neshta | 837574bb390dd104a50bbad2bc7c0b873404c25eb5f458d3394bcaaa9d609332

Analysis

max time kernel
148s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/08/2026, 01:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
Size 3.0MB
Sample260830-becrmsxcqc
SHA256 837574bb390dd104a50bbad2bc7c0b873404c25eb5f458d3394bcaaa9d609332
MD5 62f8418f52717b02b1460f74e5ab4608
SHA1 9c31d7f83a83a600395422a7953ed0fe2693a965
SHA512 1c3c772a6ff482f65fabc6828ef143a2526381b2ba2321ce5e7657b9ee663ff769fb74e156c9f7ef779ecd1eab791731623c416445d3e8bfd87e7a91ed6b66c6
SSDEEP 49152:z2mtF0GzyW4PBosJfkm4yCYBSBDTtskVc/Q8K8h5AuISn4ftsvj:9roEtJyCGj
TLSH
T150E57C03F29A01E8D06ED27997568222EAB1BC450B35B3EF0B6077151E7AFE95B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery neshta persistence spyware stealer

Malware Config

Signatures

Family: Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta

Detect Neshta payload 52 IoCs

resource	yara_rule
behavioral2/files/0x0007000000018872-112.dat	family_neshta
behavioral2/memory/4380-651-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/files/0x000100000001b72d-712.dat	family_neshta
behavioral2/files/0x000d00000001c483-732.dat	family_neshta
behavioral2/files/0x00020000000188e8-747.dat	family_neshta
behavioral2/files/0x0005000000018a4e-750.dat	family_neshta
behavioral2/files/0x000900000001887f-753.dat	family_neshta
behavioral2/files/0x000500000001895d-752.dat	family_neshta
behavioral2/files/0x00020000000188e3-751.dat	family_neshta
behavioral2/files/0x00020000000188fb-749.dat	family_neshta
behavioral2/files/0x0005000000018a3c-748.dat	family_neshta
behavioral2/files/0x0002000000018879-746.dat	family_neshta
behavioral2/files/0x0005000000018a3b-745.dat	family_neshta
behavioral2/files/0x0007000000018866-744.dat	family_neshta
behavioral2/files/0x0005000000018960-742.dat	family_neshta
behavioral2/files/0x00080000000188d2-741.dat	family_neshta
behavioral2/files/0x0005000000018a49-740.dat	family_neshta
behavioral2/memory/5860-739-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/files/0x0007000000018887-768.dat	family_neshta
behavioral2/files/0x0002000000019bdb-775.dat	family_neshta
behavioral2/files/0x00010000000064b6-792.dat	family_neshta
behavioral2/files/0x0001000000006549-791.dat	family_neshta
behavioral2/files/0x000100000001b80f-790.dat	family_neshta
behavioral2/files/0x000100000001b80e-789.dat	family_neshta
behavioral2/files/0x000100000001b7aa-787.dat	family_neshta
behavioral2/files/0x000100000001b7a5-786.dat	family_neshta
behavioral2/files/0x000100000001b79f-784.dat	family_neshta
behavioral2/files/0x000100000001b79d-783.dat	family_neshta
behavioral2/files/0x000100000001b7e2-782.dat	family_neshta
behavioral2/files/0x000100000001b728-781.dat	family_neshta
behavioral2/files/0x000100000001b727-780.dat	family_neshta
behavioral2/files/0x000100000001b719-779.dat	family_neshta
behavioral2/files/0x000100000001b717-778.dat	family_neshta
behavioral2/files/0x000100000001ba20-777.dat	family_neshta
behavioral2/files/0x0002000000019bda-774.dat	family_neshta
behavioral2/files/0x0002000000019bd9-773.dat	family_neshta
behavioral2/files/0x000100000001ae49-772.dat	family_neshta
behavioral2/files/0x0002000000019c2e-771.dat	family_neshta
behavioral2/files/0x0003000000018a13-770.dat	family_neshta
behavioral2/files/0x0009000000018889-769.dat	family_neshta
behavioral2/memory/4380-999-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/2668-1036-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/4380-1316-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/2668-1487-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/4380-1725-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/1556-1758-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/1188-1764-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/2668-1790-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/4380-2092-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/2668-2101-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/2668-2125-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/4380-2126-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 2668 created 4520	2668	identity_helper.exe	81
PID 1556 created 4520	1556	identity_helper.exe	81

Executes dropped EXE 10 IoCs

pid	Process
1676	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
2612	identity_helper.exe
2668	identity_helper.exe
5860	svchost.com
5824	IDENTI~1.EXE
3032	identity_helper.exe
1556	identity_helper.exe
1188	svchost.com
4900	IDENTI~1.EXE
5092	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge.exe	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	identity_helper.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	identity_helper.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	identity_helper.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\Google\GOOGLE~1\141073~1.0\DISABL~1.EXE	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MIA062~1.EXE	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MICROS~4.EXE	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedgewebview2.exe	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\notification_click_helper.exe	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	identity_helper.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\pwahelper.exe	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MICROS~1.EXE	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MID1AD~1.EXE	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\cookie_exporter.exe	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedge_pwa_launcher.exe	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MICROS~4.EXE	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	identity_helper.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedge_proxy.exe	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MI9C33~1.EXE	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MI9C33~1.EXE	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	identity_helper.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevation_service.exe	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\elevation_service.exe	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MICROS~2.EXE	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\BHO\ie_to_edge_stub.exe	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\BHO\ie_to_edge_stub.exe	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MICROS~2.EXE	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	identity_helper.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	identity_helper.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\pwahelper.exe	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\identity_helper.exe	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	identity_helper.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b33e66e0-a8aa-4590-95eb-3f92b3f9daa4\49d3f4505d36492b_1	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b33e66e0-a8aa-4590-95eb-3f92b3f9daa4\5d17327d7cd89746_0	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\optimization_guide_hint_cache_store\LOCK	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Code Cache\js\445e5e4e08f2bea3_0	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b33e66e0-a8aa-4590-95eb-3f92b3f9daa4\67f1189172319be9_1	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\ClientCertificates\LOCK	msedge.exe
File created	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b33e66e0-a8aa-4590-95eb-3f92b3f9daa4\e57e28a7d7e2b4b2_0	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b33e66e0-a8aa-4590-95eb-3f92b3f9daa4\b4f84b300748a114_1	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b33e66e0-a8aa-4590-95eb-3f92b3f9daa4\1f50025058c1d9d7_s	msedge.exe
File created	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Code Cache\js\27a6ea254b86b76e_0	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Cache\Cache_Data\f_000040	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Code Cache\js\58d4c9d9b7ce2248_s	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Cache\Cache_Data\f_00004b	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\shared_proto_db\CURRENT	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Cache\Cache_Data\f_000014	msedge.exe
File created	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b33e66e0-a8aa-4590-95eb-3f92b3f9daa4\ab012d0594baccce_0	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b33e66e0-a8aa-4590-95eb-3f92b3f9daa4\afbd0af6d9a0225b_1	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b33e66e0-a8aa-4590-95eb-3f92b3f9daa4\df9f3044c9ae2e2e_s	msedge.exe
File created	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Code Cache\js\f26c5db703bdfb90_0	msedge.exe
File created	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Site Characteristics Database\MANIFEST-000001	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Code Cache\js\c7437476848a92a4_0	msedge.exe
File created	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Code Cache\js\8db027ac9a028950_0	msedge.exe
File created	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b33e66e0-a8aa-4590-95eb-3f92b3f9daa4\f351022d2d76cf76_1	msedge.exe
File created	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b33e66e0-a8aa-4590-95eb-3f92b3f9daa4\7a8742d9aad82a83_1	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b33e66e0-a8aa-4590-95eb-3f92b3f9daa4\13e83bd1c1ab1541_1	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b33e66e0-a8aa-4590-95eb-3f92b3f9daa4\82b949dd669b9b4b_0	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b33e66e0-a8aa-4590-95eb-3f92b3f9daa4\1e39bb4a0f01f6c5_0	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001	msedge.exe
File created	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Code Cache\js\58d4c9d9b7ce2248_0	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b33e66e0-a8aa-4590-95eb-3f92b3f9daa4\ff5222d57552b6c1_0	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b33e66e0-a8aa-4590-95eb-3f92b3f9daa4\9f97c8dd99a7773d_0	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b33e66e0-a8aa-4590-95eb-3f92b3f9daa4\c30cb16cb4d7770f_s	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Top Sites	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\DawnGraphiteCache\data_3	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b33e66e0-a8aa-4590-95eb-3f92b3f9daa4\dc4038e735155772_1	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Code Cache\js\d3af2b4c3257d7bd_s	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b33e66e0-a8aa-4590-95eb-3f92b3f9daa4\82632a483a587f76_0	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Code Cache\js\dacd409c82c02e45_0	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Network\Trust Tokens	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Code Cache\js\b31ca9d93bfe7e02_0	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b33e66e0-a8aa-4590-95eb-3f92b3f9daa4\8fdcb7992c9e741c_1	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Code Cache\js\8f5b317272bf7745_0	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b33e66e0-a8aa-4590-95eb-3f92b3f9daa4\f12d9bd42964b0e9_s	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Code Cache\js\b65119aa44ca4bd7_s	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Code Cache\js\3f501a52458df37b_1	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Asset Store\assets.db\LOCK	msedge.exe
File created	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Code Cache\js\c8bd95e99d884226_0	msedge.exe
File created	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b33e66e0-a8aa-4590-95eb-3f92b3f9daa4\14fff935d55178d8_0	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Code Cache\js\f757b57671bfcf58_s	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b33e66e0-a8aa-4590-95eb-3f92b3f9daa4\2a248c946d92e8a4_1	msedge.exe
File created	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\c67e5c90-2eac-49a6-b7b9-68dd68f3df2d.tmp	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Nurturing\campaign_history-journal	msedge.exe
File created	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Code Cache\js\042423b2b064d1a2_0	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Code Cache\js\24cdb2aa82ff5dc9_1	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b33e66e0-a8aa-4590-95eb-3f92b3f9daa4\217bbc87393d2e57_s	msedge.exe
File created	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\EdgeCoupons\coupons_data.db\000003.log	msedge.exe
File created	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b33e66e0-a8aa-4590-95eb-3f92b3f9daa4\2e08a9c6ec333021_0	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b33e66e0-a8aa-4590-95eb-3f92b3f9daa4\65f701fc2d3b6d77_1	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Code Cache\js\5a4b89bb394a96b5_0	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b33e66e0-a8aa-4590-95eb-3f92b3f9daa4\2a99e21c738e2a0b_1	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b33e66e0-a8aa-4590-95eb-3f92b3f9daa4\678c1e6427496f3d_0	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Secure Preferences	msedge.exe
File created	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Code Cache\js\5cce1706364839f1_0	msedge.exe
File created	C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001	msedge.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	identity_helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	identity_helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.com

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4648	msedge.exe
5712	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134325254189093866"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings	identity_helper.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-189034102-168398478-1159367937-1000\{C73CB248-3FD3-46EC-8487-D2A66710049D}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings	identity_helper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-189034102-168398478-1159367937-1000\{6DC4CCE6-69F8-4BBB-A20E-2642E7FD2381}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
2804	msedge.exe
2804	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4680	msedge.exe
2804	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 1676	4380	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe	89
PID 1676 wrote to memory of 4680	1676	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe	90
PID 4680 wrote to memory of 5104	4680	msedge.exe	91
PID 4680 wrote to memory of 2748	4680	msedge.exe	92
PID 4680 wrote to memory of 4648	4680	msedge.exe	93
PID 4680 wrote to memory of 2748	4680	msedge.exe	92
PID 4680 wrote to memory of 2748	4680	msedge.exe	92
PID 4680 wrote to memory of 2076	4680	msedge.exe	94
PID 4680 wrote to memory of 4880	4680	msedge.exe	95
PID 4680 wrote to memory of 3524	4680	msedge.exe	96
PID 4680 wrote to memory of 2076	4680	msedge.exe	94
PID 4680 wrote to memory of 3860	4680	msedge.exe	97
PID 4680 wrote to memory of 2436	4680	msedge.exe	98
PID 4680 wrote to memory of 3668	4680	msedge.exe	99
PID 4680 wrote to memory of 4880	4680	msedge.exe	95
PID 4680 wrote to memory of 4880	4680	msedge.exe	95
PID 4680 wrote to memory of 3756	4680	msedge.exe	100
PID 4680 wrote to memory of 3524	4680	msedge.exe	96
PID 4680 wrote to memory of 3524	4680	msedge.exe	96
PID 4680 wrote to memory of 5044	4680	msedge.exe	101
PID 4680 wrote to memory of 2764	4680	msedge.exe	102
PID 4680 wrote to memory of 3860	4680	msedge.exe	97
PID 4680 wrote to memory of 3860	4680	msedge.exe	97
PID 4680 wrote to memory of 4656	4680	msedge.exe	103
PID 4680 wrote to memory of 3208	4680	msedge.exe	104
PID 4680 wrote to memory of 4724	4680	msedge.exe	105
PID 4680 wrote to memory of 5772	4680	msedge.exe	106
PID 4680 wrote to memory of 2436	4680	msedge.exe	98
PID 4680 wrote to memory of 2436	4680	msedge.exe	98
PID 4680 wrote to memory of 3668	4680	msedge.exe	99
PID 4680 wrote to memory of 3668	4680	msedge.exe	99
PID 4680 wrote to memory of 3756	4680	msedge.exe	100
PID 4680 wrote to memory of 3756	4680	msedge.exe	100
PID 4680 wrote to memory of 5044	4680	msedge.exe	101
PID 4680 wrote to memory of 5044	4680	msedge.exe	101
PID 4680 wrote to memory of 2764	4680	msedge.exe	102
PID 4680 wrote to memory of 2764	4680	msedge.exe	102
PID 4680 wrote to memory of 4656	4680	msedge.exe	103
PID 4680 wrote to memory of 4656	4680	msedge.exe	103
PID 4680 wrote to memory of 3208	4680	msedge.exe	104
PID 4680 wrote to memory of 3208	4680	msedge.exe	104
PID 4680 wrote to memory of 4724	4680	msedge.exe	105
PID 4680 wrote to memory of 4724	4680	msedge.exe	105
PID 4680 wrote to memory of 5772	4680	msedge.exe	106
PID 4680 wrote to memory of 5772	4680	msedge.exe	106
PID 4680 wrote to memory of 3324	4680	msedge.exe	107
PID 4680 wrote to memory of 3324	4680	msedge.exe	107
PID 4680 wrote to memory of 5292	4680	msedge.exe	108
PID 4680 wrote to memory of 5292	4680	msedge.exe	108
PID 4680 wrote to memory of 5992	4680	msedge.exe	109
PID 4680 wrote to memory of 4268	4680	msedge.exe	110
PID 4680 wrote to memory of 5992	4680	msedge.exe	109
PID 4680 wrote to memory of 4268	4680	msedge.exe	110
PID 4680 wrote to memory of 2668	4680	msedge.exe	112
PID 2668 wrote to memory of 5860	2668	identity_helper.exe	113
PID 5860 wrote to memory of 5824	5860	svchost.com	114
PID 4680 wrote to memory of 3424	4680	msedge.exe	116
PID 4680 wrote to memory of 3228	4680	msedge.exe	117
PID 4680 wrote to memory of 3424	4680	msedge.exe	116
PID 4680 wrote to memory of 3228	4680	msedge.exe	117
PID 1676 wrote to memory of 2804	1676	2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe	118
PID 2804 wrote to memory of 4928	2804	msedge.exe	119
PID 2804 wrote to memory of 5368	2804	msedge.exe	120
PID 2804 wrote to memory of 5712	2804	msedge.exe	121

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:4520
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\IDENTI~1.EXE" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir1676_1148450065" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2152,i,9739206404086020096,13544150354282482310,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=7444 /prefetch:14
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5860
- - C:\Users\Admin\AppData\Local\Temp\3582-490\IDENTI~1.EXE
    C:\Users\Admin\AppData\Local\Temp\3582-490\IDENTI~1.EXE --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir1676_1148450065" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2152,i,9739206404086020096,13544150354282482310,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=7444 /prefetch:14
    3⤵
    - Executes dropped EXE
    PID:5824
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\IDENTI~1.EXE" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir1676_1148450065" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2220,i,14737034212423161432,1543788952888003438,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1188
- - C:\Users\Admin\AppData\Local\Temp\3582-490\IDENTI~1.EXE
    C:\Users\Admin\AppData\Local\Temp\3582-490\IDENTI~1.EXE --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir1676_1148450065" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2220,i,14737034212423161432,1543788952888003438,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
    3⤵
    - Executes dropped EXE
    PID:4900

C:\Users\Admin\AppData\Local\Temp\2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe"
1⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless=new --user-data-dir="C:\Windows\SystemTemp\scoped_dir1676_1148450065" --microsoft-ext-app-env=PEH
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Windows\SystemTemp\scoped_dir1676_1148450065 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\scoped_dir1676_1148450065\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x26c,0x7fff44cbc188,0x7fff44cbc194,0x7fff44cbc1a0
      4⤵
      PID:5104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir1676_1148450065" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --field-trial-handle=2152,i,9739206404086020096,13544150354282482310,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:2
      4⤵
      PID:2748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir1676_1148450065" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2152,i,9739206404086020096,13544150354282482310,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:11
      4⤵
      Drops file in Windows directory
      System Time Discovery
      PID:4648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir1676_1148450065" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2152,i,9739206404086020096,13544150354282482310,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2864 /prefetch:13
      4⤵
      PID:2076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir1676_1148450065" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2152,i,9739206404086020096,13544150354282482310,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:1
      4⤵
      PID:4880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir1676_1148450065" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2152,i,9739206404086020096,13544150354282482310,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3108 /prefetch:1
      4⤵
      PID:3524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir1676_1148450065" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2152,i,9739206404086020096,13544150354282482310,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:1
      4⤵
      PID:3860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir1676_1148450065" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=2152,i,9739206404086020096,13544150354282482310,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3328 /prefetch:1
      4⤵
      PID:2436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir1676_1148450065" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2152,i,9739206404086020096,13544150354282482310,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3308 /prefetch:9
      4⤵
      PID:3668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir1676_1148450065" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=2152,i,9739206404086020096,13544150354282482310,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:9
      4⤵
      PID:3756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir1676_1148450065" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=2152,i,9739206404086020096,13544150354282482310,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
      4⤵
      PID:5044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir1676_1148450065" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=2152,i,9739206404086020096,13544150354282482310,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:9
      4⤵
      PID:2764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir1676_1148450065" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=2152,i,9739206404086020096,13544150354282482310,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:9
      4⤵
      PID:4656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir1676_1148450065" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=2152,i,9739206404086020096,13544150354282482310,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
      4⤵
      PID:3208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir1676_1148450065" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=2152,i,9739206404086020096,13544150354282482310,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:9
      4⤵
      PID:4724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir1676_1148450065" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=2152,i,9739206404086020096,13544150354282482310,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
      4⤵
      PID:5772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir1676_1148450065" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2152,i,9739206404086020096,13544150354282482310,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:14
      4⤵
      PID:3324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir1676_1148450065" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2152,i,9739206404086020096,13544150354282482310,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
      4⤵
      PID:5292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir1676_1148450065" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2152,i,9739206404086020096,13544150354282482310,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
      4⤵
      PID:5992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir1676_1148450065" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2152,i,9739206404086020096,13544150354282482310,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:14
      4⤵
      PID:4268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir1676_1148450065" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2152,i,9739206404086020096,13544150354282482310,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=7444 /prefetch:14
      4⤵
      Executes dropped EXE
      PID:2612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir1676_1148450065" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2152,i,9739206404086020096,13544150354282482310,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=7444 /prefetch:14
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir1676_1148450065" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2152,i,9739206404086020096,13544150354282482310,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:14
      4⤵
      PID:3424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir1676_1148450065" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2152,i,9739206404086020096,13544150354282482310,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:14
      4⤵
      PID:3228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless=new --user-data-dir="C:\Windows\SystemTemp\scoped_dir1676_1148450065" --microsoft-ext-app-env=PEH
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Windows\SystemTemp\scoped_dir1676_1148450065 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\scoped_dir1676_1148450065\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x288,0x7fff44cbc188,0x7fff44cbc194,0x7fff44cbc1a0
      4⤵
      PID:4928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir1676_1148450065" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --field-trial-handle=2220,i,14737034212423161432,1543788952888003438,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
      4⤵
      PID:5368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir1676_1148450065" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2220,i,14737034212423161432,1543788952888003438,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:11
      4⤵
      Drops file in Windows directory
      System Time Discovery
      PID:5712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir1676_1148450065" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2220,i,14737034212423161432,1543788952888003438,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:13
      4⤵
      PID:1492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir1676_1148450065" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2220,i,14737034212423161432,1543788952888003438,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
      4⤵
      PID:3016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir1676_1148450065" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2220,i,14737034212423161432,1543788952888003438,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
      4⤵
      PID:696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir1676_1148450065" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2220,i,14737034212423161432,1543788952888003438,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:14
      4⤵
      PID:5680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir1676_1148450065" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2220,i,14737034212423161432,1543788952888003438,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:14
      4⤵
      PID:3048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir1676_1148450065" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2220,i,14737034212423161432,1543788952888003438,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:14
      4⤵
      PID:852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir1676_1148450065" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2220,i,14737034212423161432,1543788952888003438,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
      4⤵
      PID:4436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir1676_1148450065" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2220,i,14737034212423161432,1543788952888003438,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
      4⤵
      Executes dropped EXE
      PID:3032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir1676_1148450065" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2220,i,14737034212423161432,1543788952888003438,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:1556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir1676_1148450065" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2220,i,14737034212423161432,1543788952888003438,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
      4⤵
      PID:5620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir1676_1148450065" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2220,i,14737034212423161432,1543788952888003438,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
      4⤵
      PID:1284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir1676_1148450065" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2220,i,14737034212423161432,1543788952888003438,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
      4⤵
      PID:3668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir1676_1148450065" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2220,i,14737034212423161432,1543788952888003438,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
      4⤵
      PID:6028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir1676_1148450065" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2220,i,14737034212423161432,1543788952888003438,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:14
      4⤵
      PID:5820

