neshta | 91347fb0461e20c56d0039e4f6924f8243ce9de9431bd5a962990444ce64bdb8

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-24_5ecd2ea13886e9519056fba6502ca97e_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
Size 5.2MB
Sample260825-phcspsysdw
SHA256 91347fb0461e20c56d0039e4f6924f8243ce9de9431bd5a962990444ce64bdb8
MD5 5ecd2ea13886e9519056fba6502ca97e
SHA1 9929f4a580600d57bdd988fee7e9abff4484b6fb
SHA512 69c4691534f0ebad8ac8b31570ca8e036fbda5fca370964eae61c9f2e54d97a96d2e5f759fd182430e52cd8a4c848af1de766c9e645f7440fdbd63bac7410436
SSDEEP 49152:7IaeM8+2eGLnlGYW27VJVoVZ2Dau0grBK7ROes/5Re9aLHcj3RhtlGM2ebLlltHx:YM8ztWqQ+bwjB6veY2lkHQhcciwt
TLSH
T16A466C03F2EA41D8E0BAD6758B269232E976BC454B34A2DF075036191E75FE09F3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery neshta persistence spyware stealer

Malware Config

Signatures

Family: Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta

Detect Neshta payload 55 IoCs

resource	yara_rule
behavioral1/files/0x00060000000202b0-85.dat	family_neshta
behavioral1/memory/6004-546-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/files/0x00010000000230cc-550.dat	family_neshta
behavioral1/memory/2896-705-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/files/0x001300000002458e-679.dat	family_neshta
behavioral1/files/0x00040000000203d5-794.dat	family_neshta
behavioral1/files/0x0007000000020310-795.dat	family_neshta
behavioral1/files/0x00040000000203da-804.dat	family_neshta
behavioral1/files/0x0001000000020339-803.dat	family_neshta
behavioral1/files/0x00040000000203c8-802.dat	family_neshta
behavioral1/files/0x0001000000020326-801.dat	family_neshta
behavioral1/files/0x00010000000202b7-800.dat	family_neshta
behavioral1/files/0x00040000000203c7-799.dat	family_neshta
behavioral1/files/0x00060000000202a4-798.dat	family_neshta
behavioral1/files/0x00060000000202a8-796.dat	family_neshta
behavioral1/files/0x00060000000202bf-825.dat	family_neshta
behavioral1/files/0x000400000002039b-824.dat	family_neshta
behavioral1/files/0x0001000000020321-823.dat	family_neshta
behavioral1/files/0x00060000000202c7-826.dat	family_neshta
behavioral1/files/0x0001000000021554-831.dat	family_neshta
behavioral1/files/0x000300000001e857-849.dat	family_neshta
behavioral1/files/0x00010000000231b1-848.dat	family_neshta
behavioral1/files/0x00010000000231af-847.dat	family_neshta
behavioral1/files/0x0001000000023149-845.dat	family_neshta
behavioral1/files/0x0001000000023144-844.dat	family_neshta
behavioral1/files/0x000100000002313e-842.dat	family_neshta
behavioral1/files/0x000100000002313c-841.dat	family_neshta
behavioral1/files/0x0001000000023181-840.dat	family_neshta
behavioral1/files/0x00010000000230c7-839.dat	family_neshta
behavioral1/files/0x00010000000230c6-838.dat	family_neshta
behavioral1/files/0x00010000000230b8-837.dat	family_neshta
behavioral1/files/0x00010000000230b6-836.dat	family_neshta
behavioral1/files/0x000100000002353b-835.dat	family_neshta
behavioral1/files/0x0001000000021556-833.dat	family_neshta
behavioral1/files/0x0001000000021555-832.dat	family_neshta
behavioral1/files/0x00010000000227c0-830.dat	family_neshta
behavioral1/files/0x000200000002039f-828.dat	family_neshta
behavioral1/files/0x00080000000202c9-827.dat	family_neshta
behavioral1/files/0x00010000000215a9-829.dat	family_neshta
behavioral1/files/0x000300000001e85d-851.dat	family_neshta
behavioral1/files/0x000400000001ebef-855.dat	family_neshta
behavioral1/files/0x000300000001ecf0-854.dat	family_neshta
behavioral1/files/0x000300000001e890-853.dat	family_neshta
behavioral1/files/0x000300000001e885-852.dat	family_neshta
behavioral1/memory/6004-873-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/5620-905-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/3148-970-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/4032-978-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/6004-1009-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/5620-1010-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/6004-1282-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/5620-1304-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/6004-1315-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/5620-1318-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/6004-1319-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2896 created 2520	2896	identity_helper.exe	51

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	2026-08-24_5ecd2ea13886e9519056fba6502ca97e_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	identity_helper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	setup.exe

Executes dropped EXE 11 IoCs

pid	Process
1844	2026-08-24_5ecd2ea13886e9519056fba6502ca97e_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
636	identity_helper.exe
2896	identity_helper.exe
5620	svchost.com
4604	IDENTI~1.EXE
3148	setup.exe
4032	svchost.com
3156	setup.exe
5720	setup.exe
1400	setup.exe
4256	setup.exe

Loads dropped DLL 1 IoCs

pid	Process
1820	msedge.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	2026-08-24_5ecd2ea13886e9519056fba6502ca97e_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	2026-08-24_5ecd2ea13886e9519056fba6502ca97e_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1820_301820611\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1820_789562871\llm_user_input_extractor_config.json	msedge.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\MSEDGE~2.EXE	2026-08-24_5ecd2ea13886e9519056fba6502ca97e_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\MICROS~1.EXE	2026-08-24_5ecd2ea13886e9519056fba6502ca97e_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{5625B~1\WINDOW~1.EXE	2026-08-24_5ecd2ea13886e9519056fba6502ca97e_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe	svchost.com
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\a4da7b0e-5aab-4548-88fd-f029d2185408.tmp	setup.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	2026-08-24_5ecd2ea13886e9519056fba6502ca97e_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\INSTAL~1\setup.exe	2026-08-24_5ecd2ea13886e9519056fba6502ca97e_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\IDENTI~1.EXE	2026-08-24_5ecd2ea13886e9519056fba6502ca97e_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1820_789562871\manifest.json	msedge.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	2026-08-24_5ecd2ea13886e9519056fba6502ca97e_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	2026-08-24_5ecd2ea13886e9519056fba6502ca97e_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1820_301820611\_locales\sr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1820_301820611\_locales\sv\messages.json	msedge.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	2026-08-24_5ecd2ea13886e9519056fba6502ca97e_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	svchost.com
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1820_301820611\_locales\th\messages.json	msedge.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	2026-08-24_5ecd2ea13886e9519056fba6502ca97e_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe	2026-08-24_5ecd2ea13886e9519056fba6502ca97e_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	2026-08-24_5ecd2ea13886e9519056fba6502ca97e_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	svchost.com
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1820_301820611\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1820_301820611\_locales\as\messages.json	msedge.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	2026-08-24_5ecd2ea13886e9519056fba6502ca97e_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1820_301820611\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1820_301820611\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1820_301820611\_locales\ms\messages.json	msedge.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MIA062~1.EXE	2026-08-24_5ecd2ea13886e9519056fba6502ca97e_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1820_301820611\_locales\ml\messages.json	msedge.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MICROS~3.EXE	2026-08-24_5ecd2ea13886e9519056fba6502ca97e_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	2026-08-24_5ecd2ea13886e9519056fba6502ca97e_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge.exe	2026-08-24_5ecd2ea13886e9519056fba6502ca97e_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MIA062~1.EXE	2026-08-24_5ecd2ea13886e9519056fba6502ca97e_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	2026-08-24_5ecd2ea13886e9519056fba6502ca97e_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	2026-08-24_5ecd2ea13886e9519056fba6502ca97e_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1820_301820611\_locales\kn\messages.json	msedge.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	2026-08-24_5ecd2ea13886e9519056fba6502ca97e_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	2026-08-24_5ecd2ea13886e9519056fba6502ca97e_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	2026-08-24_5ecd2ea13886e9519056fba6502ca97e_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1820_301820611\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1820_301820611\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1820_301820611\_locales\pa\messages.json	msedge.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\PWAHEL~1.EXE	2026-08-24_5ecd2ea13886e9519056fba6502ca97e_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1820_301820611\offscreendocument.html	msedge.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1820_301820611\_locales\fil\messages.json	msedge.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedgewebview2.exe	2026-08-24_5ecd2ea13886e9519056fba6502ca97e_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1820_301820611\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1820_771690279\domain_actions.dll	msedge.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	2026-08-24_5ecd2ea13886e9519056fba6502ca97e_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	2026-08-24_5ecd2ea13886e9519056fba6502ca97e_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\msedge.exe	2026-08-24_5ecd2ea13886e9519056fba6502ca97e_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1820_301820611\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1820_301820611\_locales\fi\messages.json	msedge.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	2026-08-24_5ecd2ea13886e9519056fba6502ca97e_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1820_301820611\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1820_301820611\_locales\my\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1820_215649996\manifest.json	msedge.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe	2026-08-24_5ecd2ea13886e9519056fba6502ca97e_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1820_301820611\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1820_215649996\protocols.json	msedge.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\svchost.com	setup.exe
File opened for modification	C:\Windows\svchost.com	svchost.com
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\directx.sys	setup.exe
File opened for modification	C:\Windows\svchost.com	2026-08-24_5ecd2ea13886e9519056fba6502ca97e_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\Windows\directx.sys	identity_helper.exe
File opened for modification	C:\Windows\svchost.com	svchost.com
File opened for modification	C:\Windows\svchost.com	identity_helper.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-24_5ecd2ea13886e9519056fba6502ca97e_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	identity_helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.com

