96d6c2d8068d2fcc451708d7a520926274e3c86d1f54ed1902e9aee2a3b0f5ee

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 11:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_dec0fccc4b7c9614c560dab7dbd74e56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Size 12.3MB
Sample260818-nhq5nasthy
SHA256 96d6c2d8068d2fcc451708d7a520926274e3c86d1f54ed1902e9aee2a3b0f5ee
MD5 dec0fccc4b7c9614c560dab7dbd74e56
SHA1 980d6384310aa3f893ec52ece9d5b961c3dc98e6
SHA512 b7eee51b466fd58d4a64bb80b0731b58ee0e7d392d6a9c890a878393297307477bf1e339af1bbb931848dabaf90c3d143690094da876c6193638a27e4f8c6b5c
SSDEEP 98304:OErJ5unH0VH3ReW/9QnI19rAQEAiNdRzITtGyk7RP+t9m2UaOunAxBzqIlwP7QE:O4unUVH3RF2nIAdZIhGyk7R6P
TLSH
T155D64B47E8A545E8C4AED574C6669293BB707C494B3033DB2B50F7282F76BD0AEB9340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3516	powershell.exe
2080	powershell.exe
1132	powershell.exe
5124	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
5932	panda-client.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\PandaRemoteClient = "C:\\Program Files\\PandaRemote\\panda-client.exe"	2026-08-18_dec0fccc4b7c9614c560dab7dbd74e56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\PandaRemoteClient = "C:\\Program Files\\PandaRemote\\panda-client.exe"	2026-08-18_dec0fccc4b7c9614c560dab7dbd74e56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe

Discovers running processes 1 TTPs 8 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4200	tasklist.exe
5256	tasklist.exe
5424	tasklist.exe
2584	tasklist.exe
4340	tasklist.exe
3852	tasklist.exe
5872	tasklist.exe
2828	tasklist.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\PandaRemote\panda-client.exe	2026-08-18_dec0fccc4b7c9614c560dab7dbd74e56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\PandaRemote\.data\.wtest	panda-client.exe
File opened for modification	C:\Program Files\PandaRemote\.data\client.log	panda-client.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1140_2136893794\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1140_1576831909\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1140_1063871613\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1140_1576831909\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1140_1576831909\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1140_1576831909\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1140_15669200\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1140_1063871613\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1140_2136893794\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4324	msedge.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
1708	wmic.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315258685956917"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{A6C28DF7-A758-43B6-8240-A8E915F9138C}	msedge.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
5980	reg.exe
440	reg.exe
3052	reg.exe
3476	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5784	schtasks.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
3516	powershell.exe
3516	powershell.exe
3516	powershell.exe
3516	powershell.exe
5124	powershell.exe
5124	powershell.exe
5124	powershell.exe
2080	powershell.exe
2080	powershell.exe
2080	powershell.exe
1132	powershell.exe
1132	powershell.exe
1132	powershell.exe
1708	wmic.exe
1708	wmic.exe
1708	wmic.exe
1708	wmic.exe
3912	msedge.exe
3912	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe
1140	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3516	powershell.exe
Token: SeIncreaseQuotaPrivilege	3516	powershell.exe
Token: SeSecurityPrivilege	3516	powershell.exe
Token: SeTakeOwnershipPrivilege	3516	powershell.exe
Token: SeLoadDriverPrivilege	3516	powershell.exe
Token: SeSystemProfilePrivilege	3516	powershell.exe
Token: SeSystemtimePrivilege	3516	powershell.exe
Token: SeProfSingleProcessPrivilege	3516	powershell.exe
Token: SeIncBasePriorityPrivilege	3516	powershell.exe
Token: SeCreatePagefilePrivilege	3516	powershell.exe
Token: SeBackupPrivilege	3516	powershell.exe
Token: SeRestorePrivilege	3516	powershell.exe
Token: SeShutdownPrivilege	3516	powershell.exe
Token: SeDebugPrivilege	3516	powershell.exe
Token: SeSystemEnvironmentPrivilege	3516	powershell.exe
Token: SeRemoteShutdownPrivilege	3516	powershell.exe
Token: SeUndockPrivilege	3516	powershell.exe
Token: SeManageVolumePrivilege	3516	powershell.exe
Token: 33	3516	powershell.exe
Token: 34	3516	powershell.exe
Token: 35	3516	powershell.exe
Token: 36	3516	powershell.exe
Token: SeDebugPrivilege	5124	powershell.exe
Token: SeDebugPrivilege	2080	powershell.exe
Token: SeIncreaseQuotaPrivilege	2080	powershell.exe
Token: SeSecurityPrivilege	2080	powershell.exe
Token: SeTakeOwnershipPrivilege	2080	powershell.exe
Token: SeLoadDriverPrivilege	2080	powershell.exe
Token: SeSystemProfilePrivilege	2080	powershell.exe
Token: SeSystemtimePrivilege	2080	powershell.exe
Token: SeProfSingleProcessPrivilege	2080	powershell.exe
Token: SeIncBasePriorityPrivilege	2080	powershell.exe
Token: SeCreatePagefilePrivilege	2080	powershell.exe
Token: SeBackupPrivilege	2080	powershell.exe
Token: SeRestorePrivilege	2080	powershell.exe
Token: SeShutdownPrivilege	2080	powershell.exe
Token: SeDebugPrivilege	2080	powershell.exe
Token: SeSystemEnvironmentPrivilege	2080	powershell.exe
Token: SeRemoteShutdownPrivilege	2080	powershell.exe
Token: SeUndockPrivilege	2080	powershell.exe
Token: SeManageVolumePrivilege	2080	powershell.exe
Token: 33	2080	powershell.exe
Token: 34	2080	powershell.exe
Token: 35	2080	powershell.exe
Token: 36	2080	powershell.exe
Token: SeDebugPrivilege	1132	powershell.exe
Token: SeIncreaseQuotaPrivilege	1132	powershell.exe
Token: SeSecurityPrivilege	1132	powershell.exe
Token: SeTakeOwnershipPrivilege	1132	powershell.exe
Token: SeLoadDriverPrivilege	1132	powershell.exe
Token: SeSystemProfilePrivilege	1132	powershell.exe
Token: SeSystemtimePrivilege	1132	powershell.exe
Token: SeProfSingleProcessPrivilege	1132	powershell.exe
Token: SeIncBasePriorityPrivilege	1132	powershell.exe
Token: SeCreatePagefilePrivilege	1132	powershell.exe
Token: SeBackupPrivilege	1132	powershell.exe
Token: SeRestorePrivilege	1132	powershell.exe
Token: SeShutdownPrivilege	1132	powershell.exe
Token: SeDebugPrivilege	1132	powershell.exe
Token: SeSystemEnvironmentPrivilege	1132	powershell.exe
Token: SeRemoteShutdownPrivilege	1132	powershell.exe
Token: SeUndockPrivilege	1132	powershell.exe
Token: SeManageVolumePrivilege	1132	powershell.exe
Token: 33	1132	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1140	msedge.exe
4740	2026-08-18_dec0fccc4b7c9614c560dab7dbd74e56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4740	2026-08-18_dec0fccc4b7c9614c560dab7dbd74e56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4740	2026-08-18_dec0fccc4b7c9614c560dab7dbd74e56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
4740	2026-08-18_dec0fccc4b7c9614c560dab7dbd74e56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
4740	2026-08-18_dec0fccc4b7c9614c560dab7dbd74e56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
4740	2026-08-18_dec0fccc4b7c9614c560dab7dbd74e56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 1468	4136	2026-08-18_dec0fccc4b7c9614c560dab7dbd74e56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	88
PID 4136 wrote to memory of 5784	4136	2026-08-18_dec0fccc4b7c9614c560dab7dbd74e56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	90
PID 4136 wrote to memory of 440	4136	2026-08-18_dec0fccc4b7c9614c560dab7dbd74e56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	92
PID 1468 wrote to memory of 1140	1468	rundll32.exe	94
PID 1140 wrote to memory of 6020	1140	msedge.exe	97
PID 4136 wrote to memory of 3052	4136	2026-08-18_dec0fccc4b7c9614c560dab7dbd74e56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	96
PID 4136 wrote to memory of 3516	4136	2026-08-18_dec0fccc4b7c9614c560dab7dbd74e56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	99
PID 1140 wrote to memory of 2416	1140	msedge.exe	101
PID 1140 wrote to memory of 4324	1140	msedge.exe	102
PID 1140 wrote to memory of 2416	1140	msedge.exe	101
PID 1140 wrote to memory of 2416	1140	msedge.exe	101
PID 1140 wrote to memory of 3184	1140	msedge.exe	103
PID 1140 wrote to memory of 3184	1140	msedge.exe	103
PID 1140 wrote to memory of 2584	1140	msedge.exe	120
PID 1140 wrote to memory of 2584	1140	msedge.exe	120
PID 1140 wrote to memory of 2584	1140	msedge.exe	120
PID 1140 wrote to memory of 3008	1140	msedge.exe	106
PID 1140 wrote to memory of 3008	1140	msedge.exe	106
PID 1140 wrote to memory of 3008	1140	msedge.exe	106
PID 1140 wrote to memory of 6076	1140	msedge.exe	107
PID 1140 wrote to memory of 6076	1140	msedge.exe	107
PID 1140 wrote to memory of 6076	1140	msedge.exe	107
PID 1140 wrote to memory of 3292	1140	msedge.exe	108
PID 1140 wrote to memory of 3292	1140	msedge.exe	108
PID 1140 wrote to memory of 3292	1140	msedge.exe	108
PID 1140 wrote to memory of 2328	1140	msedge.exe	110
PID 1140 wrote to memory of 2328	1140	msedge.exe	110
PID 4136 wrote to memory of 4740	4136	2026-08-18_dec0fccc4b7c9614c560dab7dbd74e56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	111
PID 1140 wrote to memory of 5864	1140	msedge.exe	113
PID 1140 wrote to memory of 5864	1140	msedge.exe	113
PID 1140 wrote to memory of 3788	1140	msedge.exe	114
PID 1140 wrote to memory of 3788	1140	msedge.exe	114
PID 1140 wrote to memory of 5352	1140	msedge.exe	117
PID 1140 wrote to memory of 2584	1140	msedge.exe	120
PID 1140 wrote to memory of 2584	1140	msedge.exe	120
PID 1140 wrote to memory of 2872	1140	msedge.exe	121
PID 1140 wrote to memory of 2872	1140	msedge.exe	121
PID 4740 wrote to memory of 3980	4740	2026-08-18_dec0fccc4b7c9614c560dab7dbd74e56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	122
PID 4740 wrote to memory of 6016	4740	2026-08-18_dec0fccc4b7c9614c560dab7dbd74e56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	124
PID 4740 wrote to memory of 4580	4740	2026-08-18_dec0fccc4b7c9614c560dab7dbd74e56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	126
PID 4740 wrote to memory of 2484	4740	2026-08-18_dec0fccc4b7c9614c560dab7dbd74e56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	128
PID 4740 wrote to memory of 5124	4740	2026-08-18_dec0fccc4b7c9614c560dab7dbd74e56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	130
PID 4740 wrote to memory of 3476	4740	2026-08-18_dec0fccc4b7c9614c560dab7dbd74e56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	132
PID 4740 wrote to memory of 5980	4740	2026-08-18_dec0fccc4b7c9614c560dab7dbd74e56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	134
PID 4740 wrote to memory of 2080	4740	2026-08-18_dec0fccc4b7c9614c560dab7dbd74e56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	136
PID 4740 wrote to memory of 1132	4740	2026-08-18_dec0fccc4b7c9614c560dab7dbd74e56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	138
PID 4740 wrote to memory of 4200	4740	2026-08-18_dec0fccc4b7c9614c560dab7dbd74e56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	140
PID 4740 wrote to memory of 2008	4740	2026-08-18_dec0fccc4b7c9614c560dab7dbd74e56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	143
PID 4740 wrote to memory of 1708	4740	2026-08-18_dec0fccc4b7c9614c560dab7dbd74e56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	144
PID 4740 wrote to memory of 2780	4740	2026-08-18_dec0fccc4b7c9614c560dab7dbd74e56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	145
PID 2780 wrote to memory of 4520	2780	rundll32.exe	147
PID 1140 wrote to memory of 2016	1140	msedge.exe	148
PID 1140 wrote to memory of 2016	1140	msedge.exe	148
PID 1140 wrote to memory of 2016	1140	msedge.exe	148
PID 1140 wrote to memory of 1696	1140	msedge.exe	150
PID 1140 wrote to memory of 3104	1140	msedge.exe	151
PID 1140 wrote to memory of 5012	1140	msedge.exe	152
PID 4740 wrote to memory of 5256	4740	2026-08-18_dec0fccc4b7c9614c560dab7dbd74e56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	153
PID 4740 wrote to memory of 5424	4740	2026-08-18_dec0fccc4b7c9614c560dab7dbd74e56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	155
PID 4740 wrote to memory of 2412	4740	2026-08-18_dec0fccc4b7c9614c560dab7dbd74e56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	157
PID 1140 wrote to memory of 556	1140	msedge.exe	158
PID 1140 wrote to memory of 556	1140	msedge.exe	158
PID 1140 wrote to memory of 5624	1140	msedge.exe	162
PID 1140 wrote to memory of 5624	1140	msedge.exe	162

C:\Users\Admin\AppData\Local\Temp\2026-08-18_dec0fccc4b7c9614c560dab7dbd74e56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_dec0fccc4b7c9614c560dab7dbd74e56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Windows\system32\rundll32.exe
  rundll32 url.dll,FileProtocolHandler http://127.0.0.1:49793/
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://127.0.0.1:49793/
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x314,0x7ffcd606c188,0x7ffcd606c194,0x7ffcd606c1a0
      4⤵
      PID:6020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1536,i,9111242149471041200,5013657780832403483,262144 --field-trial-handle=2020,i,17539450259896177513,1669983741922789386,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:2
      4⤵
      PID:2416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,17503416474460693037,4916449024903840988,524288 --field-trial-handle=2020,i,17539450259896177513,1669983741922789386,262144 --variations-seed-version --mojo-platform-channel-handle=1940 /prefetch:11
      4⤵
      System Time Discovery
      PID:4324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,14220697191485406584,13082631633264118892,524288 --field-trial-handle=2020,i,17539450259896177513,1669983741922789386,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:13
      4⤵
      PID:3184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,3656118234709228993,5155806852350179137,2097152 --field-trial-handle=2020,i,17539450259896177513,1669983741922789386,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
      4⤵
      PID:2584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,9590595531962460880,16344221998616391905,2097152 --field-trial-handle=2020,i,17539450259896177513,1669983741922789386,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
      4⤵
      PID:3008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4376,i,11890201165690352902,11952086530151704182,2097152 --field-trial-handle=2020,i,17539450259896177513,1669983741922789386,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:9
      4⤵
      PID:6076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4364,i,17125618862410053187,4265378337182239804,2097152 --field-trial-handle=2020,i,17539450259896177513,1669983741922789386,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:1
      4⤵
      PID:3292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,3881358042213771439,11506239367234801593,524288 --field-trial-handle=2020,i,17539450259896177513,1669983741922789386,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
      4⤵
      PID:2328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,1508034075615264818,9789224322307537050,524288 --field-trial-handle=2020,i,17539450259896177513,1669983741922789386,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:14
      4⤵
      PID:5864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,7516866082672143295,2954233519671825389,524288 --field-trial-handle=2020,i,17539450259896177513,1669983741922789386,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:14
      4⤵
      PID:3788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3744,i,16484355657553840564,4868363257862695401,524288 --field-trial-handle=2020,i,17539450259896177513,1669983741922789386,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
      4⤵
      PID:704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3744,i,16484355657553840564,4868363257862695401,524288 --field-trial-handle=2020,i,17539450259896177513,1669983741922789386,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
      4⤵
      PID:5352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,5021644303882266190,14433843493773546957,524288 --field-trial-handle=2020,i,17539450259896177513,1669983741922789386,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
      4⤵
      PID:2584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,17991248216866054981,18022493580808234948,524288 --field-trial-handle=2020,i,17539450259896177513,1669983741922789386,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:14
      4⤵
      PID:2872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3744,i,4219916286943168790,1446962610494239414,2097152 --field-trial-handle=2020,i,17539450259896177513,1669983741922789386,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
      4⤵
      PID:2016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=744,i,14521358153102260549,15475551127576843277,524288 --field-trial-handle=2020,i,17539450259896177513,1669983741922789386,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:14
      4⤵
      PID:1696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6684,i,6008882783939422119,9242229227820223756,524288 --field-trial-handle=2020,i,17539450259896177513,1669983741922789386,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:14
      4⤵
      PID:3104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6736,i,5696801893721467836,16481362515141866072,524288 --field-trial-handle=2020,i,17539450259896177513,1669983741922789386,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:14
      4⤵
      PID:5012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,8519970258269657429,2383955340895102328,524288 --field-trial-handle=2020,i,17539450259896177513,1669983741922789386,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:14
      4⤵
      PID:556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,10864415445187467360,8925886679127768582,524288 --field-trial-handle=2020,i,17539450259896177513,1669983741922789386,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:14
      4⤵
      PID:5624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6012,i,13888926808201121673,10492725075472390735,2097152 --field-trial-handle=2020,i,17539450259896177513,1669983741922789386,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:1
      4⤵
      PID:5788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,9620783331106073930,17887577715369481848,524288 --field-trial-handle=2020,i,17539450259896177513,1669983741922789386,262144 --variations-seed-version --mojo-platform-channel-handle=4088 /prefetch:14
      4⤵
      PID:4172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=4108,i,3001367307132240073,3227652483213961910,2097152 --field-trial-handle=2020,i,17539450259896177513,1669983741922789386,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:1
      4⤵
      PID:5336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6976,i,10272402543269099015,3777518966449524912,524288 --field-trial-handle=2020,i,17539450259896177513,1669983741922789386,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:14
      4⤵
      PID:4936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6468,i,4603771085287619243,14068410689514614971,262144 --field-trial-handle=2020,i,17539450259896177513,1669983741922789386,262144 --variations-seed-version --mojo-platform-channel-handle=7096 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,12625399362789798697,11304355021862732070,524288 --field-trial-handle=2020,i,17539450259896177513,1669983741922789386,262144 --variations-seed-version --mojo-platform-channel-handle=1196 /prefetch:14
      4⤵
      PID:5824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6940,i,654631102617254176,5609089106703937001,2097152 --field-trial-handle=2020,i,17539450259896177513,1669983741922789386,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:1
      4⤵
      PID:2056
- C:\Windows\system32\schtasks.exe
  schtasks /create /f /tn PandaRemoteRelocate /sc once /st 23:59 /ru SYSTEM /rl HIGHEST /tr "cmd /c mkdir \"C:\Program Files\PandaRemote\" 2>nul & copy /Y \"C:\Users\Admin\AppData\Local\Temp\2026-08-18_dec0fccc4b7c9614c560dab7dbd74e56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\" \"C:\Program Files\PandaRemote\panda-client.exe\" >nul 2>&1 & echo ok>\"C:\Users\Admin\AppData\Roaming\PandaRemote\.relocate-ok\" & schtasks /delete /f /tn PandaRemoteRelocate >nul 2>&1"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5784
- C:\Windows\system32\reg.exe
  reg add HKLM\SOFTWARE\360Safe\safemon\TrustedApp /v "C:\Program Files\PandaRemote" /t REG_SZ /d "C:\Program Files\PandaRemote" /f
  2⤵
  - Modifies registry key
  PID:440
- C:\Windows\system32\reg.exe
  reg add HKLM\SOFTWARE\360Safe\safemon\TrustedApp /v 2026-08-18_dec0fccc4b7c9614c560dab7dbd74e56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-08-18_dec0fccc4b7c9614c560dab7dbd74e56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe /f
  2⤵
  - Modifies registry key
  PID:3052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Program Files\PandaRemote' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3516
- C:\Users\Admin\AppData\Local\Temp\2026-08-18_dec0fccc4b7c9614c560dab7dbd74e56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-18_dec0fccc4b7c9614c560dab7dbd74e56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --panel --relock
  2⤵
  - Adds Run key to start application
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4740
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoAdminLogon /t REG_SZ /d 0 /f
    3⤵
    PID:3980
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultUserName /f
    3⤵
    PID:6016
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword /f
    3⤵
    PID:4580
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v ForceAutoLogon /f
    3⤵
    PID:2484
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ws = New-Object -ComObject WScript.Shell; $s = $ws.CreateShortcut('C:\Users\Admin\Desktop\熊猫远程控制.lnk'); $s.TargetPath = 'C:\Program Files\PandaRemote\panda-client.exe'; $s.Arguments = '--panel'; $s.IconLocation = 'C:\Program Files\PandaRemote\panda-client.exe,0'; $s.WorkingDirectory = 'C:\Program Files\PandaRemote'; $s.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5124
- - C:\Windows\system32\reg.exe
    reg add HKLM\SOFTWARE\360Safe\safemon\TrustedApp /v "C:\Program Files\PandaRemote" /t REG_SZ /d "C:\Program Files\PandaRemote" /f
    3⤵
    - Modifies registry key
    PID:3476
- - C:\Windows\system32\reg.exe
    reg add HKLM\SOFTWARE\360Safe\safemon\TrustedApp /v 2026-08-18_dec0fccc4b7c9614c560dab7dbd74e56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2026-08-18_dec0fccc4b7c9614c560dab7dbd74e56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe /f
    3⤵
    - Modifies registry key
    PID:5980
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Program Files\PandaRemote' -ErrorAction SilentlyContinue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2080
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\PandaRemote' -ErrorAction SilentlyContinue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1132
- - C:\Windows\system32\tasklist.exe
    tasklist /fo csv /nh
    3⤵
    - Discovers running processes
    PID:4200
- - C:\Users\Admin\AppData\Local\Temp\2026-08-18_dec0fccc4b7c9614c560dab7dbd74e56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-18_dec0fccc4b7c9614c560dab7dbd74e56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --watchdog
    3⤵
    PID:2008
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "pid eq 4740" /fo csv /nh
      4⤵
      Discovers running processes
      PID:3852
  - - C:\Users\Admin\AppData\Local\Temp\2026-08-18_dec0fccc4b7c9614c560dab7dbd74e56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
      C:\Users\Admin\AppData\Local\Temp\2026-08-18_dec0fccc4b7c9614c560dab7dbd74e56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
      4⤵
      PID:3608
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "pid eq 4740" /fo csv /nh
      4⤵
      Discovers running processes
      PID:2828
  - - C:\Users\Admin\AppData\Local\Temp\2026-08-18_dec0fccc4b7c9614c560dab7dbd74e56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
      C:\Users\Admin\AppData\Local\Temp\2026-08-18_dec0fccc4b7c9614c560dab7dbd74e56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
      4⤵
      PID:1376
- - C:\Windows\System32\Wbem\wmic.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    PID:1708
- - C:\Windows\system32\rundll32.exe
    rundll32 url.dll,FileProtocolHandler http://127.0.0.1:50071/?token=90eef404c03c800689b24f796dd66839
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://127.0.0.1:50071/?token=90eef404c03c800689b24f796dd66839
      4⤵
      PID:4520
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "pid eq 2008" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:5256
- - C:\Windows\system32\tasklist.exe
    tasklist /fo csv /nh
    3⤵
    - Discovers running processes
    PID:5424
- - C:\Users\Admin\AppData\Local\Temp\2026-08-18_dec0fccc4b7c9614c560dab7dbd74e56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-18_dec0fccc4b7c9614c560dab7dbd74e56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --watchdog
    3⤵
    PID:2412
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "pid eq 4740" /fo csv /nh
      4⤵
      Discovers running processes
      PID:5872
  - - C:\Users\Admin\AppData\Local\Temp\2026-08-18_dec0fccc4b7c9614c560dab7dbd74e56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
      C:\Users\Admin\AppData\Local\Temp\2026-08-18_dec0fccc4b7c9614c560dab7dbd74e56_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
      4⤵
      PID:6104
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "pid eq 2412" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:2584
- - C:\Windows\system32\tasklist.exe
    tasklist /fo csv /nh
    3⤵
    - Discovers running processes
    PID:4340
- - C:\Windows\system32\rundll32.exe
    rundll32 url.dll,FileProtocolHandler http://127.0.0.1:50071/?token=90eef404c03c800689b24f796dd66839
    3⤵
    PID:5140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://127.0.0.1:50071/?token=90eef404c03c800689b24f796dd66839
      4⤵
      PID:4992
- - C:\Windows\system32\rundll32.exe
    rundll32 url.dll,FileProtocolHandler http://127.0.0.1:50071/?token=90eef404c03c800689b24f796dd66839
    3⤵
    PID:5388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://127.0.0.1:50071/?token=90eef404c03c800689b24f796dd66839
      4⤵
      PID:5032
- - C:\Windows\system32\rundll32.exe
    rundll32 url.dll,FileProtocolHandler http://127.0.0.1:50071/?token=90eef404c03c800689b24f796dd66839
    3⤵
    PID:6064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://127.0.0.1:50071/?token=90eef404c03c800689b24f796dd66839
      4⤵
      PID:3632

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5212

C:\Program Files\PandaRemote\panda-client.exe
"C:\Program Files\PandaRemote\panda-client.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

panda-client.exe

Path C:\Program Files\PandaRemote\panda-client.exe
Size 12.3MB
SHA256 96d6c2d8068d2fcc451708d7a520926274e3c86d1f54ed1902e9aee2a3b0f5ee
MD5 dec0fccc4b7c9614c560dab7dbd74e56
SHA1 980d6384310aa3f893ec52ece9d5b961c3dc98e6
SHA512 b7eee51b466fd58d4a64bb80b0731b58ee0e7d392d6a9c890a878393297307477bf1e339af1bbb931848dabaf90c3d143690094da876c6193638a27e4f8c6b5c
SSDEEP 98304:OErJ5unH0VH3ReW/9QnI19rAQEAiNdRzITtGyk7RP+t9m2UaOunAxBzqIlwP7QE:O4unUVH3RF2nIAdZIhGyk7R6P
TLSH
T155D64B47E8A545E8C4AED574C6669293BB707C494B3033DB2B50F7282F76BD0AEB9340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

6e61815b-68d1-4bde-a48c-30a699f7aeea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6e61815b-68d1-4bde-a48c-30a699f7aeea.tmp
Size 12KB
SHA256 1b4c5b2880a27d9e7bb856a2acd3bb78c25bf6f97e2ec5985dd4de1f60bb17b0
MD5 c6b6a4530a3aa87a06dbe79c0c38c2c4
SHA1 32c28fa5690c9400c794d77f584399f59d7e5da3
SHA512 09cc1718e5dcbf97acf787741d773ad024c090d4e00247a2f4cdec1b3809cb86e7d62e57749c1ba4c228470a064cc645e2bff2423b07b82518e406d63ec79f5f
SSDEEP 192:sxR4R8CU/fbsp3HZ4cDzoA8p+Z/g6+WNhqS4tTaSx/YoXlCYMGyIgDOlBJ:sxR4VU/fbsp35hyu/5x4Nx/gNKt
TLSH
T19142C9166A28A93B5CC7E71DBA55BF53D3F95033A0D51E48ABFC9A1C01E7ACD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1d9229e56e76e3d0ced986200c56944d12982ab738f66de26e47ed4ad7e082b4
MD5 4f00d5aa58bcb723f623ae3a02f201f7
SHA1 b18d835831bb46c90bdef39e40978202ca89ecde
SHA512 2d0870beaf6801530472b38458b1f1eec57303df0f077c10d58640fbb23fa697b890d20be64a08a690ee5730374f68fdc7eea35d0f2bcb0f86df4d5aee416b88
TLSH
T1F551A691632DB9D2DF258C75AAF3548D31F968E9010FDF0280426F34E6A6FA470F106B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599d40.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599d40.TMP
Size 3KB
SHA256 a4bcbf598c8517fbadee0a0af96d1b55c8d505e747e901ce2947e1ea06e374fc
MD5 cc67c56a07dde19c42dbd481e0a8c9da
SHA1 ef4f55629aeee1f90977d39854203e813ebb2eda
SHA512 2ae7044a580980557bf2ab167c0c9dc7bd8bda5337c2fc373c61186f3995bd2c4b7b230c3bc8e97fe5f302a95b95f7138be58b1e03844a0562acd5a56375b745
TLSH
T17F519591632EB9D2DF258C75AAF3548D31F968E9010FDF0284426F34E6A6FA470F106B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8394eb7b42570b7d43cc05eab0296ef3e7c598b70f4eb440bd4b26f9652fc7ee
MD5 0fe8c8927b4024965e16fba9a3a5c3a6
SHA1 f321c0bdeb078a5f3bd8568b6256d090e55b39b8
SHA512 5cea07ae6cc21eee0d73fca4fae9d3f747f36e505fdbc3388eb910b50d1f5201ce80041021a7fb0f12b0ab0fecedf1efd3acec9770a3ee4ba0bd248b67023bfe
TLSH
T19241CDF783F4856ECE0156F0AA186E2FCE2C0511432C7D5AC9E0AE2793E3471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 90949dc098191ff0f0a93a1ad0e2ce911169fa01bcdaeaf0ff78a87c0fb715bc
MD5 c6c449d0b723ff826372d6891c1795b5
SHA1 60558463bf823523cf324afb0b12cddd54d001a3
SHA512 e57538dcee8ebbb285fdf99e9c41e321b388672ada3361ff56d9ce099e392bc3011bf1013fea703d5394b4df5a0eb7dd49e1370cf604ad2bf24e41290b624e78
SSDEEP 192:sxRtR8CU/fbsG1HZ4cgzoA8p+W/g6+WNhqS4/YoJhCYMGyIgVBJ:sxRtVU/fbsG15hZV/5x4/mN9
TLSH
T17042B8166E28A93B4CC7E61DBA25BF53D3F95033A1D51E48BAFC9A1C04E6ADD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f6a007efae8e6833e0d083563c9b829c06286188e694c93630b026a428af3fa7
MD5 27bf50037668e20e0f671eb8657e047f
SHA1 14253acc78e0f67fde2361119d165c7e4d4c3806
SHA512 c1d5790de9acff9ab5097654b4be79a79781acdb1b93d57a0e73785c8cb20b2b48f1b25e7c2de493f9c05a4b987c92d9bc6a35d238b1978a53de3c1028d2183f
SSDEEP 192:sxRmR8CU/fbsp1HZ4cgzoA8p+W/g6+WNhqS4/YoJhCYMGyIgDAlBJ:sxRmVU/fbsp15hZV/5x4/mNst
TLSH
T1A742C816AE28A93B4CC7E71DBA55BF53D3F95033A0D51E48AAFC9A1C04E6ADD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 531f0343a10dbe4495a850e77a97ae7a464a551ada60124b03af4c2095da5995
MD5 1abe38550daf33b78ffb28a09c04cf14
SHA1 3fd8c8466eed874dd0c49df4c5eeda01adfbf5d0
SHA512 167e39c0dde7c5f40d55fbbfe2513d689107d7f741705d381289e90597a7422c176963900af4cde672cfafa6f8a08370b4ba3eef47f4a339b7a89048ca2052e7
SSDEEP 192:sxR3R8CU/fbsp3HZ4c8zoA8pY9/g6+WNhqS4tT+SJZYojlCYMGyIgDOnBJ:sxR3VU/fbsp35htg/5x4VJZ8NKL
TLSH
T10E42B816AE28A97B4CC7E719BA55BF53E3F9503360D51E48AAFC8A1C01E7ADD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 3432254ff44e3145781bd0ff94eb900f1a0533ec9e9d743adf154d4e1629fb86
MD5 b663a4ce64a1c48737a05d2279ee7c27
SHA1 41e99029cc8cce9f28ee68df33d90a5d2e30a997
SHA512 c4c9fd299db6065b28514162332f4ba5f0677bc4494a955d22e4e8761d554cb8337448546fb8e9cc40372e50169858efef471a73836384c185ab7a550dac7d74
SSDEEP 192:sxReR8CU/fbsp3HZ4c8zoA8pYF/g6+WNhqS4tTvjSS8fYo2rlCYMGyIgDOWBJ:sxReVU/fbsp35htk/5x4gFffNKM
TLSH
T1A542C9166A28A97B4CC7E71DBA55BF53E3F9503360D51E48ABFC8A1C01E7ACD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 862bf8134abaf56aff57b2dfeb3fcb1a494a8b77f2d472448cf1fc36161c61eb
MD5 5f6f5368b554ce723c842d5d8beb7eca
SHA1 55fc9e5a6e5388a939c613dc392bec56ba2ce8b0
SHA512 5f11f7514fabaf2adada0b63a7ad8ac5c801912fdef47b0ae28eaad1899392a1acfb0177d78f951b4c414808d28ad716e80bd5cf4beba0e52f29d849d7b91503
SSDEEP 768:j26HOo7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVtWBVuwLro9Ge0B:j26HOUE7MRWgs2f02u1jaaWB4w4dC
TLSH
T1A0D2DB7B640DCABF4F804ADDEC197E9E6D6802CB9698CD8047FE941C02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

42e66686-b708-4ca0-b30e-9760f8cdb60b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\42e66686-b708-4ca0-b30e-9760f8cdb60b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 708585c21e55df0835e22e5dbba135ce7ef252cf6c9926b7a688a068cd4cf8f3
MD5 fe8fad4c27aabc5c88a15b8fd259ae48
SHA1 447397725d664515c914063e860f73cb9ced6ee8
SHA512 994f0cfa78f7089f1c007d6c3090ce33265ad472cad4822bda717cafa3165822405fbd2a314645525f4480d0d657713deacef7bcb2c1906f15493788ed5053de
SSDEEP 768:jFQc30wg8OqypsOWQtt2xONXyer1IRCzni950uTHriBu8:Gc3pG4SIqn20cHriBJ
TLSH
T1331329F684D38937D99E6387633D6E429EBCD063B5888590BBD51E0DCC865BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 55afa161b9c3977623d2eaa21abd92215a97e5e56f67047d10465e9d5ff8afa0
MD5 f645f2f740930afc3ff8f341f2f6b9eb
SHA1 f9cfcc2e9067b9e7b94e34a49443154379379f69
SHA512 11b0484c0ecebb5cc642ecb5cf291a0010fd9a80f79fbbf27993ea7a815ff86a1091f0422ed4f246a57aed65845884724641c18a7620698cb62b43b05fa523ed
SSDEEP 768:hrv+4UNbdz3QY/TBOWQttgONXyer1IRCzniBYeVH1SK7:hbsbV3fbSIqnzEH1l
TLSH
T12B03CF32E4A89E338DE2A3C6B14777037FB86057C6840B90E9DE1F4E069B99D130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 bf056953546bdc6a8e1317ca0a5ea4e3bb6d6283b04e1d87cb33faee690a8f6b
MD5 637283f152f0fbfc61a16459a7792883
SHA1 54b91c3418d20da29e8f1216939d357fe55dbff0
SHA512 c340620bf1580831a95356da32c61d78c63d9891d2920fe767efa18356d1c7978c03e866e86bd32d392c35fd03b6a6731ddcaa56f963acbc043800f4245b6520
SSDEEP 768:Arv+4UNbdk3tQM/TBOWQtt2IONXyer1IRCzni95M:Absbe3tXQSIqn2M
TLSH
T10A03AE31E1689E334DE6A386B10777937FB8206795C10B60EED61B8E058B99E270F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 c5f950ecf5be7d258681b888cd167ce829fd4471c76fb08d29dddee58f9f115c
MD5 156680c2a9def93901aa0578a2319c8a
SHA1 8c1eb676c71cfa378d041de79260c22d21f45387
SHA512 5f4477d741fc25ee28f5bbf61d227b04f88c03d849ea7a87853a6d9b4efdbf0cbf71c584a54587b186cbc87fab28136e76a50103aa615b306805940c4b9407ec
SSDEEP 768:cz3OSM/TBOWQtt2GONXyer1IRCzni950uTHriBu8:cz3OFeSIqn20cHriBJ
TLSH
T101F2BF7195519D238DEAB396B10A6B43BFF86063C5C84A90EEEA1F0F018795E171F81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 355efcc699284a8127e81ca6d7af739979bd6fecac133254a727abb0000181a8
MD5 a8a7005449c1a86a25e1c09eb705536b
SHA1 0c28ebe8808484c233a3e179be82a5bce4efd408
SHA512 b55ba51df9587c086dcc0a555dbb9bca2e588409631149857e58becc6a328bfa6b053e6d4fe6af625da7233c79369d69e07fc73cfcab16b0efd36e4a8e3d1ebe
SSDEEP 768:Kz3PJqt/TBOWQtt2GONXyer1IRCzni950uTHriBu8:Kz3PyeSIqn20cHriBJ
TLSH
T157F2BE7195519D238DEAB396B10A7B43BFF86063C5C84A90EEEA1F0F0187A5E171F817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 dc470f3181c594ceb33095d8bebdb2dcfaa1c71f4b6c4a542f82d9d0cd6d95e3
MD5 82464dfb94e3129c9dc851a2e07b88a3
SHA1 27df8569779b6d1505eaec86a23cc628aa708ad8
SHA512 d2f1a945635ae355447a777f27514f5094c05b86daa1222b3db4c35f6d51b23b6824b740b6b51c86235811c896c1f671ed22329c6715b2c24ff545008753effd
SSDEEP 768:jrv+4UNbdz3m+/TBOWQtt2ZONXyer1IRCzniw5eVH1SK7:jbsbV3/xSIqnlEH1l
TLSH
T15D03BF31D169DE334DE2A396B14777437FB8206789840B90EDDA1F4E069799E130F91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 91b77a04eb04a75f6e35f7a69edcb497c69a6a62eeb515e7f9df02349411d296
MD5 b491f0890ee60eccd75d65a928a58b61
SHA1 86a68825d33d05e454ab81cf9c79cb0dfdfe6a50
SHA512 fdfd2bca1510ab65b24e26bd03dac4c126cfca339dd899f06decf5b8362937c8909a8f6c7fe9382fea6ba8c30b9457e12334c4215e2025a294f28bc8a055d0d2
TLSH
T12FE00202571010ADC034023040431F342FA28021015102859B31015E1C317002F145C0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5a9145.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a9145.TMP
Size 392B
SHA256 41dbae3d8584b230f0540fcf5f7416b3061039a0e848cee6f2d8d97481b80001
MD5 8b1f6b0fdba424db10147654567553c2
SHA1 b0ba0a12dfb8d719e48723acd0c3db9448495649
SHA512 a960fe947347cbd68e4dd970cb48b5c9b66b9f767df686bf8600c758b8c0b7daf4f8126fd5811e8acb671e9b164a4985ccd6b3abebdca8182598ab9c954ba49c
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 435471b87a1a97b0e29f7d5dd0878e63031511f063629d7e750852c068e7c4f5
MD5 81b56f1dad28119d54bf23c83fc570b9
SHA1 cb9a89a716465611149ce3c700bd60681d434faf
SHA512 77bd4d53ca86d66d29ba662dd424e94e5cef46c6a460cbf9f8d87a40c627401c0f6d0fe30258c23ed1cf63df1a70b19288885a33c206fb85a19f12efaab61927
TLSH
T1F3216833B3DD8614C89A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ba357b9a3aa5469ed2a3c2162d2f222020f0b36f51b6e3008211c36384a56485
MD5 b2ecd2a194985841eb4c50363e402d81
SHA1 b775e344f9090b03b63e081e8295a686af5b400b
SHA512 706416694611364a7d3d19aba60f313d967447df08e23a5757db853f215f548f02efd8a0264c293507d7ed0d4de5befaa1430cb9ed5d9f8884cc4d869eafa5d4
TLSH
T159217A33F3CC8724DC9A403650CEAC1036B6CBDB409ECE5BAB84D558B42F289CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_fqcy2pbm.kqr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fqcy2pbm.kqr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1140_570643305\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