C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
1⤵
- Executes dropped EXE
PID:5092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ACROBR~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE
Size 328KB
SHA256 888a1dd0033e5d758a4e731e3e55357de866e80d03b1b194375f714e1fd4351d
MD5 39c8a4c2c3984b64b701b85cb724533b
SHA1 c911f4c4070dfe9a35d9adcb7de6e6fb1482ce00
SHA512 f42ca2962fe60cff1a13dea8b81ff0647b317c785ee4f5159c38487c34d33aecba8478757047d31ab2ee893fbdcb91a21655353456ba6a018fc71b2278db4db2
SSDEEP 6144:k9x6edjvw6L6jAVnhH1Am2ZBU4M528hW8Bi7Q5VYN9:Y6exwI1oB8RZ4Q5VYH
TLSH
T1DC645B017F908EB6F5A2807F5D7A631D5A6ABA221B10E2C373703B5DCD321C59A3E356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ACROTE~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
Size 86KB
SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
MD5 3b73078a714bf61d1c19ebc3afc0e454
SHA1 9abeabd74613a2f533e2244c9ee6f967188e4e7e
SHA512 75959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4
SSDEEP 1536:JxqjQ+P04wsmJCNgh/sE/EkHd0Ci2zkQASqk+H6L2C:sr85CysEM6GC+QA8+HlC
TLSH
T17493AE13FAF18872D1621BF89C29E359C93F7A306E3056A7A3E40D5D5D747C26C2924B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ADOBEC~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE
Size 5.7MB
SHA256 1b5c715d71384f043843ea1785a6873a9f39d2daae112ccdeffcd88b10a3a403
MD5 09acdc5bbec5a47e8ae47f4a348541e2
SHA1 658f64967b2a9372c1c0bdd59c6fb2a18301d891
SHA512 3867bf98e1a0e253114a98b78b047b0d8282b5abf4aaf836f31cc0e26224e2a1b802c65df9d90dc7696a6dbcb9a8e4b900f1d1299e1b11e36f095ebaf8a2e5b8
SSDEEP 49152:DmlI9H9rY654KYroYJqkhWFUBlNwnFq3kXRsPI6BRY20YZAliDgFL2YmXZjU2P38:oiH9MfT3NwMkKhBRr0yAk6qkKvq
TLSH
T1F3567C22B902C139E15102B159ECBFE9C49D99348FB105DFBAC41F6E9A613E33931E67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ADelRCP.exe