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5964	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321339963913510"	msedge.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	identity_helper.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{83A8333C-4323-4123-ACEA-44C73B0B3B8A}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	2026-08-24_5ecd2ea13886e9519056fba6502ca97e_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4440	msedge.exe
4440	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1820	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 6004 wrote to memory of 1844	6004	2026-08-24_5ecd2ea13886e9519056fba6502ca97e_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe	85
PID 1844 wrote to memory of 1820	1844	2026-08-24_5ecd2ea13886e9519056fba6502ca97e_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe	86
PID 1820 wrote to memory of 792	1820	msedge.exe	87
PID 1820 wrote to memory of 5964	1820	msedge.exe	88
PID 1820 wrote to memory of 3668	1820	msedge.exe	89
PID 1820 wrote to memory of 3668	1820	msedge.exe	89
PID 1820 wrote to memory of 3668	1820	msedge.exe	89
PID 1820 wrote to memory of 5084	1820	msedge.exe	90
PID 1820 wrote to memory of 5084	1820	msedge.exe	90
PID 1820 wrote to memory of 1940	1820	msedge.exe	91
PID 1820 wrote to memory of 1940	1820	msedge.exe	91
PID 1820 wrote to memory of 1940	1820	msedge.exe	91
PID 1820 wrote to memory of 1884	1820	msedge.exe	92
PID 1820 wrote to memory of 1884	1820	msedge.exe	92
PID 1820 wrote to memory of 1884	1820	msedge.exe	92
PID 1820 wrote to memory of 1848	1820	msedge.exe	94
PID 1820 wrote to memory of 3800	1820	msedge.exe	95
PID 1820 wrote to memory of 5664	1820	msedge.exe	96
PID 1820 wrote to memory of 1100	1820	msedge.exe	100
PID 1820 wrote to memory of 1100	1820	msedge.exe	100
PID 1820 wrote to memory of 5908	1820	msedge.exe	101
PID 1820 wrote to memory of 5908	1820	msedge.exe	101
PID 1820 wrote to memory of 2896	1820	msedge.exe	104
PID 2896 wrote to memory of 5620	2896	identity_helper.exe	105
PID 5620 wrote to memory of 4604	5620	svchost.com	106
PID 1820 wrote to memory of 3148	1820	msedge.exe	111
PID 3148 wrote to memory of 4032	3148	setup.exe	114
PID 4032 wrote to memory of 3156	4032	svchost.com	115
PID 3156 wrote to memory of 5720	3156	setup.exe	116
PID 3156 wrote to memory of 1400	3156	setup.exe	117
PID 1400 wrote to memory of 4256	1400	setup.exe	118
PID 1820 wrote to memory of 4112	1820	msedge.exe	127
PID 1820 wrote to memory of 4112	1820	msedge.exe	127
PID 1820 wrote to memory of 4700	1820	msedge.exe	130
PID 1820 wrote to memory of 4700	1820	msedge.exe	130
PID 1820 wrote to memory of 4532	1820	msedge.exe	131
PID 1820 wrote to memory of 4532	1820	msedge.exe	131
PID 1820 wrote to memory of 4708	1820	msedge.exe	134
PID 1820 wrote to memory of 4708	1820	msedge.exe	134
PID 1820 wrote to memory of 2644	1820	msedge.exe	135
PID 1820 wrote to memory of 2644	1820	msedge.exe	135
PID 1820 wrote to memory of 4544	1820	msedge.exe	136
PID 1820 wrote to memory of 4544	1820	msedge.exe	136
PID 1820 wrote to memory of 4516	1820	msedge.exe	137
PID 1820 wrote to memory of 4516	1820	msedge.exe	137
PID 1820 wrote to memory of 4440	1820	msedge.exe	138
PID 1820 wrote to memory of 2264	1820	msedge.exe	139
PID 1820 wrote to memory of 2264	1820	msedge.exe	139

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2520
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\IDENTI~1.EXE" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,1314816686400580274,9986588159336944758,524288 --field-trial-handle=2332,i,6260383434140791350,17407935296672312090,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5620
- - C:\Users\Admin\AppData\Local\Temp\3582-490\IDENTI~1.EXE
    C:\Users\Admin\AppData\Local\Temp\3582-490\IDENTI~1.EXE --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,1314816686400580274,9986588159336944758,524288 --field-trial-handle=2332,i,6260383434140791350,17407935296672312090,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:8
    3⤵
    - Executes dropped EXE
    PID:4604

C:\Users\Admin\AppData\Local\Temp\2026-08-24_5ecd2ea13886e9519056fba6502ca97e_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_5ecd2ea13886e9519056fba6502ca97e_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe"
1⤵
- Checks computer location settings
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:6004
- C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-24_5ecd2ea13886e9519056fba6502ca97e_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-24_5ecd2ea13886e9519056fba6502ca97e_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --force-first-run
    3⤵
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffcbb12c188,0x7ffcbb12c194,0x7ffcbb12c1a0
      4⤵
      PID:792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,4972937583471252699,17174487162727766153,524288 --field-trial-handle=2332,i,6260383434140791350,17407935296672312090,262144 --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:3
      4⤵
      System Time Discovery
      PID:5964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,2258450892026960423,14120025014530362867,262144 --field-trial-handle=2332,i,6260383434140791350,17407935296672312090,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
      4⤵
      PID:3668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,12089731567050140568,10440095848151494096,524288 --field-trial-handle=2332,i,6260383434140791350,17407935296672312090,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:8
      4⤵
      PID:5084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,6826897720084575438,6345658178873134114,2097152 --field-trial-handle=2332,i,6260383434140791350,17407935296672312090,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
      4⤵
      PID:1940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,14530558125548686609,15580808687920068942,2097152 --field-trial-handle=2332,i,6260383434140791350,17407935296672312090,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
      4⤵
      PID:1884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4124,i,13036726429055184499,6362119771391708474,524288 --field-trial-handle=2332,i,6260383434140791350,17407935296672312090,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:8
      4⤵
      PID:1848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4184,i,4968133024402102997,554466156260476978,524288 --field-trial-handle=2332,i,6260383434140791350,17407935296672312090,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:8
      4⤵
      PID:3800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4196,i,16802529810400612499,5991594192340938309,524288 --field-trial-handle=2332,i,6260383434140791350,17407935296672312090,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:8
      4⤵
      PID:5664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,5499489399370151938,258170388779709620,524288 --field-trial-handle=2332,i,6260383434140791350,17407935296672312090,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:8
      4⤵
      PID:1100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,4887808177190360677,9829141055181825629,524288 --field-trial-handle=2332,i,6260383434140791350,17407935296672312090,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:8
      4⤵
      PID:5908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,1314816686400580274,9986588159336944758,524288 --field-trial-handle=2332,i,6260383434140791350,17407935296672312090,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,1314816686400580274,9986588159336944758,524288 --field-trial-handle=2332,i,6260383434140791350,17407935296672312090,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:8
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Checks computer location settings
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3148
    - - C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4032
      - C:\Users\Admin\AppData\Local\Temp\3582-490\setup.exe
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\setup.exe --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:3156
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\setup.exe
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 --annotation=exe=C:\Users\Admin\AppData\Local\Temp\3582-490\setup.exe --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x20c,0x210,0x214,0x1e8,0x218,0x7ff72c6e04c8,0x7ff72c6e04d4,0x7ff72c6e04e0
        7⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3582-490\setup.exe" --msedge --system-level --verbose-logging --installerdata="C:\Program Files (x86)\Microsoft\Edge\Application\master_preferences" --create-shortcuts=1 --install-level=0
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1400
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\setup.exe
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 --annotation=exe=C:\Users\Admin\AppData\Local\Temp\3582-490\setup.exe --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x218,0x21c,0x220,0x1f4,0x224,0x7ff72c6e04c8,0x7ff72c6e04d4,0x7ff72c6e04e0
        8⤵
        Executes dropped EXE
        
        PID:4256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,14810037667957018527,10551239891043883067,524288 --field-trial-handle=2332,i,6260383434140791350,17407935296672312090,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
      4⤵
      PID:4112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,10849841976896238192,4881784266412355888,524288 --field-trial-handle=2332,i,6260383434140791350,17407935296672312090,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
      4⤵
      PID:4700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1996,i,11300666423286412794,15851758044311356069,524288 --field-trial-handle=2332,i,6260383434140791350,17407935296672312090,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
      4⤵
      PID:4532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,17399863100822622436,7659475569408110359,524288 --field-trial-handle=2332,i,6260383434140791350,17407935296672312090,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:8
      4⤵
      PID:4708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6924,i,2966428613566366779,14363975948622134269,524288 --field-trial-handle=2332,i,6260383434140791350,17407935296672312090,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:8
      4⤵
      PID:2644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,531086639079596983,6599154351604889430,524288 --field-trial-handle=2332,i,6260383434140791350,17407935296672312090,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:8
      4⤵
      PID:4544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,17760727345389162466,8916839826167804670,524288 --field-trial-handle=2332,i,6260383434140791350,17407935296672312090,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:8
      4⤵
      PID:4516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7048,i,13658927356906038913,16649554661524375280,262144 --field-trial-handle=2332,i,6260383434140791350,17407935296672312090,262144 --variations-seed-version --mojo-platform-channel-handle=7136 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1308,i,7791242324516626649,5752823686639915218,524288 --field-trial-handle=2332,i,6260383434140791350,17407935296672312090,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:8
      4⤵
      PID:2264

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ACROBR~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE
Size 328KB
SHA256 888a1dd0033e5d758a4e731e3e55357de866e80d03b1b194375f714e1fd4351d
MD5 39c8a4c2c3984b64b701b85cb724533b
SHA1 c911f4c4070dfe9a35d9adcb7de6e6fb1482ce00
SHA512 f42ca2962fe60cff1a13dea8b81ff0647b317c785ee4f5159c38487c34d33aecba8478757047d31ab2ee893fbdcb91a21655353456ba6a018fc71b2278db4db2
SSDEEP 6144:k9x6edjvw6L6jAVnhH1Am2ZBU4M528hW8Bi7Q5VYN9:Y6exwI1oB8RZ4Q5VYH
TLSH
T1DC645B017F908EB6F5A2807F5D7A631D5A6ABA221B10E2C373703B5DCD321C59A3E356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ACROTE~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
Size 86KB
SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
MD5 3b73078a714bf61d1c19ebc3afc0e454
SHA1 9abeabd74613a2f533e2244c9ee6f967188e4e7e
SHA512 75959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4
SSDEEP 1536:JxqjQ+P04wsmJCNgh/sE/EkHd0Ci2zkQASqk+H6L2C:sr85CysEM6GC+QA8+HlC
TLSH
T17493AE13FAF18872D1621BF89C29E359C93F7A306E3056A7A3E40D5D5D747C26C2924B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ADOBEC~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE
Size 5.7MB
SHA256 1b5c715d71384f043843ea1785a6873a9f39d2daae112ccdeffcd88b10a3a403
MD5 09acdc5bbec5a47e8ae47f4a348541e2
SHA1 658f64967b2a9372c1c0bdd59c6fb2a18301d891
SHA512 3867bf98e1a0e253114a98b78b047b0d8282b5abf4aaf836f31cc0e26224e2a1b802c65df9d90dc7696a6dbcb9a8e4b900f1d1299e1b11e36f095ebaf8a2e5b8
SSDEEP 49152:DmlI9H9rY654KYroYJqkhWFUBlNwnFq3kXRsPI6BRY20YZAliDgFL2YmXZjU2P38:oiH9MfT3NwMkKhBRr0yAk6qkKvq
TLSH
T1F3567C22B902C139E15102B159ECBFE9C49D99348FB105DFBAC41F6E9A613E33931E67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ADelRCP.exe

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe
Size 175KB
SHA256 3f00404dd591c2856e6f71bd78423ed47199902e0b85f228e6c4de72c59ddffe
MD5 576410de51e63c3b5442540c8fdacbee
SHA1 8de673b679e0fee6e460cbf4f21ab728e41e0973
SHA512 f7761f3878775b30cc3d756fa122e74548dfc0a27e38fa4109e34a59a009df333d074bf14a227549ae347605f271be47984c55148685faac479aeb481f7191db
SSDEEP 3072:sr85CnHb5CZCq5DACsVlNl7HIJ1PcJ7LxnkdA53Pa4sjSTX4:k9n4N5QVrZZ7Lxkmsjj
TLSH
T119045C22BBC09075E69317723EFC79E44BF6BC319AA410ABF318495B197E350963931B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RdrCEF.exe

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe
Size 9.4MB
SHA256 31da9632f5d25806b77b617d48da52a14afc574bbe1653120f97705284ea566c
MD5 322302633e36360a24252f6291cdfc91
SHA1 238ed62353776c646957efefc0174c545c2afa3d
SHA512 5a1f7c44ce7f5036bffc18ebac39e2bf70e6f35fa252617d665b26448f4c4473adfa115467b7e2d9b7068823e448f74410cdcdfef1ac1c09021e051921787373
SSDEEP 98304:FrbT5JhEP+SuC0qyLfPeLDo/uLGM7gbl91hxkPZTA:lXnfW/JLGMcblLheTA
TLSH
T186A6AF1D7BE21036CD732176AF4FA104E739D007A215C6977ADC83981FB1AA152B6FE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcroRd32.exe

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
Size 2.4MB
SHA256 8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6
MD5 8ffc3bdf4a1903d9e28b99d1643fc9c7
SHA1 919ba8594db0ae245a8abd80f9f3698826fc6fe5
SHA512 0b94ead97374d74eaee87e7614ddd3911d2cf66d4c49abbfd06b02c03e5dd56fd00993b4947e8a4bcd9d891fa39cab18cc6b61efc7d0812e91eb3aea9cd1a427
SSDEEP 49152:oTfiUEWo6zuEz439z99akTBc4O8b8ITDnlT4NvJX:oTfiG/nzU90T
TLSH
T179C59226A2C8C0EBE5642170CC59BBF900546D78DBA2CDD7BD447E16BA307D29533A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WCCHRO~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE
Size 183KB
SHA256 ecd5e94da88c653e4c34b6ab325e0aca8824247b290336f75c410caa16381bc5
MD5 9dfcdd1ab508b26917bb2461488d8605
SHA1 4ba6342bcf4942ade05fb12db83da89dc8c56a21
SHA512 1afc1b95f160333f1ff2fa14b3f22a28ae33850699c6b5498915a8b6bec1cfc40f33cb69583240aa9206bc2ea7ab14e05e071275b836502a92aa8c529fc1b137
SSDEEP 3072:sr85Cl8pIsfHwCbf9MFdRvyAgnz8n/dfQ7PjFKq23T/h:k9KbfHwCbyFdAafCPc53T/h
TLSH
T177046B51F7C7C9B2E09206704C2AAF6541B9FE381F7105EBF3E87A1E5A713C2182566B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eula.exe

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe
Size 131KB
SHA256 5c3ef3ec7594c040146e908014791dd15201ba58b4d70032770bb661b6a0e394
MD5 5791075058b526842f4601c46abd59f5
SHA1 b2748f7542e2eebcd0353c3720d92bbffad8678f
SHA512 83e303971ed64019fde9e4ba6f6e889f8fb105088490dfa7dcf579a12baff20ef491f563d132d60c7b24a4fd3cac29bd9dc974571cd162000fae8fba4e0e54fb
SSDEEP 3072:sr85Ciq9YnyoRmLisiselSsONt3F7oQGO7M1bp:k9kgLHvld2
TLSH
T19CD37C13BBE0C872D66207785D25F36696AFF6305E74CB677B880B0E9DB46824D0C64A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FULLTR~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE
Size 254KB
SHA256 16d65f2463658a72dba205dcaa18bc3d0bab4453e726233d68bc176e69db0950
MD5 4ddc609ae13a777493f3eeda70a81d40
SHA1 8957c390f9b2c136d37190e32bccae3ae671c80a
SHA512 9d7f90d1529cab20078c2690bf7bffab5a451a41d8993781effe807e619da0e7292f991da2f0c5c131b111d028b3e6084e5648c90816e74dfb664e7f78181bc5
SSDEEP 3072:sr85CYl4dsOc6v2vTzwU+Pho86meq+FaSoB2+vSHr8qcVz5fzsC:k9r3PiY+Fa7BdvG1cT7
TLSH
T128446B307B86C53BE66301718CF8EBBF942EBA150F6851D7B3984B5E5EA05D32E31846
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOGTRA~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE
Size 386KB
SHA256 473eb551101caeaf2d18f811342e21de323c8dd19ed21011997716871defe997
MD5 8c753d6448183dea5269445738486e01
SHA1 ebbbdc0022ca7487cd6294714cd3fbcb70923af9
SHA512 4f6fddefc42455540448eac0b693a4847e21b68467486376a4186776bfe137337733d3075b7b87ed7dac532478dc9afc63883607ec8205df3f155fee64c7a9be
SSDEEP 6144:k9W3n0dK2NP0RHx8D98WTBPW8fF8oABm1nKZ0RsrI:WKhHSDeWTRW8fdebmqI
TLSH
T16A84AE11FB86C172D96602728DAAA35CC4BDB5714F314BD3E3DC6F0D9E601D2A932B86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

READER~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE
Size 92KB
SHA256 2f947e3ca624ce7373080b4a3934e21644fb070a53feeaae442b15b849c2954f
MD5 176436d406fd1aabebae353963b3ebcf
SHA1 9ffdfdb8cc832a0c6501c4c0e85b23a0f7eff57a
SHA512 a2d1a714e0c1e5463260c64048ba8fd5064cfa06d4a43d02fc04a30748102ff5ba86d20a08e611e200dc778e2b7b3ae808da48132a05a61aa09ac424a182a06a
SSDEEP 1536:JxqjQ+P04wsmJC66w8MghW4wNlu9HQIXsW/44:sr85C66w8oFlKwW//
TLSH
T1E1936C13BB928E33D4204AB91C6997B8D4BEF5306F1556E367650A4E8DBC3C22C3925F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WOW_HE~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE
Size 147KB
SHA256 750824b5f75c91a6c2eeb8c5e60ae28d7a81e323d3762c8652255bfea5cba0bb
MD5 3b35b268659965ab93b6ee42f8193395
SHA1 8faefc346e99c9b2488f2414234c9e4740b96d88
SHA512 035259a7598584ddb770db3da4e066b64dc65638501cdd8ff9f8e2646f23b76e3dfffa1fb5ed57c9bd15bb4efa3f7dd33fdc2e769e5cc195c25de0e340eb89ab
SSDEEP 3072:sr85Ce6l8TRpR+EMucyaGoS43IIJNdS3UA:k9e6l8aGo/3VL4kA
TLSH
T15EE38C57B7E134F8E1768A78CC615608EB32B8352A319BAF03A4065A5F273C05E3DF25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arh.exe

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe
Size 125KB
SHA256 fe44ca8d5050932851aa54c23133277e66db939501af58e5aeb7b67ec1dde7b5
MD5 cce8964848413b49f18a44da9cb0a79b
SHA1 0b7452100d400acebb1c1887542f322a92cbd7ae
SHA512 bf8fc270229d46a083ced30da6637f3ca510b0ce44624a9b21ec6aacac81666dffd41855053a936aa9e8ea6e745a09b820b506ec7bf1173b6f1837828a35103d
SSDEEP 1536:JxqjQ+P04wsmJCWM2D57Kykf8d/R8Tyr5J5is7MDjrXDyO4zkm8dbHVLokF8iJTp:sr85CCQw/STyr5Jks7MvrMzkm8PL3Eo
TLSH
T127C3AE22F6A1C432D4920D788919C3B18E3F7D3169A99957F7E80B5E9E607C0EA1D31F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32BITM~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE
Size 142KB
SHA256 3e9da97a7106122245e77f13f3f3cc96c055d732ab841eb848d03ac25401c1bc
MD5 92dc0a5b61c98ac6ca3c9e09711e0a5d
SHA1 f809f50cfdfbc469561bced921d0bad343a0d7b4
SHA512 d9eefb19f82e0786d9be0dbe5e339d25473fb3a09682f40c6d190d4c320cca5556abb72b5d97c6b0da4f8faefdc6d39ac9d0415fdf94ebcc90ecdf2e513c6a31
SSDEEP 1536:JxqjQ+P04wsmJC9S7UmwuBLAefbVH8x+FOI31EmkIY2d5J6WUghEuireklhKsikg:sr85Cs7HN9fN8sFOE1Z5Y2966ilU9xL
TLSH
T1F2E38D21F5C188B2E67205B54D2AA79E942CF6340F3194E3B3E84F2D9D342C39F765A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

64BITM~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE
Size 278KB
SHA256 22a585c183e27b3c732028ff193733c2f9d03700a0e95e65c556b0592c43d880
MD5 12c29dd57aa69f45ddd2e47620e0a8d9
SHA1 ba297aa3fe237ca916257bc46370b360a2db2223
SHA512 255176cd1a88dfa2af3838769cc20dc7ad9d969344801f07b9ebb372c12cee3f47f2dba3559f391deab10650875cad245d9724acfa23a42b336bfa96559a5488
SSDEEP 6144:k9P1UKupTu8ffMb0/GxsZfcJtqQ1UBZ6g:jK+HMYcytZh
TLSH
T105546C1A77D84CF5E467C23DCD528642E2B278551B34D7CB6760022AAF637E0AE3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ADOBEA~1.EXE

Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE
Size 454KB
SHA256 bb07d817b8b1b6b4c25e62b6120e51dec10118557d7b6b696ad084a5ba5bfdeb
MD5 bcd0f32f28d3c2ba8f53d1052d05252d
SHA1 c29b4591df930dabc1a4bd0fa2c0ad91500eafb2
SHA512 79f407735853f82f46870c52058ceee4d91857a89db14868ee1169abd5c0fd2e3fa1ed230ab90b5f479a9581b88998643d69b0df498defea29e73b0d487f3b10
SSDEEP 6144:k9sQsSVWSLjX2PxPNMRyfn7LzPdKblt0K+HAfh0v8axsbQuXYvr6yIll6Jf:+VWnxlMSn7nFKbltn+Ch/m6Xl6l
TLSH
T1E1A47C1077D0C036F1B329768A7FE728546DB9715F6881CFE3881A6E4E706E0AA3571B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.exe

Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe
Size 1.2MB
SHA256 b1ec065f71cc40f400e006586d370997102860504fd643b235e8ed9f5607262a
MD5 d47ed8961782d9e27f359447fa86c266
SHA1 d37d3f962c8d302b18ec468b4abe94f792f72a3b
SHA512 3e33f2cdf35024868b183449019de9278035e7966b342ba320a6c601b5629792cbb98a19850d4ca80b906c85d10e8503b0193794d1f1efa849fa33d26cff0669
SSDEEP 12288:M0ZRHkXVfeeO4LMneqyQsWSjGQCfLBlS7guN1AnQ6i12NI+03Sgouvb:M0ZRHkFfenxyQZXS7gZnQh2NIDSgouvb
TLSH
T19D45E50267F94129F1F37B71EEB993645A77BC61AE39C50E5284025E0DB4A90EE31B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaureg.exe

Path C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe
Size 555KB
SHA256 c5a99f42100834599e4995d0a178b32b772a6e774a4050a6bb00438af0a6a1f3
MD5 ce82862ca68d666d7aa47acc514c3e3d
SHA1 f458c7f43372dbcdac8257b1639e0fe51f592e28
SHA512 bca7afd6589c3215c92fdaca552ad3380f53d3db8c4b69329a1fa81528dd952a14bf012321de92ad1d20e5c1888eab3dd512b1ac80a406baccc37ee6ff4a90dc
SSDEEP 12288:PKv89GDYikjjqggz7/PtFxRNWBYrpkQJ7u:PKqjjg/PzNWyr9J7u
TLSH
T1A5C4BF2079A0C032D17311344D6AE794A63EF6700E7249E777D46FBD7E346C1EB28AA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOIN~1.EXE

Path C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE
Size 121KB
SHA256 405b8bd647fa703e233b8b609a18999abe465a8458168f1daf23197bd2ea36aa
MD5 cbd96ba6abe7564cb5980502eec0b5f6
SHA1 74e1fe1429cec3e91f55364e5cb8385a64bb0006
SHA512 a551001853f6b93dfbc6cf6a681820af31330a19d5411076ff3dbce90937b3d92173085a15f29ebf56f2ef12a4e86860ac6723ebc89c98ea31ea7a6c7e3d7cdc
SSDEEP 3072:sr85CqPo10JOSdhuPlur1Vg9uCRFRzsxeZ:k9qg1MOc4iVmRFJs0Z
TLSH
T114C37C22F9E0C032D4A219B88DACD261593E7A721B3589C337A41BDDDDB03C1AE79357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe
Size 325KB
SHA256 5e2e22ead49ce9cc11141dbeebbe5b93a530c966695d8efc2083f00e6be53423
MD5 9a8d683f9f884ddd9160a5912ca06995
SHA1 98dc8682a0c44727ee039298665f5d95b057c854
SHA512 6aecf8c5cb5796d6879f8643e20c653f58bad70820896b0019c39623604d5b3c8a4420562ab051c6685edce60aa068d9c2dbb4413a7b16c6d01a9ac10dc22c12
SSDEEP 6144:k9/jbN5zFEjGkqkAJHyEzYV/PvyeWPZw22b:GjzzFEoS2cPvyeiZwbb
TLSH
T19D649EA5B3901CF4EC63453ECC258916D6B27C2A0B70C65F13A8366A5F733911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe
Size 325KB
SHA256 e2262c798729169f697e6c30e5211cde604fd8b14769311ff4ea81abba8c2781
MD5 892cf4fc5398e07bf652c50ef2aa3b88
SHA1 c399e55756b23938057a0ecae597bd9dbe481866
SHA512 f16a9e4b1150098c5936ec6107c36d47246dafd5a43e9f4ad9a31ecab69cc789c768691fa23a1440fae7f6e93e8e62566b5c86f7ed6bb4cfe26368149ea8c167
SSDEEP 6144:k9/eWYoTOLHIsPPzAdnz0YutYPDvh2AHdwSc:GeWYoaLHF3z0z04PDvh2Cd9c
TLSH
T15A649EA5B3901CF4EC67853ECC258916D6B27C2A0B70C65F13B8366A5F333911D2DB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe
Size 505KB
SHA256 da73b6e071788372702104b9c72b6697e84e7c75e248e964996700b77c6b6f1c
MD5 452c3ce70edba3c6e358fad9fb47eb4c
SHA1 d24ea3b642f385a666159ef4c39714bec2b08636
SHA512 fe8a0b9b1386d6931dc7b646d0dd99c3d1b44bd40698b33077e7eeba877b53e5cb39ff2aa0f6919ccab62953a674577bc1b2516d9cadc0c051009b2083a08085
SSDEEP 6144:k9/4aKTRnXtTkCgwCzUg/HpjN4IBwu7QTLbpqmHdIvWTiYB2n5:GHWRdTfgwCHKy7GLbbdIvWTi4e5
TLSH
T178B43990F3E414F4F0B79A3589764511DAB67C6A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DISABL~1.EXE

Path C:\PROGRA~2\Google\Update\DISABL~1.EXE
Size 5.7MB
SHA256 3acf99624820fd862ac30780021108f0ff2df60db3df351cd17400404f279d3c
MD5 e63e539e0f0393fdea9da0d6ee80ac45
SHA1 027c8609ca7bb42b61256abb3269e1babce0141b
SHA512 f4d0458b8bfe5a66254cb85b8ba3859c9d6a937e6d14f8e15b95b7e131aaeff8a1be39f0eee3939e305901797d98dd2c5aac1837873a49f786cfcac0c9b1e6d6
SSDEEP 98304:Fog5HQ+hDHQTW6Af4fF7KkOuYO6IgF+IAMk/JexMXP8iuHG9XXYXQz7w7:Fog1P9fIlOuz6IgF+I3m2MXP6HG8QzU
TLSH
T133567C23A4E08034E5F732756D2CA73959327BA29F3145CB86946C946FB83D3293936F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IE_TO_~1.EXE

Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\BHO\IE_TO_~1.EXE
Size 557KB
SHA256 6bb357968887ad126579fb157f455e359ea036a4960a9f98f5cec1fe53931c98
MD5 2b03f86c9209825849c716434fb730bf
SHA1 1148f00cf40b0872e08f47b38bbd0c9858802aa3
SHA512 8d9b5be64e9843ec8d05af21a951e8a7501fc8fb1fc4179959ec60ea150810c0db83b7e8cedb32c44b58a0f81d09c13c4d9d8b0536711978accf47709382e71a
SSDEEP 6144:k9gGr2dzO3/lSs3AaNCaBVSa+FvChdrNSuhwK5i43FvGvu6SiZ9aD:ZGr2d29S4AaQtMhdrNSuvt+WDin2
TLSH
T1C7C49D41B3E846F9E06AC534CA438642EA7278560F34E6DF02E492792F37BE55F3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

COOKIE~1.EXE

Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\COOKIE~1.EXE
Size 161KB
SHA256 5fee43e3295682e179d6e10c568aeb640bbbcf0d6b962fd27f5b372a45fc272d
MD5 b67dba91dd68c0c9c7c78899faf33033
SHA1 4374c00761ec34d6416096524eedf439636baa94
SHA512 7065a8c6552d7dff816e288056cc2bb371bbe078798df471369382a6620c0702020102f1c39485e0c57b65279a6f0484385944f7874575d8b4351c9fa03fd8f6
SSDEEP 3072:sr85CRJjEt/g/ptvjGL/PQQpbsZAk/kJHLRdtIJsF4FxFVN:k9RJjEt/gHGrtRtIJD1N
TLSH
T134F38C57B3E430F9E2364A78C8118645EB37B8310B21AFEF07A446591E277C59E3DB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ELEVAT~1.EXE

Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\ELEVAT~1.EXE
Size 1.8MB
SHA256 47eb0dc0cd08f4faa389621c43d6407283e3c315012ef1078a6018c117f195b2
MD5 aeb70455f5c599fd2022ee73ff56bfc4
SHA1 7c3534c7cb80067ab5e6ace67e0ac0d0b8d0cc79
SHA512 5e11a5a9f28aa2e4f1d126f393232673043fffa84fa5280755ec6009e0226961343843cc0721e92d08b3fb7510fade31c118e56a993adffff3bdb4a251e67e13
SSDEEP 24576:MLaHtm12wFpUawX5LPM+bRGRpknL2NLb9Ld25PTOocJuJ/cIsY6Wfvy:yaNm12qpUTzM+bRDLwpZeToMJseC
TLSH
T1CD957B03F29941E9D06ED578C7469236E972BC890B34B6DF0290B2992E77EE45F3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IDENTI~1.EXE

Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\IDENTI~1.EXE
Size 1.1MB
SHA256 94c99d3284962585c15fdb061e0685287df11c872ef930263e251d8d3084d5b0
MD5 91a9df658e480362c108c71fd91d0247
SHA1 f94db13955eb70f2efecceb414225cdaa9b002ff
SHA512 9f5815533354a931a68e1fd97de45124f7faef97243352feb787e40a110a27d1277c4d37a6c09cb7d506159a0f153632578626d04fe5d48040438619be159d39
SSDEEP 24576:KYmWHHo7fvqcXFudDJdWQCkvjZQqg+lIVprST:KYzno7fvTqJdbPrCx9pGT
TLSH
T1A2359E07B6D840E8D069D5B8CB568132EAB27C520B74A6DF06D0B25A1F7BEE46F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\INSTAL~1\setup.exe
Size 6.6MB
SHA256 4ea8adca8a7f73fc71c7e45ef98f8c422a8b161ca6b6fcd912aec701bebd08a5
MD5 46e5df430f3f97f6cf88787698514165
SHA1 873621354ef29d4d267d693ffbd9e896d881f503
SHA512 4ea1798977bfa5fc039b1f8518ac1a546c63f565258e3537292f531cfe11c5cd54755fd21600b24fa59464d99904cc9926d19686cee72d898e62db7757e35bf6
SSDEEP 98304:kl8YfTaJ1+WpyeB2L4HrZtbPIieK5M0uR7F5eA:c8YfTa/8L6IiFUpIA
TLSH
T1C3665B47E2A600A8E46ED970CF3A5521DA353C8E57B493EF129476E81A32FD47B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\msedge.exe
Size 3.8MB
SHA256 6773bf49098b9fa85725651bc789ec2bcef5dd563a356043468c1f7b235defef
MD5 a943e9369c8e6b1e67dc7a91f58e691c
SHA1 7df172c9ab05dce69c198a55d5b7dc56c36323f8
SHA512 5a476bb13a93565132d5e1481295d6701e04250186086e1aab8e10d4882ad48a6f63e8f7d76a4d3dd07bd52fb7793bea2a49ea3d496f4f515ee767533166c3c4
SSDEEP 49152:CjP3KQLTi1GL6tSXAt9J4W+8Z0+0GD0AGeuVEusJ6LNzOeL0GKVIeCjIp26If2yH:0S3lSeuVlcm7fwKA8
TLSH
T135064903F29940D4D059C074CE5A8232EB627C8D47F562EF3694B6EA2A73AD47B3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\BHO\ie_to_edge_stub.exe
Size 562KB
SHA256 533d6da98378d3b1bb120b192bc5bd20bbeed6e123fe9fc6c15a4a3504932c71
MD5 dc797b816795fbca95de068b5fe4d089
SHA1 f5ed348926dd8c5b235dcac434bf3d7fba6b32fc
SHA512 e44d5b42d408ba7ad2c8c4b6f7af9f27650ab540afb68bc79f8bce4ad0b2843c67ab050b9d9568e9006756862199a90c6bf28483f889bf09257ed28af665147c
SSDEEP 6144:k9bLO76tlVr1Il5HlrJHU7kfLeeHVlK8SQBJ9LBKJwgdAmKa5rl6C:0S86nHrUA9HVlK8SQBJ9t4f15rR
TLSH
T161C48E41F3E847F8E07AC534CE528646EA7278960B61A6DF03A0527A2F376E55F3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\INSTAL~1\setup.exe
Size 7.1MB
SHA256 70c13c14a682d65fd82ec72f578e160617f8b7c164414bcce613a9b9ebd0c878
MD5 f80dd7e28ac5795b9cff0de19ea24bd3
SHA1 eb68d7d26bd4f849cefe6638bf4a3b73e3ce7a20
SHA512 af6ebd45c716d5c50395705dfa80c94c17fda338db24046051e82515b742cdc4f0503d2726278ba40a3b77e9b358f2b74704c851f28a8539dd77bee34b0e4fd4
SSDEEP 98304:V6CZetahq+WZxcpwCsJB2++fGOOxRj2vJzRN+T6frL:gCZetaEMGIG5xVqzRdDL
TLSH
T1A8766C47E3E600A8E46ED970CF2A9521DA353C8E47B492EF169476E41A32FD47B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cookie_exporter.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\cookie_exporter.exe
Size 155KB
SHA256 30d26d2f766f716cd6b21cdc15065ee4191760ef0d37de51f67dead898fb8e7c
MD5 ea213110894b1ad78e8e13686ff682c4
SHA1 49ea3bc31236ae9a32c600f7bb5cd66c49dafbdc
SHA512 77ec20210cffff94cf85ea1efb0551bc38000928b2af5f125b0597a281a3489f44d55b97dbbffba4f25e7f996a1d23d8734644f1cbd81ff3f8da42db6c9e64d9
SSDEEP 3072:sr85Co/5vndNI3Kk4+NLlzt4++++YdbeBGnRppeQBMWRywl9:k9ohvndNIaINY++++YtBnRpAFWcwl9
TLSH
T1B3F37B57B2E870F9E1324A78C8118605EB37B8711B21AFEF07A4065A1F277D19E3DB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevated_tracing_service.exe
Size 3.8MB
SHA256 c13ce5f473ff68ffdea61e8a4800008f527054f4561f2bf7853f6769d0c02dc5
MD5 b1de16babff63db612506d5dfcdd28f2
SHA1 4615a0df5812fc95be0f836b9d29a454da5bc67a
SHA512 5b3694c0a5f69d7ac74efe66a5b61f0b85cc73127a7805c0e93b8a368e0ee03eb72920d12988731cd9e43d7166e2cbe743deeeff02dc51a18301c14cfd394579
SSDEEP 49152:g6gu3VyrBme/hqvxbmhLbKqm006NPpIupEoEVu+e6NqcXToRzvUqIzYHBigdQBW:N3mMsYvRmCCENUhIUBbF
TLSH
T1A8063903F29900E8E05DD578CB568122EAB2BC854B35B2DF0750B7562E7BEE4AB3D750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevation_service.exe
Size 2.2MB
SHA256 8c53985c403e44c0c899c2d1f2a0b8afb1f17fb928ff866271de7952c9ff7c66
MD5 0db104178cbb26201b06ca53a8c18e39
SHA1 36cd76eb3cf04bd3cdf0fc3be4ec84fc52663040
SHA512 7c7871ad15851162facfb71f854f72869c833a68ed26c331d21c7900ac4fd87a5dcd9fc7ea2f494155b51d9b2f7c40a29dcd0cf06215ed7255c376106120dfe2
SSDEEP 49152:pb+632BuPkFKRrdE6oh2stBhuXjfS4LWxn9:/3q6DjBK
TLSH
T1A4B56B03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge.exe
Size 4.0MB
SHA256 18f4157c2dabb39cf84662e17c471f69f679840a70be3a4685e0c4ed8ccc207a
MD5 48d1aea6577f190f1e31b4ce9c2c3a83
SHA1 7bc44982c5a6bf7506d6f2dc4b2630caf0b263ce
SHA512 be71c8f0481b619aceb33b32a9222b0b6909fd07866f01374fc92fa08632ff01b7708166239c284bd1429a6b44f3edc351db346d877f174a369be9edb61dbbd5
SSDEEP 49152:GudQuVyBvNszCnSgVdQM3/+TjER7zExldDwUIDtaZHWRdpev2y/BaK:iijnUdYd+RaAK
TLSH
T121164903B29940D8D059C074CE5AD232EB617C8947F162EF3690B7EA2A73AD47B3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge_pwa_launcher.exe
Size 1.8MB
SHA256 2c31887681976e9691cfed32b98a9f81898beaaee9ea3f7a90fe695b84190511
MD5 650cdf4a369b08768ceaa48a2cfd7fdb
SHA1 d105394f9f806863e3d4a8611c76f291e13fe588
SHA512 4679c6a80bedb2de0d405037277b3c32cf04223e048ca90b79d3d709face5240cc8ad97d9bebd5f53617ce06b551421569a9e5434e68b4d6a5b7b8284155c1b6
SSDEEP 24576:Z5kAGu6McqpA7D9ruO3O7Q7OBLLMdus7CtW7KSdHBxmRkkkkkkklQXBysWAk:ZZGu6qG13O7Q7gLYduZrSdHBAVfk
TLSH
T142957C03F6DA80E5E05DC2B8CB768B35EA717C554F20A6DF0680BA652E77AD04B3D394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedgewebview2.exe
Size 3.4MB
SHA256 c0566225b047e50773acde8ada568ef7612809e74f2cc200504e60cf7a917c68
MD5 12403afd3d0b104f1d0f6cf034ed01f7
SHA1 08a9a2c1962f9f522c841dad14a55400a2b9e25b
SHA512 29a14f52b706b966361d9875ef3904560b41924fa959ce90985dd5e694d2ca9d0181509309bcb512563479fd5b5286cbef216e3ed5ed90cc170105f6dd13ec1c
SSDEEP 49152:DuZgk07G0auOj85q7aGScYbb6YErz7z4AkOuaRoBISCaQZCLlrrW:lo/Yhy8OnZ9
TLSH
T16CF54903A29900D8D059D074CF4A9223EBA27C8D47F566EF3690B6D52A77EE47B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_click_helper.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\notification_click_helper.exe
Size 1.6MB
SHA256 0faa9f1f62a95136d454efa51e6f8e8ff06a08d344fd26dc2216de09f6fbee4e
MD5 3b9687342c1ebc56dfa598bf9f0f8358
SHA1 794bcee37bfdcd2e8df01f9773c277629c5891b0
SHA512 addf3d1844271b0e54e8c665df1f85f521f0f14bd66bbf8fdd00eeee46315c294830d6d95e441cddbe6843b230064759e0d12e70b32690a431afdd45ee3aefbf
SSDEEP 24576:pnh1d46If99L9KA4uaiXJVB6HveuTJb9HxeQuJXlPnyF4mfHU9YawsNk:34hoNiZVB6PeuT5lxeHX04mfHIk
TLSH
T145856903F2D841E8D06DD2B8CB568122EAB27C450B34A6DF0791B65A1F7BEE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSEDGE~1.EXE

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE
Size 1.5MB
SHA256 b4bdab2b2c7731923854f254ba1494c25a11331293c0ee4939afd10ba1e2b575
MD5 8042d50db625ec28b95ecd7911222ac0
SHA1 a485755c8216c717a446bce8f2a7644328c59d1c
SHA512 8a0e4a53bb43933937d588fe6bf4754245136995d2603c4e3fcb8dd66cc8714b80255a52e75a31aac09223ed7b2f8d49594c20288aa2beeb802136f0f5f9b799
SSDEEP 24576:ryoteh6euUHmEhK7eTuNdfxINakEtv9kWG2L1oaedpEukUoygGmq/SJ:rfehjvHHKTdfxINPEt99G2Bo7EukU16
TLSH
T14C657B03F2D801E8D069D1B8C7568536E9B2BC450B24AAEF0B90B6591F7BFE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PWAHEL~1.EXE

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE
Size 1.4MB
SHA256 df233ebee614cd9117f7e467f16f4c2225aadbc59213a5695913a4a87f792d6a
MD5 67a7c8fa88aa1c40a5715ad4e0f8c4f0
SHA1 3d61b3c5b653549b835cbb5cae396e0e7b435b4e
SHA512 fbce329738386cc1670b58ea7c58d67cef047977d831af84e50cb811dd6cffdda5552156a0e1756d60fde2c67f3cd672bc4b6e12e2728eec70d4288e49f5efbb
SSDEEP 24576:WZGY26UEU3RyRPW+uSmS86IU8Gc7QGsVa4i6h27d3WlE:1Y2fF8FhmS86IUJWQn+6h27d/
TLSH
T152657C03F29940E8D059D1B8CB56853AEAB27C450B34A6EF0B90B7552F7BEE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
Size 1.4MB
SHA256 cd0adfcf43373e05fcf8836cc998cb17e3aaade9f8b190e28ce4331bd026f23c
MD5 aeb91dca670fae787b272163af7828ca
SHA1 a40927cc53e24d516f86042279684973fc85b77a
SHA512 f7a6aac88fcc029cd551cb4f336fb860d06b4f0094fea7a38a70aa8f25aa1f17300fda60a989ae89e558be15dc4e31dd74365e53ed44d3a3a41126e191297833
SSDEEP 24576:YmjDvw6qZ04SuTjPn68TQuD3g9gZLfChjyosZ9HT1zYeHNrk9NrfZ3:BDvwZ2XuTjPb33g9gZLfCdW9HTlXrk9T
TLSH
T113657B03F29900E9D059D1B8C7568536EAB2BC450B34A6EF0B90B7552E3BFE46B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1820_454392521\manifest.json
Size 78B
SHA256 c7e506687caffcf3906916ad3fc190a19212d67a2535479241096bd0d4418b03
MD5 259f068207f60fb9d4448c02c27b74ba
SHA1 99131d95cce94750a928738a99caa5c710bbc924
SHA512 fa41eac9d1ca244d06083e3d4230dd94700861155359722c1d815d0d9933dcd39c113b6f0f6ea02ff7ee1acd2fbc6ed40267d557afde16f417e80b678e8136bd
TLSH
T173A02230AC02E23320C803B002B083C383A02C02302A388C0B0320A232C823BE2F323C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1820_771690279\manifest.json
Size 165B
SHA256 880b2b81f96f7ec0799e2939e82955327f65a8e4edadfdd89cfebb70d8fb6f2e
MD5 3ef32f0bc4059ed77b8df1ddc1bd32d6
SHA1 180f08a503c8145e50e715a1dbe202b491de0011
SHA512 036d08f722ca62b9f5a21d79d9d6d0585f7255ff736ce717f72aff31ef0e194adb3481da6c690be7306818947efcdf1e6745d0d14de0c32bd088a5f93415805b
TLSH
T1EEC080029400197419CE47150D5CF388A722D7152D80B0165BD7C218DC3DC8B68F3B4D
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1820_789562871\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

359fcfb4-9673-4139-b3d5-1e186b9c0097.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\359fcfb4-9673-4139-b3d5-1e186b9c0097.tmp
Size 25KB
SHA256 9de9a0d78dd4442d699e1886ec51d339a94b8a88374d77c0d90ea934194457b5
MD5 8f8913e12d09c2e4b31ffd6b298287f6
SHA1 9fb283265c4db23e7e8829bdb4e5ba524bd41c7f
SHA512 3949c1c8556de49d9d21adf28ddbf01055c812cdbade948a5f81f9757a4e80f85bbf3820aef18b4c43f162a7b4e677fc525c564b84482a4615e485c0306e0afe
SSDEEP 384:npdiF9CcmyWCs3sNC8TUNTUlIm2QckCr9lpKphifGGb/4w9VobFpdEe4KV8p0TH1:pUFccps3PwgbkUjkFGb/X2beI8p0j1
TLSH
T12DB26C36EC58CEFBEDE74F89B74A3A07DEE01227859C59E4DAD85D0D009719C170B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 bde5708228c067f6e3b2df63881732e822cb0a4c4923f905776bce250fb5d2ac
MD5 cdce45083722e834964c5cb22ad59106
SHA1 d8b670fd1fe07ad5964ac6985e9390d4ba447cef
SHA512 add29cb721fed990f6392b8011f43b96762c657a31434eaf340636304386a1a536e5d11beb823696f0cd6637d25926fc5a531cecdac1c28453156cffd25537df
TLSH
T11AE02BA5C821EC2708FE0B58E0594797E71113272640994F3A3C820CCFB062A85CA85C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 1c3ebe45eae9f649bdbc953c4fe8a08e9404900acf6abbfbbc0a190d4e90115f
MD5 58403ca277a149334c5e1f778738b633
SHA1 02254ddb7d7b66c38e214e2de6ddfec6544c7f97
SHA512 109894f05c21a99ecf9b452da769644a82104484245baf6f67d1f32daa43e668ab41cdf7f08f978566b8cf18d18e057365b7bb21e327bdfc251a490bf8e1ff67
SSDEEP 48:mPaM59sAy4E/54/kjrIr6rlRp0/kIvrRrvEV6tQMgU3bf6hqiWEiMuUMbJiO3lfP:mPaM5qAs/5vor6OAVrMHmh9WNfbUIlfP
TLSH
T146A189B497A82401DFDD0EF847923EA4F337A6F9FC8B0E020BC4536566326BE8E51485
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58d2eb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d2eb.TMP
Size 2KB
SHA256 2d445033ec6ac8627b9fbec6fd90b6b2f9048533d3c3bb68b1f167daa659b6b7
MD5 ea7f9e939229217530e973a8f9b39f5b
SHA1 a84d5bf10944c39d1baf1f4a43bde5c8f3abed7c
SHA512 a7f7f423d378322474f63091ba889090b92d04c0dbb44140748d49da27ea5fff4f8143efb110613b44953cb49f3443c87e39621b8fa81a8acf9471a42c57aa98
TLSH
T140512DF995B91221EBED02FC9BD03B34B37017D8F8D31D858E8867756830B355D61A02
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 f79ef4205d706138ca2ef40d55e411f2202afebe6781290bfaf72aa962cb445c
MD5 a643bdf5a0016958c6dacbf00e180567
SHA1 4721d8c1e97de5c20bde53993b4de9e5c8504831
SHA512 5b7e32826db039fb5fd1050865fc977cde590e9d2a1c47d9836c59b24783c891c52d6726a88dbabf3d1831c7240f01ff3946dfbf161eaa286208f48099af0dd6
SSDEEP 96:D/O15YVIRaij6oJzBGOsJcsJGcjJtH0J7JajwgJkJy:DW15YVcaij6G17CcCGc9tqVaj/ay
TLSH
T14291CCF3C3E9862DD91195F0AA146F1BCF1C0451436C3D8A85E4AF5BA3F24B1E141B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 92815205680c418d64cb224b10d1f4dd108d9b67ab1cc234d9c9f92f81292744
MD5 99fa99bba3d189d86ca669eae4867044
SHA1 9a079882d1aa8c93bb2aeb01edef38d44a45121d
SHA512 4c962b86f1580b653f49a99b5e158f24df97e53ac070207cf379aa5979858a19a14b14c94e0787627d716fa8a7ec547f72531ccd97c56edc33b4d14f3ee2bc5a
SSDEEP 192:sxZ1RryMqZjK1Ml8M36/fMsJyaZdIaRuv7Cb8/odp45HW6+WNBUb/Yvcuz+uGIgP:sxZ1o/6/fMsJyazIKYXQoHbi/vp3f
TLSH
T15D721906692449BBCCD7D619FA45BBA3D6F81063D1949E48A5FCCE0C04E7BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 ce3f5ba47793743aec042f5cef89993a12d2e0e23579a9ea684fc45ddff9e460
MD5 8177bf4e9a81451333df2efb5b5f7454
SHA1 15d7a6bdd6c3b55349d03251683b1ef279d4a1f6
SHA512 4d73d84a95cb22e72e8f91f04e9fc713eb7df2c2b868898508e6f2d2b3e1c9ea6193c122b28db8bc626853d527cef218afe4283550b5d08f4bed975bd7b4e7ad
SSDEEP 192:sxZ1RryMqZjK1Ml8ME6/fMssOyaZdIaRuv7Cb8/odp45HW6+WNBUb/Yvcuz+uGIE:sxZ1oc6/fMssOyazIKYXQoHbi/vpjf
TLSH
T1D7720806692459BBCCD7D619FA45BBA3D6F81063D1948E48A5FCCE0C04E7BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 c2075aa22b5e6c99eecb64dba9fe371e77c8c36b1e09e6a06cfa28837450a005
MD5 e68af8841f7bf69989f20fe2c9c50319
SHA1 8d92aa6dd20c2a4e0178dcc8277dccbb9f81aa1f
SHA512 bd7beabc29a7ff5f97fc21804668923ec74a7ace68a3999ffbbc872146303d59b7dda17545264dfa1afb8df788ce86aa43aa914a435feba51d4cde31f44e9c39
SSDEEP 192:sxZ1RryMqZjK1Ml8UQK36/fMsJbZdIaRuv7Cb8/odp45HW6+WNBUb/YvUzQuGIgW:sxZ1oqo6/fMsJbzIKYXQoHbi/Mpry
TLSH
T156820806692449BBCCD7D619FA45BBA3D6F8106391948E48A5FCCE0C04E7BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 aea7f395831bae51b3c7357aa921ec8d6818ec891a445026616b6b86a2edaeda
MD5 61b94009793505503736c0c4d035c89a
SHA1 8fc97839356f66425f9d90da46f511b53672163c
SHA512 58629f281e1cd179c00c6b39251675a4b2879a0d52b6723fc4db56d4fd032e04779dc6c93a572dfc870866351ff02d9529cc2c76e6a972b1cb103399c2d534c8
SSDEEP 768:ZYsv8OdF6ssi7pLuLnFhWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OV6ysy10LlM:eY8Od/HEnFhWvFvmXu1jait10Lm2Nujv
TLSH
T1BFF2FB3B6C0CCB7E4F844E9CEC2A7F8A6DE802CB5698895447FA844C02C76EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bc34455a-c0c0-4ad5-9d7c-df0e9e63825f\index-dir\the-real-index
Size 72B
SHA256 c39010be41e7d41d81e7d88867ceca3e1b43483fe8d485a2e8d1bedd6b56566b
MD5 a331ab5ff12ee598f36d94e5639be02c
SHA1 c103c96c3103e4b281458253c3020bb49dbec454
SHA512 66d3fb434dcc0dad6cf792591006b44b04dbe79fe512cf188edcfd2d19862aad5952711ce507668c70a25c40c5c6510ff07b99f263bfa38267b1e9329d1d1682
TLSH
T1F7A002A412643046D54507F1664A05B16358DE150501438BC1D4047DCCF256C4F43145
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588e22.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bc34455a-c0c0-4ad5-9d7c-df0e9e63825f\index-dir\the-real-index~RFe588e22.TMP
Size 72B
SHA256 a9d597444cddc676517d6e275f9ae4a2c300d3e08a56a7f5fab48fec91f2166e
MD5 18e0074f57433b721965ce8023b7184a
SHA1 484cab6418ddcc561f3fb0e5837d7aedd9ce2ad0
SHA512 4e511ec77180220b0f0d423e377fdb7513aae2a6fc5ddceea622621fa1bee06d7bacc1d4f6be5d23959459d6a2e45ee91f8d6bce081410f233b38eb37ed749fd
TLSH
T184A002358FA44444C1100DB0652203512784DC122413470754906A568C654D89D11045
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cdf12dee-6673-4e91-954c-23b338c514e6\index-dir\the-real-index
Size 3KB
SHA256 55a9dcf7adb9364cfef6cd40251fbc64d75fb41e911282aeaadd27bdc0fec07f
MD5 b35d6e34b04aca93f8be348629d98d51
SHA1 479ea866bc0a43604feb1330cb1406452f698ff6
SHA512 17d6a5db96f48890d351ce2c933547563d2d71b05dcc75a920dfe668400cac86d2914c5b4e9d10513747ea6908830da8e7664b6301816afe61253b38e14b8a13
TLSH
T12F51B50E8D471F1ECAAC02B224FB081033B578DE56444A9275ACB075B8CB3296D1D768
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\de7b2916-8e2d-4b46-869a-c9ad33a4fdde\index-dir\the-real-index
Size 72B
SHA256 ebf15ce32b32e3ac144d61e5231e70b904167dbd4d1e02fa9d87c3c3bb9660b9
MD5 d68320c8f04c1c06f057e23460382002
SHA1 64176498f4f99e0db2b5f923393e3d33f8d22e42
SHA512 2bc4b5c183f080d83a990dd45a94714eb6b4fdb4c31996d51326acd8cce19d348ce5ec9ec29459ffe3657621bd09a002b6117cca997eb9783cc328c0ecabb8ae
TLSH
T185A0025052A4A601D804677114CF8740729899BA0D53AA05B3D1B0A5C9D15948149956
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a10d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\de7b2916-8e2d-4b46-869a-c9ad33a4fdde\index-dir\the-real-index~RFe58a10d.TMP
Size 72B
SHA256 608338117ca03dc45ded3b4408edadf0db456a48e6e729fc9d4e5630b78c1b13
MD5 72544b8da0bb753f5bb196bff5ef1e3b
SHA1 bb13ae6dcede5769ed8b69d1412c3556be05cf35
SHA512 c97d76c3f9fe7f31a8571fde324375bf15fbe8fa2a6769b07ba90d89a83ca85ce33f3beada393539002565c69fe4f1aa947ddac3b2a886d0103947194727e860
TLSH
T158A0022402500835E4410973607142601370B898705E5B1A70EE1058CDB445CA703252
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e6392b72-b563-46a0-851d-26cde0dbbb59\index-dir\the-real-index
Size 72B
SHA256 729be986300b79b7eba4bf86c33b8e108bf3ba22adf2fafe6a11b1a651cca582
MD5 62f7ada8ae188fa05cd4754cbdc46ebb
SHA1 9ae6e3e496827e364dd5f2343af6daf9723c84e1
SHA512 0d33b8b966e2a12076970ec40523f44f149007fda0783729eecb44d7b98f1f5390bc344bed4f8b6ff9d08304f2eb3efd0ab6b30848275b61c1958fc26c89479c
TLSH
T174A0025C23815201E00312B52997DED1F711DC140A436337C1D64044CC60E454A4200E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a10d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e6392b72-b563-46a0-851d-26cde0dbbb59\index-dir\the-real-index~RFe58a10d.TMP
Size 72B
SHA256 e016ccd6c7b3018fe6910cb213aab9a5ff9401a38003a52f58f07b9d4f7d1aeb
MD5 b6faa0faa450b0e848588a4a5799c7e7
SHA1 c8afa0377edce436e30451502cca8f178a410802
SHA512 18d1a03ca3108b1b6d6d01083f6ed33aa18c2c4c35cf9c44db16419ab7fad43d7f1d427c83a57c9b4fe06c1e607be470b1d7e778f7dcceb38b6707e9cf08a1f1
TLSH
T1DFA0022003814057C01B13B126DA03457308CC106141130744A53148CCB04404D4108C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 0beb33f228eb4d44cc400b3bf0ed996f03163fa8b3b6e90eab6e50013f7471dc
MD5 ae78bfa98becaf52a271c208ed5c40fa
SHA1 91f97432a94170a2f1744d51cece76de02d5a511
SHA512 cd51813e6b88e61f5bccc3a81e2400119e9701ec3c11eb4834caa2a3ef9e84b5db6fcefcbc8fcc4f6cf70ac88a2ab2e397e55fd3abf119014328684006fa0d80
TLSH
T15EF027B77FFB1850FCEBD3D630310960004A7950D490DC1F6527B68755B1358205ACA6
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 8493620eddcd1b16524729f10bd33b5bc8a17a0e9ff005dd8fe12eb893e863af
MD5 7ebfe65a95d139250aa11c0d9c9478dd
SHA1 b1bc4720b523d365ebd9a9e506ee22d1a343bfcf
SHA512 abbcae3ea98406be80ec8b8ff5b6f58bbe6032b792de78a5c031880442de70c7da79f0667fe700e77e8b1ef5a1766c97cb86876e769fcfcde7544baffbbd220c
TLSH
T151A0029CCA5E9009E41107B061A555C877505CD905451215489C91BC8D9328951C6101
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 359c8c4be7e1124eb4ea7c6b68ce5026ffaa4e307eede50e6e4cceeb1e13aae1
MD5 5c681b380ff2b2b997cad5ec80be6f78
SHA1 31c1297910867b66e25f9c4c2c1c67bb16c649e8
SHA512 273087dd7ccc9749fa250d4ac495d328182e85a5a145d886797da41dcbc904540e3cdf4cacfb94ea58c27c076b90e4d7f41b7d6bc7dad3f2bf14fd0f210fc9fe
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGz:05ppxnY753RNBvRJJdt7p5J9fvXOy
TLSH
T14DB2575A713E0212397E2948B39696364F4235A33058E4BF7FB814A14F67E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.20\domain_actions.dll
Size 82KB
SHA256 e5c9378b540360fb4ab0b16bf40ed18bd99cf4a8a5a6923f4f240d373fb441cb
MD5 aeb538c29f46cf0e19827ce47594488b
SHA1 db32b33a5811c303b1e37e1ab956df20ba44b355
SHA512 38488a42e5c532442a65fd4edab683f1f63eea71bae3ba2f801693647f633af9d836171dc751b342dc2e0e7784266eb9a40f677c0d3c9f651e7374f1af707852
SSDEEP 1536:NocewxXknaFpdgxBf8paY3JQzQik428fKagFVbydki806yav7Sz:NZvx3bgrfrPza428fIe76yaDS
TLSH
T1F783F1C0DA6C0117EE6B4D75D17959CA6BB9D6B50BA0B3EB2372845A0E02FC5EF36700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 51e26fb90c870b55285338674a0d4ae1c96ff850f6d5e56ad9f85f16491daf57
MD5 014c3b417b43744407582932bb7e5505
SHA1 24a78c9f33ad03e63ce58b90dbc39b1e34829cff
SHA512 05469bd10ca2084b4264af049a474b77832e49e3edacc9d0af4ecaaf3354f4ed800474211b0ad6554d0b4351792ffdf763b819bfe751ea9a8272c042a8398da8
SSDEEP 384:npPiF9CcmyWCs3sN+8TUNTUlI4+QckCrETXphifGGb/4w9VokEL5LHB13LBty/7A:paFccps3jwgdk5ZFGb/X2kEHB13LJ
TLSH
T1C3B22A32E868CEB7EDEB4B89E74A3653DEF44153868C59D4D6DD1E0C009B19D134B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 809d396f5d8021ebaf837ccab89679acdadc4d610ecbc48f42b2a6563e49678e
MD5 173a54f88c7bac94d01d3be69d75116b
SHA1 dcb57c6c6f1cdc5ca9eeac553172f7720aff14fa
SHA512 213b25e7f2f6f762817826fe9709c8e7d3fbc9c0ca91b8a54e4b80bd36066c2e3aa80a667e5c0b3d9679f33dc03d2c0e9e49bc65df55e001517f54fd88355a77
SSDEEP 384:npPiFiZcIm3sN+8TUNTUlI4+QckCrvxXphifGGb/4w9VokEL5zVHB7vjufty/7Ik:paFQm3jwgdkaZFGb/X2ksHB7LucV
TLSH
T1FAC24B36DC68CAB7ADEB8B89EB4A3617DEF4415386CC9AD4D5DC5E1C009B19D030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 cf4c68d4e719693681fadcd2e62704e9e020d0cb1c098ac296fed886656c8498
MD5 20e0c2ffabe779a40bac4865bec17442
SHA1 ca506120183491c26ad31e2b5cc6aaea66c32e31
SHA512 36cb2198044b506774c7acc5b862de8212caa598818e3b3c02452bab4b02a37bf20146262f9c75d50232da9fe69bca31d49613c5b6efa706621b63547e204e50
SSDEEP 384:n+iFiZcIX3sN+8TUNTUlI4+QckCrvxXphifGGb/4w9VokEL5zVHB7vjufty/7IgR:VFQX3jwgdkaZFGb/X2ksHB7LucV
TLSH
T1D3C24A36EC68CAB7ADEB8B85EB4A3617DEF44153868C9AD4D5DC5E1C009B19D030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 ba0df5146ca752b0d5ff4210946ccef0e70e17d46c043ba9981063c42789de3d
MD5 66346c92b0356bcc9012be06bce5183e
SHA1 978ce22c087ac0d0bd7f2f44de1830991f33fa9c
SHA512 020a6c04f8b481c458e435b7bf4276f8c463bfa8293bef541201d20b51d47886565d9e8c2a1dc7bf12b4d713e9d59462061a57df3aa3571167de2d50d9c12945
SSDEEP 384:nUiFiZcIm3sN+8TUNTUlI4+QckCrvxXphifGGb/4w9VokEL5zVHB7vjufty/7IgR:vFQm3jwgdkaZFGb/X2ksHB7LucV
TLSH
T15CC24A36DC68CAB7ADEB8B89EB4A3617DEF4415386CC9AD4D5DC5E1C009B19D030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 5cdefab0d85038d2cee7cdfcbb5bf73ff3a65d43601ddba2899eb0dfa17c00ab
MD5 fcacb66371c47e9f2d3e8872ff96d74c
SHA1 4cc20f975c77502498d8892acbce5236e4ddba07
SHA512 47ee3d0509542c76d8096d4ffedea4cfb001e84c7be8b74f8dda053e10dbc12b5579a4caa1d41bddfa8bc894e73aeff11b0c821e6374a64825831e08fb97d22d
SSDEEP 384:npriF9CcmyWCs3sNK8TUNTUlIm2QckCr96SkphifGGb/4w9VokEL5vHBe4KV8p0J:pGFccps3zwgbkUNCFGb/X2kWHBI8p0j1
TLSH
T155C25C32E858CEBBECD74F99B74A3507DEE45223868C9AE4D6DC5E4C10DB19D430B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.8.3.1\keys.json
Size 8KB
SHA256 3d6c659801f1686ff3ac64bc3b24b1d0ae76ffdd5f0e9c399ba37d1354a15ab4
MD5 ee666d1b2290efa6cdbc89ea3d317333
SHA1 a8bdd2c1d7e76fef48a735a80524243cd453e0bc
SHA512 7b2b577c9a168f626a687ee158cc20fa0ad0f816fb0583abfe45f89222d1762eb4fc619e029856618479fb6096a02eb2f9934cb46334fa781cea5cbcec992ee9
SSDEEP 192:uNtGbR0m0GflPAyR9Pm4lOvMwkoR9PuGMXcy:O7mZpKjA
TLSH
T17F02B6BF14A41182CE7FC16D9F0774B78FB03C066BCA3A83925BEA49484196D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 f2dc07e3481906b4f4289d195d839a1f5fb96741e208da5db41a5eb3b380f00e
MD5 5231028f737ea8c1d5da4e44ecfc5cf0
SHA1 111087b31608e264b80be6a2b6ad807b82c39f8d
SHA512 d8e0f2fa3e888150c7e088eff14fa10bbd639451c58c716c3f520de38c49a6debd08d8be74abf43031c861507d3de50bea9052128b7fc7dd293398e55fd739d2
TLSH
T1B6414FD14C381AD2C4BC0A6EB49B38FC85E8C725F1A4707D6898E9940A3D54E748583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 aa00708795980dd39e40dcf72192ae432c9723c4b876d8aa0ee7c09d221ec36d
MD5 b86a7c58ee40356fcb8e3d4a647fb35b
SHA1 a1aff380eca039177f45bf8900772f4cdfd67b5f
SHA512 a8810fb130020ed22dc5e572a3a2567513dffc1534601ff2765cc0c70a5f04631f65a431dc87cb2dccfe29d9a39e8f6784267d29cfebb9f38552e7b41af92e79
TLSH
T174414FD14C380AD2C4BC0EBEB49739FC85E8D726B1E0347D6898E9940A7E54E709583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 706f44fc94310b8f9e8ce4f3b9bc912fd12a30245f4c80e92d7f23fc3c10f6f9
MD5 3a453591469cf31b306761d3055947d4
SHA1 54bf97722d27c01659cdca31ab2aff0623379d01
SHA512 57aaf6bc8907d19b2dd231518d6febdc433a3aa16641a9f1a42f7a1d053bc6a7675484b7d45c8ec107c70ef870a75c492549c7fc9b6efc1000f08179c070a9f1
TLSH
T198414FD04C380AE6C4BC0E7EB49739FC85E8E725F4A4347C6898E9980A6E50D349183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 74a526757f2741633566c7bbe88e53f464d6350409cedcd1fe8a43a32de3d1ff
MD5 9638b772d19e2738794e01148cacce5f
SHA1 9c1658965b741f88762157928d9f027286279548
SHA512 5253b0031ef74ed62c1ab3c58c450f3a7a9e380ee14c52e06a28352a12c34ab96efa6d3160cf55f8b1a9d7fe82eaeebc0a8856f459d73798998a698fc37d9b15
TLSH
T113414FD00C381AE2C4BC0E7EB49739FC85E8D625B5A4347C6898E9A84A6E50D749183F
MD5 SHA1 SHA512 TLSH

Submit Download

965f5093-6bae-4984-b7c8-adaa48d28136.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\965f5093-6bae-4984-b7c8-adaa48d28136.tmp
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 cf48681bacb942c156647e39596b33a2e5562f9dcb6fb20b26bc957004f8d728
MD5 ce488aeb1e6f69a014ba82495fa59e20
SHA1 e15c9c3cc4eea93669be93ecbc3f3130a2a7c203
SHA512 58be7e934ad184565fccb82dbc5260218415457e4da27864c4716979a4a47bab5c4828ad64bd0bc128ad4b2722e7b0ce250461da70130ab9e7a7161921193b1e
TLSH
T13241D698AAF91148B3B73F569BF6A9AE447FBD772E06D45D10110E4F0A32A00C861B37
MD5 SHA1 SHA512 TLSH

Submit Download

2026-08-24_5ecd2ea13886e9519056fba6502ca97e_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe

Path C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-24_5ecd2ea13886e9519056fba6502ca97e_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
Size 5.2MB
SHA256 2cdc92a346c1ae156d0d2907a6dab1fda7039f5ae0d1c4d2e5d1068909996a6a
MD5 6664fdad12d442c963c76fc477f307d5
SHA1 d35408d49a9cb11d02b59aac479a67424a3b9645
SHA512 7fe8e7ccb22aef2ace0b176229544b9df33a288a65b1c4295e7c7eabe6923588fdc8d801723d77ffc79ee8a603b76c42b3073c3cf03b0c104bd43d33e041d9a7
SSDEEP 49152:ZIaeM8+2eGLnlGYW27VJVoVZ2Dau0grBK7ROes/5Re9aLHcj3RhtlGM2ebLlltHG:+M8ztWqQ+bwjB6veY2lkHQhcciw
TLSH
T14A465C03F2EA41D8E0BAD6758B269232E976BC454B34A2DF075036191E75FE09F3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IDENTI~1.EXE

Path C:\Users\Admin\AppData\Local\Temp\3582-490\IDENTI~1.EXE
Size 1.4MB
SHA256 4cd3e95e38df0cfb094ceedc26a43312d71f71e1361b3f8498f4996fdef2c73a
MD5 e9eff67e5bcb8b27e3109516d470fc56
SHA1 56a3e9b944260a05f25eacf55ac49af1aadf55b3
SHA512 85832d93f4354a63e39428f7cd80413aa5b094fbb933f84a2f5bcbe8e971b6fe9b38aab0013860d4fc061a769e5c29ff7fb4b488446b7a7984afddc8affa624a
SSDEEP 24576:JmjDvw6qZ04SuTjPn68TQuD3g9gZLfChjyosZ9HT1zYeHNrk9NrfZB:KDvwZ2XuTjPb33g9gZLfCdW9HTlXrk9l
TLSH
T126656B03F29900E9D059D1B8C7568536EAB2BC450B34A6EF0B90B6552F3BFE46B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\3582-490\setup.exe
Size 7.0MB
SHA256 26cb956ab6e70438d9e2d82ded0db3294148ae689d2a1e29d3d1eee7b90b87e0
MD5 79739842d0875865064b6f3880b7f04b
SHA1 f2b4f9e8c53359ea6fccd3d883ea4b57d4d1ff87
SHA512 e06d24e4ce83afbde9406fa612a4955ffca1b5b486cd7777f280280bf439b6833fd3f4ca51ed3ef0792bb4ca3d83ad659ca856905d6fdd1614f5b7c9f9f3d4e1
SSDEEP 98304:r6CZetahq+WZxcpwCsJB2++fGOOxRj2vJzRN+T6frX:uCZetaEMGIG5xVqzRdDX
TLSH
T153766C47E3E600A8E46ED970CF2A9521DA353C8E47B492EF169476E41A32FD47B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.com

Path C:\Windows\svchost.com
Size 40KB
SHA256 18ac91904c0ad479259e714029e22741b98fd232bba86932f89fc9921473e604
MD5 954a9af1b5a3ab2aabfa185e778c712b
SHA1 2e56bc05a093e7d4490d9a79a1b735b030b55d7b
SHA512 67752bb46e034efe24ec3f4f700b0aacfccf4956d7d974caf09423e2cab967b871b17df6bb8e5985856b770e7e6ccba3b3f84bc06d0036e7b3e067a4b72ef425
SSDEEP 768:eyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJ:JxqjQ+P04wsmJC
TLSH
T154130A51FDADC8B1D02009BCCF1A9FF4843A3D22B92516A3A7B53DBEEC79781680C549
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2896-705-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3148-970-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4032-978-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/5620-1010-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/5620-905-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/5620-1318-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/5620-1304-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/6004-546-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/6004-1319-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/6004-873-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/6004-1315-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/6004-1282-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/6004-1009-0x0000000000400000-0x000000000041B000-memory.dmp

Download