client.json

Path C:\Users\Admin\AppData\Roaming\PandaRemote\client.json
Size 92B
SHA256 fdb479aff9288a81232b03cbc596ad978da67b7f0392af7c52621b69a1c6b096
MD5 ee462fb9142967683614c7d3eb0c211c
SHA1 cc264b54f0415dd76c255651d105b964e1da6b4d
SHA512 c94a525eef8980f30e56f99070ca2f37d4eeeb4f1f4f1402dc0456b5ec6e8085b2c6b05b9a359d6ff5654482e199b3c24d6d86cb11edf5254eee6cdd5802b062
TLSH
T165B022BE08AA2CB8C3B308800CBA3B8E30ABA0C388CC0CF88C0C2E300CCC0002302023
MD5 SHA1 SHA512 TLSH

Submit Download

client.log

Path C:\Users\Admin\AppData\Roaming\PandaRemote\client.log
Size 5KB
SHA256 c0a7415f17dab23a09cb6a71c2de2165cfae6308c4b22a0023f9b29fb7fc7bcb
MD5 5d813ea8dbaf9672726dd58a896597fc
SHA1 85b60cacb7b994412f42302d336b4014f9948ff4
SHA512 5aedcec7bda0b03bd2e1fdce740b24834d595486b67e556b8d152e482be1111b2b1b8e24a00eec44f1c1e416af838e3f910c63f42bb01d4720bbc623d05b6bed
SSDEEP 96:aKad6k6WJERhAfMIOKaduUaA97ARtF7BXMOk1ryAv+Y+EDRdlaVdIaTMDJXJ4Kag:aKCL6WJERh7KCPcF1XMOmyS+Y+6R7aVO
TLSH
T1A0C16F8828A3EDF01C51590392318522D165D225F88CA0B2BBFC9B5D5387563F1FFBE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

client.log

Path C:\Users\Admin\AppData\Roaming\PandaRemote\client.log
Size 6KB
SHA256 d6591bfb368c0433223cac031ebdcc1d1dacf3b83861491483bbb968664e3b68
MD5 9cc1f2597e451a2c3774ea2330912658
SHA1 0753df261c5426a45774d6666dbef6050ac5cd94
SHA512 62550633db83f2b15ec0b266e72b1092fd55b05570b753e9d74f669c9dcb27ef47990d321f851df363af35d031047047e163e07dc8d9f3bb3f4ab18b441e5312
SSDEEP 192:aKCL6WJERh7KCPcF1XMOmyS+Y+6R7aVyaTMDJXJ4KCs6fDafDwKCS:aKCmWOh7KCPi1cOfhLO2lMtZ4KCsUKCS
TLSH
T15AE140C818A3EDF05C81590396318522D166D255F88CA0B2BBFC9B5D5387562F2FFBD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

