b094fbb933f84a2f5bcbe8e971b6fe9b38aab0013860d4fc061a769e5c29ff7fb4b488446b7a7984afddc8affa624a
SSDEEP 24576:JmjDvw6qZ04SuTjPn68TQuD3g9gZLfChjyosZ9HT1zYeHNrk9NrfZB:KDvwZ2XuTjPb33g9gZLfCdW9HTlXrk9l
TLSH
T126656B03F29900E9D059D1B8C7568536EAB2BC450B34A6EF0B90B6552F3BFE46B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4b5cd28d-a885-45ac-88a7-496a6708a341.tmp

Path C:\Users\Admin\AppData\Local\Temp\4b5cd28d-a885-45ac-88a7-496a6708a341.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

b91a5364-ab53-403f-952c-a0bfca374b81.tmp

Path C:\Users\Admin\AppData\Local\Temp\b91a5364-ab53-403f-952c-a0bfca374b81.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4328_365493838\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eb0f6a5e-442c-4c88-a70d-be4de2737e58.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4328_541323712\eb0f6a5e-442c-4c88-a70d-be4de2737e58.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.com

Path C:\Windows\svchost.com
Size 40KB
SHA256 e8638156d8ffcd62d1310a66c97859d9d2a3cfa51bb2d68eff1fb3bb5e0b88fa
MD5 bbe7c2a598307f1959111956daa7d18d
SHA1 b5475cb967f67d394929ead4ebb9fc50a7bf9f09
SHA512 24e2481d21c87a464478194213e7692d52631a626f4d7699d4d57f9fad6288353ecec52ac447d5fb6347269c381b35108fb191a7d39cdf1229df51a32ebe455d
SSDEEP 768:eyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJakk0pEDSO:JxqjQ+P04wsmJCHkOz
TLSH
T1BE136C52FAE18871D0301EFCCC1A9258C57A7B303E7A1AF5BAF91D5DEC693D1290C58A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/380-688-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/380-1116-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/380-1612-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/380-1639-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/380-1641-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/380-1646-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/5388-1574-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/5388-1636-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/5388-1640-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/5388-1642-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/5388-1645-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/5536-903-0x0000000000400000-0x000000000041B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads