Overview

overview

10

Static

static

10

2026-08-09...op.exe

windows10-2004-x64

10

2026-08-09...op.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/08/2026, 17:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-09_2757cbf6761338bf0888dee222d52fad_darkgate_elex_emotet_neshta_ransomhub_stealc_stop.exe
  • Size 8.1MB
  • Sample260809-vlyggavyct
  • SHA256 cba062c501d750c44f95fa8430aed2e81736d7f0d533298e436741d4f542f22f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasiondiscoveryneshtapersistencespywarestealertrojan

Malware Config

Signatures

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Detect Neshta payload 63 IoCs
  • Executes dropped EXE 29 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Checks system information in the registry 2 TTPs 2 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 53 IoCs
  • System policy modification 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_2757cbf6761338bf0888dee222d52fad_darkgate_elex_emotet_neshta_ransomhub_stealc_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_2757cbf6761338bf0888dee222d52fad_darkgate_elex_emotet_neshta_ransomhub_stealc_stop.exe"
    1⤵
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3672
    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-09_2757cbf6761338bf0888dee222d52fad_darkgate_elex_emotet_neshta_ransomhub_stealc_stop.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-09_2757cbf6761338bf0888dee222d52fad_darkgate_elex_emotet_neshta_ransomhub_stealc_stop.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4112
      • C:\Program Files (x86)\Internet Explorer\iexplore.exe
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe" "https://www.fine-drive.com/customer/mypage.do?method=loginezlog&mem_id=%s&passwd=%s"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4252
        • C:\Program Files\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files\Internet Explorer\IEXPLORE.EXE" "https://www.fine-drive.com/customer/mypage.do?method=loginezlog&mem_id=%s&passwd=%s"
          4⤵
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:3744
          • C:\Windows\svchost.com
            "C:\Windows\svchost.com" "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" -- "https://www.fine-drive.com/customer/mypage.do?method=loginezlog&mem_id=%s&passwd=%s"
            5⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2208
            • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
              C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe -- https://www.fine-drive.com/customer/mypage.do?method=loginezlog&mem_id=%s&passwd=%s
              6⤵
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Checks system information in the registry
              • Drops file in Windows directory
              • Enumerates system info in registry
              • Modifies data under HKEY_USERS
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:4160
              • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --monitor-self-argument=/prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 --annotation=exe=C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffa944ac188,0x7ffa944ac194,0x7ffa944ac1a0
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:5680
                • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                  C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 --annotation=exe=C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x1d0,0x1d4,0x1d8,0x1ac,0x1dc,0x7ff6c9296910,0x7ff6c929691c,0x7ff6c9296928
                  8⤵
                  • Executes dropped EXE
                  PID:3612
              • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,13458463771504473929,655214089644999929,524288 --field-trial-handle=2912,i,2610206079190255813,7045078085555434153,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:11
                7⤵
                • Executes dropped EXE
                • System Time Discovery
                PID:4560
              • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,15698207075963746302,12767464850679733989,262144 --field-trial-handle=2912,i,2610206079190255813,7045078085555434153,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:2
                7⤵
                • Executes dropped EXE
                PID:5220
              • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2224,i,12997705489154601333,11142300613133460436,524288 --field-trial-handle=2912,i,2610206079190255813,7045078085555434153,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:13
                7⤵
                • Executes dropped EXE
                PID:1476
              • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,15787852307637064199,10029184966312123052,2097152 --field-trial-handle=2912,i,2610206079190255813,7045078085555434153,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
                7⤵
                • Executes dropped EXE
                PID:4884
              • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3684,i,5755022255544569070,7551781957613810904,2097152 --field-trial-handle=2912,i,2610206079190255813,7045078085555434153,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:1
                7⤵
                • Executes dropped EXE
                PID:3908
              • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,9550591135261766519,14763112231889298208,2097152 --field-trial-handle=2912,i,2610206079190255813,7045078085555434153,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:1
                7⤵
                • Executes dropped EXE
                PID:4352
              • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,3954493697667692765,14554549390937189121,2097152 --field-trial-handle=2912,i,2610206079190255813,7045078085555434153,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:9
                7⤵
                • Executes dropped EXE
                PID:6020
              • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,17972474700933059612,8032955224480651717,524288 --field-trial-handle=2912,i,2610206079190255813,7045078085555434153,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:14
                7⤵
                • Executes dropped EXE
                PID:728
              • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3744,i,4879518543741837456,2889114686043068002,524288 --field-trial-handle=2912,i,2610206079190255813,7045078085555434153,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
                7⤵
                • Executes dropped EXE
                PID:5124
              • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,5752129503790918582,15788866717838481523,524288 --field-trial-handle=2912,i,2610206079190255813,7045078085555434153,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
                7⤵
                • Executes dropped EXE
                PID:5336
              • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,11747821201944826045,10548707967425776248,524288 --field-trial-handle=2912,i,2610206079190255813,7045078085555434153,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
                7⤵
                • Executes dropped EXE
                PID:4180
              • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,13273768578262743098,932963575417831279,524288 --field-trial-handle=2912,i,2610206079190255813,7045078085555434153,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:14
                7⤵
                • Executes dropped EXE
                PID:1488
              • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,12739418107388720691,5833417318300548380,524288 --field-trial-handle=2912,i,2610206079190255813,7045078085555434153,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
                7⤵
                • Executes dropped EXE
                PID:6036
              • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,7774156738198986306,3324089512721055784,524288 --field-trial-handle=2912,i,2610206079190255813,7045078085555434153,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
                7⤵
                • Executes dropped EXE
                PID:5944
              • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,5820918471133780023,8139015493603307256,524288 --field-trial-handle=2912,i,2610206079190255813,7045078085555434153,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:14
                7⤵
                • Executes dropped EXE
                PID:1744
              • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4384,i,66891567226635761,4773940588074222209,524288 --field-trial-handle=2912,i,2610206079190255813,7045078085555434153,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:14
                7⤵
                • Executes dropped EXE
                PID:5592
              • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,15673149068616078909,8490331671640624775,524288 --field-trial-handle=2912,i,2610206079190255813,7045078085555434153,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:14
                7⤵
                • Executes dropped EXE
                PID:4132
              • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,13073573124154597378,595588142854841718,524288 --field-trial-handle=2912,i,2610206079190255813,7045078085555434153,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:14
                7⤵
                • Executes dropped EXE
                PID:3972
              • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3120,i,2697002637517011666,910080314567943243,524288 --field-trial-handle=2912,i,2610206079190255813,7045078085555434153,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:14
                7⤵
                • Executes dropped EXE
                PID:4212
              • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3744,i,8894840995214330432,12814317144380478618,524288 --field-trial-handle=2912,i,2610206079190255813,7045078085555434153,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
                7⤵
                • Executes dropped EXE
                PID:5568
              • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6740,i,835304804743327002,15428395592133657686,524288 --field-trial-handle=2912,i,2610206079190255813,7045078085555434153,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
                7⤵
                • Executes dropped EXE
                PID:5732
              • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=924,i,12136433066175107399,8417576567517864069,262144 --field-trial-handle=2912,i,2610206079190255813,7045078085555434153,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:10
                7⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                PID:4768
              • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,2450774413709545101,17180007796659482894,524288 --field-trial-handle=2912,i,2610206079190255813,7045078085555434153,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:14
                7⤵
                • Executes dropped EXE
                PID:1196
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:5956
    • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
      "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --no-startup-window --win-session-start
      1⤵
      • Executes dropped EXE
      PID:6036

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          ACROBR~1.EXE
          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE
          • Size 328KB
          • SHA256 888a1dd0033e5d758a4e731e3e55357de866e80d03b1b194375f714e1fd4351d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ACROTE~1.EXE
          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
          • Size 86KB
          • SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ADOBEC~1.EXE
          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE
          • Size 5.7MB
          • SHA256 1b5c715d71384f043843ea1785a6873a9f39d2daae112ccdeffcd88b10a3a403
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ADelRCP.exe
          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe
          • Size 175KB
          • SHA256 3f00404dd591c2856e6f71bd78423ed47199902e0b85f228e6c4de72c59ddffe
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          RdrCEF.exe
          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe
          • Size 9.4MB
          • SHA256 31da9632f5d25806b77b617d48da52a14afc574bbe1653120f97705284ea566c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AcroRd32.exe
          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
          • Size 2.4MB
          • SHA256 8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WCCHRO~1.EXE
          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE
          • Size 183KB
          • SHA256 ecd5e94da88c653e4c34b6ab325e0aca8824247b290336f75c410caa16381bc5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Eula.exe
          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe
          • Size 131KB
          • SHA256 5c3ef3ec7594c040146e908014791dd15201ba58b4d70032770bb661b6a0e394
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          FULLTR~1.EXE
          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE
          • Size 254KB
          • SHA256 16d65f2463658a72dba205dcaa18bc3d0bab4453e726233d68bc176e69db0950
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          LOGTRA~1.EXE
          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE
          • Size 386KB
          • SHA256 473eb551101caeaf2d18f811342e21de323c8dd19ed21011997716871defe997
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          READER~1.EXE
          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE
          • Size 92KB
          • SHA256 2f947e3ca624ce7373080b4a3934e21644fb070a53feeaae442b15b849c2954f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WOW_HE~1.EXE
          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE
          • Size 147KB
          • SHA256 750824b5f75c91a6c2eeb8c5e60ae28d7a81e323d3762c8652255bfea5cba0bb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          arh.exe
          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe
          • Size 125KB
          • SHA256 fe44ca8d5050932851aa54c23133277e66db939501af58e5aeb7b67ec1dde7b5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          32BITM~1.EXE
          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE
          • Size 142KB
          • SHA256 3e9da97a7106122245e77f13f3f3cc96c055d732ab841eb848d03ac25401c1bc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          64BITM~1.EXE
          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE
          • Size 278KB
          • SHA256 22a585c183e27b3c732028ff193733c2f9d03700a0e95e65c556b0592c43d880
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ADOBEA~1.EXE
          • Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE
          • Size 454KB
          • SHA256 bb07d817b8b1b6b4c25e62b6120e51dec10118557d7b6b696ad084a5ba5bfdeb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AdobeARM.exe
          • Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe
          • Size 1.2MB
          • SHA256 b1ec065f71cc40f400e006586d370997102860504fd643b235e8ed9f5607262a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jaureg.exe
          • Path C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe
          • Size 555KB
          • SHA256 c5a99f42100834599e4995d0a178b32b772a6e774a4050a6bb00438af0a6a1f3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VSTOIN~1.EXE
          • Path C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE
          • Size 121KB
          • SHA256 405b8bd647fa703e233b8b609a18999abe465a8458168f1daf23197bd2ea36aa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          java.exe
          • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe
          • Size 325KB
          • SHA256 5e2e22ead49ce9cc11141dbeebbe5b93a530c966695d8efc2083f00e6be53423
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          javaw.exe
          • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe
          • Size 325KB
          • SHA256 e2262c798729169f697e6c30e5211cde604fd8b14769311ff4ea81abba8c2781
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          javaws.exe
          • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe
          • Size 505KB
          • SHA256 da73b6e071788372702104b9c72b6697e84e7c75e248e964996700b77c6b6f1c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DISABL~1.EXE
          • Path C:\PROGRA~2\Google\Update\DISABL~1.EXE
          • Size 5.7MB
          • SHA256 3acf99624820fd862ac30780021108f0ff2df60db3df351cd17400404f279d3c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MICROS~1.EXE
          • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MICROS~1.EXE
          • Size 223KB
          • SHA256 fe2d4359da69b28aa924ea8e144c8cb12250be7f8ab41485b4b86fe40ab49e14
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MICROS~2.EXE
          • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MICROS~2.EXE
          • Size 242KB
          • SHA256 e1680751388c4af523a769ce4e16ae013c7d8b7a1b03e56b97525bbb918b647b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MICROS~3.EXE
          • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MICROS~3.EXE
          • Size 138KB
          • SHA256 0c67d6d3361be736320cca1522b7a08cfaf7aaa8f04311dfeae2eaff8415834c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MICROS~4.EXE
          • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MICROS~4.EXE
          • Size 256KB
          • SHA256 54680d4ec289fc3dab85466803f01a6d7be5933abab940f7e1ec597c32aa7f64
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ie_to_edge_stub.exe
          • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\BHO\ie_to_edge_stub.exe
          • Size 553KB
          • SHA256 7b2d809ff4b2691c04855f4bb3d89b88fa4d1d65c8c35d3941a26f015947cde9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          setup.exe
          • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\INSTAL~1\setup.exe
          • Size 6.8MB
          • SHA256 78e1d1e4460914eb8be59bb96d9897562a0ac65a5fbce63349f43ee56ba5e83b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cookie_exporter.exe
          • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\cookie_exporter.exe
          • Size 157KB
          • SHA256 3ecafed639ffb272e758902d1baa0b399c044bfb744cedd6bda1ed40516ca132
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          elevation_service.exe
          • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\elevation_service.exe
          • Size 1.7MB
          • SHA256 2177d0e64ef5cd4d3ad386606feb8d45ae0a7d070f19583b67eea9407272b9f0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          identity_helper.exe
          • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\identity_helper.exe
          • Size 1.2MB
          • SHA256 d2decf24ecc69018df3da6dde66ca81e168dbcea91c6d4ceb428a1929778b39e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedge.exe
          • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedge.exe
          • Size 3.9MB
          • SHA256 39cf8228fc39959bcd27f64512c81e5049eeed843387016d4c733982b622706d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedge_proxy.exe
          • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedge_proxy.exe
          • Size 1.2MB
          • SHA256 6f3f49143cab7ee4c239f74f6649241ddd527040ea390a3a214b1d7b8f113fc7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedge_pwa_launcher.exe
          • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedge_pwa_launcher.exe
          • Size 1.6MB
          • SHA256 c3f6a5111276371edf9e46fcb05869f993cb17cac5f8033ee5707ecddc244f5f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgewebview2.exe
          • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedgewebview2.exe
          • Size 3.5MB
          • SHA256 47df542ec5d28a6c75c2d815e9b700c65f587186c02c8f1a2566fdab9e3b5d01
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          notification_helper.exe
          • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\notification_helper.exe
          • Size 1.4MB
          • SHA256 964abff6df613e4f987fa1615a0f7963d177c3c7418b4a719c3121e9752b5a00
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pwahelper.exe
          • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\pwahelper.exe
          • Size 1.2MB
          • SHA256 07b4d83c273dd032f6a763951adc1196ca00568ce2cef2cd9c3a310788fbcd78
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ie_to_edge_stub.exe
          • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\BHO\ie_to_edge_stub.exe
          • Size 562KB
          • SHA256 533d6da98378d3b1bb120b192bc5bd20bbeed6e123fe9fc6c15a4a3504932c71
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          setup.exe
          • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\INSTAL~1\setup.exe
          • Size 7.1MB
          • SHA256 70c13c14a682d65fd82ec72f578e160617f8b7c164414bcce613a9b9ebd0c878
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cookie_exporter.exe
          • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\cookie_exporter.exe
          • Size 155KB
          • SHA256 30d26d2f766f716cd6b21cdc15065ee4191760ef0d37de51f67dead898fb8e7c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          elevated_tracing_service.exe
          • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevated_tracing_service.exe
          • Size 3.8MB
          • SHA256 c13ce5f473ff68ffdea61e8a4800008f527054f4561f2bf7853f6769d0c02dc5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          elevation_service.exe
          • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevation_service.exe
          • Size 2.2MB
          • SHA256 8c53985c403e44c0c899c2d1f2a0b8afb1f17fb928ff866271de7952c9ff7c66
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          identity_helper.exe
          • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\identity_helper.exe
          • Size 1.4MB
          • SHA256 cd0adfcf43373e05fcf8836cc998cb17e3aaade9f8b190e28ce4331bd026f23c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedge.exe
          • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge.exe
          • Size 4.0MB
          • SHA256 18f4157c2dabb39cf84662e17c471f69f679840a70be3a4685e0c4ed8ccc207a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedge_pwa_launcher.exe
          • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge_pwa_launcher.exe
          • Size 1.8MB
          • SHA256 2c31887681976e9691cfed32b98a9f81898beaaee9ea3f7a90fe695b84190511
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedgewebview2.exe
          • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedgewebview2.exe
          • Size 3.4MB
          • SHA256 c0566225b047e50773acde8ada568ef7612809e74f2cc200504e60cf7a917c68
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          notification_click_helper.exe
          • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\notification_click_helper.exe
          • Size 1.6MB
          • SHA256 0faa9f1f62a95136d454efa51e6f8e8ff06a08d344fd26dc2216de09f6fbee4e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pwahelper.exe
          • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\pwahelper.exe
          • Size 1.4MB
          • SHA256 df233ebee614cd9117f7e467f16f4c2225aadbc59213a5695913a4a87f792d6a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSEDGE~1.EXE
          • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE
          • Size 1.5MB
          • SHA256 b4bdab2b2c7731923854f254ba1494c25a11331293c0ee4939afd10ba1e2b575
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedge.exe
          • Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          • Size 3.9MB
          • SHA256 9eed2a0101daf439ba35a3818176c8341f9ec29dc083e689d9239e09bba566bd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msedge.exe
          • Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          • Size 3.9MB
          • SHA256 6d8e5d6a4d1c147b90b5a394a5054840e19dfa3eae3ea706ffb367477cecb929
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          settings.dat
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
          • Size 280B
          • SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          settings.dat
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
          • Size 280B
          • SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          the-real-index
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
          • Size 3KB
          • SHA256 7a618a49b8e5eb282788886743746799205de68905787a9353ba42d2028763f7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          the-real-index~RFe5a350b.TMP
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a350b.TMP
          • Size 3KB
          • SHA256 ca09bc0124624863d93fb09adf5738a2e2e6b0ebef1eb6c388045a743416507e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          SiteList-Enterprise.json
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
          • Size 2B
          • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
          • MD5 SHA1 SHA512
          Submit Download

          Edge Profile.ico
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
          • Size 70KB
          • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          890d542a-dbb9-415d-98e9-be4609e7e70b.tmp
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\890d542a-dbb9-415d-98e9-be4609e7e70b.tmp
          • Size 1KB
          • SHA256 c801887e4bd3541fa4b4f29791013ac04d13f1a8d7fb4c6f16d1b0fe7f84e380
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Network Persistent State
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
          • Size 5KB
          • SHA256 022328f453a6f6376e46b188fed1af7d5f428666504db8619ee8ec77a6ad3b5c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SCT Auditing Pending Reports
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
          • Size 2B
          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
          • MD5 SHA1 SHA512
          Submit Download

          Sdch Dictionaries
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
          • Size 40B
          • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
          • MD5 SHA1 SHA512
          Submit Download

          Preferences
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
          • Size 13KB
          • SHA256 dddf354cb0f721bddecf06b86e7cf11513a603fb769b0f7903ed0795e50a9c5b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Preferences
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
          • Size 11KB
          • SHA256 2f291c28bf19e6c2663c520bbc4199cc9e5cba2fb322e8a9e0dab0c101f2fc04
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Preferences
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
          • Size 12KB
          • SHA256 8217a7e582cca8cf9aea4cab02e3f8a5556102a544b221b352a811f9929ab0c7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Secure Preferences
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
          • Size 27KB
          • SHA256 9ab992d88c023b8c44228c6905358fb27885b66311d642c22ba98376754ebbae
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sync_diagnostic.log
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
          • Size 4KB
          • SHA256 75c3365a3def2337aba864f3fd01af20545bee0713f2e117d1c06fff568bf31d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          OperationConfig
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
          • Size 22KB
          • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          OperationConfig~RFe5a5a08.TMP
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a5a08.TMP
          • Size 3KB
          • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Local State
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
          • Size 28KB
          • SHA256 309031bca27d5f89e4e1ddc696ff199ddf6215cf41e42d4fff3a14b61ad14b40
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Local State
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
          • Size 31KB
          • SHA256 d68651dc10bd3b8908d4af155cacd2ac59f43a3303b9ceb6cdb213e95f83a87f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Local State
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
          • Size 36KB
          • SHA256 b8a9e9f63dac826a781f870917e3448be2bcae9aaa5ea799ce2b7349c4b735f0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Local State
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
          • Size 37KB
          • SHA256 758d5f49df25a31b11d1fc4f5b2df6d559536a960fb9d5a230f2b4dcfaa56437
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Local State
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
          • Size 39KB
          • SHA256 a7e99263b17ff48e9db3fe28a07e7d03b14a63bb69ea7e3070751a8b2d0fe969
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Local State
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
          • Size 37KB
          • SHA256 4d7597c632ec4160ec43b294ad60da66c3a1072831ca3f178ce04aee037225ed
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Local State
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
          • Size 28KB
          • SHA256 66096b0c3ba4ce089067381595c5ae2a220de1d3aa369dd87266575f2721297a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Local State
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
          • Size 38KB
          • SHA256 3f1a05aa8db8eb713e4358936f72baa9a3d3c34943542c9cce2e338a578f164f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          metadata.json
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
          • Size 372B
          • SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          metadata.json
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
          • Size 132B
          • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          metadata.json
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
          • Size 252B
          • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
          • Size 153KB
          • SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          a6838043-45fe-40b0-b4f0-e8e14dc5db90.tmp
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a6838043-45fe-40b0-b4f0-e8e14dc5db90.tmp
          • Size 13B
          • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
          • MD5 SHA1 SHA512
          Submit Download

          metadata.json
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
          • Size 132B
          • SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          2026-08-09_2757cbf6761338bf0888dee222d52fad_darkgate_elex_emotet_neshta_ransomhub_stealc_stop.exe
          • Path C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-09_2757cbf6761338bf0888dee222d52fad_darkgate_elex_emotet_neshta_ransomhub_stealc_stop.exe
          • Size 8.1MB
          • SHA256 b6dd7aef634087274597c9580216c382adc0f37024a170e2d2115024a08f77c8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          8ac298ae-a553-46f3-a493-1868e07c063e.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\8ac298ae-a553-46f3-a493-1868e07c063e.tmp
          • Size 1B
          • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
          • MD5 SHA1 SHA512
          Submit Download

          content_new.js
          • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4160_1036851783\CRX_INSTALL\content_new.js
          • Size 10KB
          • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          svchost.com
          • Path C:\Windows\svchost.com
          • Size 40KB
          • SHA256 7d2f00810045d565265cdfc9a23b28da7a09692ba026900510de9ea1dd5e8e9b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/2208-784-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/2208-808-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/2208-564-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/2208-298-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/2208-820-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/3672-297-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/3672-817-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/3672-243-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/3672-788-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/3672-581-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/3672-821-0x0000000000400000-0x000000000041B000-memory.dmp
          Download

          memory/4768-933-0x000002426C5D0000-0x000002426C5D1000-memory.dmp
          Download

          memory/4768-931-0x000002426C5D0000-0x000002426C5D1000-memory.dmp
          Download

          memory/4768-937-0x000002426C5D0000-0x000002426C5D1000-memory.dmp
          Download

          memory/4768-942-0x000002426C5D0000-0x000002426C5D1000-memory.dmp
          Download

          memory/4768-941-0x000002426C5D0000-0x000002426C5D1000-memory.dmp
          Download

          memory/4768-939-0x000002426C5D0000-0x000002426C5D1000-memory.dmp
          Download

          memory/4768-938-0x000002426C5D0000-0x000002426C5D1000-memory.dmp
          Download

          memory/4768-940-0x000002426C5D0000-0x000002426C5D1000-memory.dmp
          Download

          memory/4884-246-0x00007FFAB7DF0000-0x00007FFAB7DF1000-memory.dmp
          Download

          memory/5220-238-0x00007FFAB7DF0000-0x00007FFAB7DF1000-memory.dmp
          Download