client.log

Path C:\Users\Admin\AppData\Roaming\PandaRemote\client.log
Size 8KB
SHA256 922ccc68817e6380ad4a36330b3f5d5709c1bac49c60f5bc9065cd9ab638562d
MD5 d681438f1d4228015c94017bc039c197
SHA1 0ffbf062e3e6c530b48840c68eac85f397732978
SHA512 7245e8e9b5da7ab7b82b06d57554c778655570600d8dc79ce54adfb5d07af160cc8a7e68fbb9fc4b53ac4bd5674b966b07236e3d9a906ec23586b4150f3c0391
SSDEEP 192:aKCL6WJERh7KCPcF1XMOmyS+Y+6R7aVyaTMDJXJ4KCs6fDafDwKCpfDMfDVvKCbC:aKCmWOh7KCPi1cOfhLO2lMtZ4KCsUKCj
TLSH
T1590252C818A3EDF05C815A0396318512E162D215F98CE0B2B7FD9B899387562F2FFBD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

client.log

Path C:\Users\Admin\AppData\Roaming\PandaRemote\client.log
Size 10KB
SHA256 5b8fbf9078c403dd4e6db2c156667bd1e5ee4c681f4d239993d5d93ab536146f
MD5 61b43beb67d3e29e826164d7e5022682
SHA1 0619e8c58c61a74e1cb7697fbf308544c9d5d584
SHA512 bb2a3a04dacacfad6416221531bdaab4268d6122e26a068b354c636f35de7971e48d0b8e2c1bfd61617187a80cd974986fed5097e82519ab1fa77fdd63f46856
SSDEEP 192:aKCL6WJERh7KCPcF1XMOmyS+Y+6R7aVyaTMDJXJ4KCs6fDafDwKCpfDMfDVvKCbu:aKCmWOh7KCPi1cOfhLO2lMtZ4KCsUKCB
TLSH
T1E62262D82893EDB19C815A4399314512E162D215F88CE0B6B7FD8B889387563F2FFBD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

client.log

Path C:\Users\Admin\AppData\Roaming\PandaRemote\client.log
Size 11KB
SHA256 ea26742d1079fb6d119961777aad3d7fe0d0553154ea657e72f381ae212a6f0c
MD5 ec39843799731c6247dd611fd1892d72
SHA1 813dd6b3ce3ab3120b6f15c5c93aae1b55e239d6
SHA512 0fde9e5135260b808c5bd02aba39421cdad2375b434dc7dbdea7fdd3f0d2f3d87c3892db849831c673543f0bca4b3e7af6165a01f0b1a8651bcfac9f041df494
SSDEEP 192:aKCL6WJERh7KCPcF1XMOmyS+Y+6R7aVyaTMDJXJ4KCs6fDafDwKCpfDMfDVvKCbA:aKCmWOh7KCPi1cOfhLO2lMtZ4KCsUKCv
TLSH
T1683262D82493FDB19C811A4399314512E162C215F98CE0B6F7F94B8CA78B563F2BBBD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

client.log

Path C:\Users\Admin\AppData\Roaming\PandaRemote\client.log
Size 1KB
SHA256 3f0292a57ed760ff88bfaed8b8b52c78c9395183ad0aac0496ad7bfa30084707
MD5 bb0c32c3f8cca7472081a2d3e0ba27e1
SHA1 6a5965ee17ec529148f8b44d5dad8b9870815ccd
SHA512 4d256128f34e93e6db3728633889a289ae6be14bf9acb8b1061b61aea1806a634e09ee819ac1f5b0ec592b588c84817690de02a7626531edafc942565c42d7a6
TLSH
T1503111881493DCB45C41A90397325162E1A5C520B9CCA0B27FF08FAD5287A63B1EFFD8
MD5 SHA1 SHA512 TLSH

Submit Download

panda.pid

Path C:\Users\Admin\AppData\Roaming\PandaRemote\panda.pid
Size 4B
SHA256 34ed0cec6ebf3e846818bc8b7c51169dddec9d9dbc557370f4701384563710c0
MD5 0f304eddb4ad6007a3093fd6d963a1d2
SHA1 2b086baf1e1b6116f287be6b521caec8fc8bc519
SHA512 d19785f0d43bb4a6dc1b2e4b39186f02f4ac0ea305b172011927e6b0cc3f5cd0242932020ecc900662986538ee8c1c1d1193ddfac97f60a257121be9500917e3
MD5 SHA1 SHA512

Submit Download

watchdog.pid

Path C:\Users\Admin\AppData\Roaming\PandaRemote\watchdog.pid
Size 4B
SHA256 e5e53c784d5d49de1cabb6e904bf3380026aadcb9769775a268dd304dd9aa2df
MD5 ef8446f35513a8d6aa2308357a268a7e
SHA1 527dc687fa586a676045bc4cf16cb04ba5ff58eb
SHA512 b8a59dc0ccab9e8c864a220ddccb579e9cb74bfa51851766b67206c85d3e37be048a483eb8c25dc702047a2edd02926f7f2a6c065b1f817df934c2a1f0284059
MD5 SHA1 SHA512

Submit Download

watchdog.pid

Path C:\Users\Admin\AppData\Roaming\PandaRemote\watchdog.pid
Size 4B
SHA256 93e2a45037eb149bd13e633f2cdd848b0caaa04a4f048df7c49de10fb41a3d16
MD5 186fb23a33995d91ce3c2212189178c8
SHA1 323621a00c94f0d1c848e8962af7adbe478f274e
SHA512 1e29a8a7b425ad0e220b1f8dd5a0383ae733716530ee07ad603c5b23ab0f1c16ed82a645749471d7bd99f3cdc37cccb1dee6896cfc9b56ef59aa5c09df1898ff
MD5 SHA1 SHA512

Submit Download

memory/2080-222-0x000001FDC9E20000-0x000001FDC9ED2000-memory.dmp

Download

memory/3516-55-0x0000018C5FB60000-0x0000018C5FB7E000-memory.dmp

Download

memory/3516-40-0x0000018C5F8A0000-0x0000018C5F8C2000-memory.dmp

Download

memory/3516-56-0x0000018C5FB80000-0x0000018C5FC32000-memory.dmp

Download

memory/3516-60-0x0000018C5F950000-0x0000018C5F95A000-memory.dmp

Download