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe
Size 175KB
SHA256 3f00404dd591c2856e6f71bd78423ed47199902e0b85f228e6c4de72c59ddffe
MD5 576410de51e63c3b5442540c8fdacbee
SHA1 8de673b679e0fee6e460cbf4f21ab728e41e0973
SHA512 f7761f3878775b30cc3d756fa122e74548dfc0a27e38fa4109e34a59a009df333d074bf14a227549ae347605f271be47984c55148685faac479aeb481f7191db
SSDEEP 3072:sr85CnHb5CZCq5DACsVlNl7HIJ1PcJ7LxnkdA53Pa4sjSTX4:k9n4N5QVrZZ7Lxkmsjj
TLSH
T119045C22BBC09075E69317723EFC79E44BF6BC319AA410ABF318495B197E350963931B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RdrCEF.exe

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe
Size 9.4MB
SHA256 31da9632f5d25806b77b617d48da52a14afc574bbe1653120f97705284ea566c
MD5 322302633e36360a24252f6291cdfc91
SHA1 238ed62353776c646957efefc0174c545c2afa3d
SHA512 5a1f7c44ce7f5036bffc18ebac39e2bf70e6f35fa252617d665b26448f4c4473adfa115467b7e2d9b7068823e448f74410cdcdfef1ac1c09021e051921787373
SSDEEP 98304:FrbT5JhEP+SuC0qyLfPeLDo/uLGM7gbl91hxkPZTA:lXnfW/JLGMcblLheTA
TLSH
T186A6AF1D7BE21036CD732176AF4FA104E739D007A215C6977ADC83981FB1AA152B6FE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcroRd32.exe

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
Size 2.4MB
SHA256 8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6
MD5 8ffc3bdf4a1903d9e28b99d1643fc9c7
SHA1 919ba8594db0ae245a8abd80f9f3698826fc6fe5
SHA512 0b94ead97374d74eaee87e7614ddd3911d2cf66d4c49abbfd06b02c03e5dd56fd00993b4947e8a4bcd9d891fa39cab18cc6b61efc7d0812e91eb3aea9cd1a427
SSDEEP 49152:oTfiUEWo6zuEz439z99akTBc4O8b8ITDnlT4NvJX:oTfiG/nzU90T
TLSH
T179C59226A2C8C0EBE5642170CC59BBF900546D78DBA2CDD7BD447E16BA307D29533A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WCCHRO~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE
Size 183KB
SHA256 ecd5e94da88c653e4c34b6ab325e0aca8824247b290336f75c410caa16381bc5
MD5 9dfcdd1ab508b26917bb2461488d8605
SHA1 4ba6342bcf4942ade05fb12db83da89dc8c56a21
SHA512 1afc1b95f160333f1ff2fa14b3f22a28ae33850699c6b5498915a8b6bec1cfc40f33cb69583240aa9206bc2ea7ab14e05e071275b836502a92aa8c529fc1b137
SSDEEP 3072:sr85Cl8pIsfHwCbf9MFdRvyAgnz8n/dfQ7PjFKq23T/h:k9KbfHwCbyFdAafCPc53T/h
TLSH
T177046B51F7C7C9B2E09206704C2AAF6541B9FE381F7105EBF3E87A1E5A713C2182566B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eula.exe

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe
Size 131KB
SHA256 5c3ef3ec7594c040146e908014791dd15201ba58b4d70032770bb661b6a0e394
MD5 5791075058b526842f4601c46abd59f5
SHA1 b2748f7542e2eebcd0353c3720d92bbffad8678f
SHA512 83e303971ed64019fde9e4ba6f6e889f8fb105088490dfa7dcf579a12baff20ef491f563d132d60c7b24a4fd3cac29bd9dc974571cd162000fae8fba4e0e54fb
SSDEEP 3072:sr85Ciq9YnyoRmLisiselSsONt3F7oQGO7M1bp:k9kgLHvld2
TLSH
T19CD37C13BBE0C872D66207785D25F36696AFF6305E74CB677B880B0E9DB46824D0C64A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FULLTR~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE
Size 254KB
SHA256 16d65f2463658a72dba205dcaa18bc3d0bab4453e726233d68bc176e69db0950
MD5 4ddc609ae13a777493f3eeda70a81d40
SHA1 8957c390f9b2c136d37190e32bccae3ae671c80a
SHA512 9d7f90d1529cab20078c2690bf7bffab5a451a41d8993781effe807e619da0e7292f991da2f0c5c131b111d028b3e6084e5648c90816e74dfb664e7f78181bc5
SSDEEP 3072:sr85CYl4dsOc6v2vTzwU+Pho86meq+FaSoB2+vSHr8qcVz5fzsC:k9r3PiY+Fa7BdvG1cT7
TLSH
T128446B307B86C53BE66301718CF8EBBF942EBA150F6851D7B3984B5E5EA05D32E31846
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOGTRA~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE
Size 386KB
SHA256 473eb551101caeaf2d18f811342e21de323c8dd19ed21011997716871defe997
MD5 8c753d6448183dea5269445738486e01
SHA1 ebbbdc0022ca7487cd6294714cd3fbcb70923af9
SHA512 4f6fddefc42455540448eac0b693a4847e21b68467486376a4186776bfe137337733d3075b7b87ed7dac532478dc9afc63883607ec8205df3f155fee64c7a9be
SSDEEP 6144:k9W3n0dK2NP0RHx8D98WTBPW8fF8oABm1nKZ0RsrI:WKhHSDeWTRW8fdebmqI
TLSH
T16A84AE11FB86C172D96602728DAAA35CC4BDB5714F314BD3E3DC6F0D9E601D2A932B86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

READER~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE
Size 92KB
SHA256 2f947e3ca624ce7373080b4a3934e21644fb070a53feeaae442b15b849c2954f
MD5 176436d406fd1aabebae353963b3ebcf
SHA1 9ffdfdb8cc832a0c6501c4c0e85b23a0f7eff57a
SHA512 a2d1a714e0c1e5463260c64048ba8fd5064cfa06d4a43d02fc04a30748102ff5ba86d20a08e611e200dc778e2b7b3ae808da48132a05a61aa09ac424a182a06a
SSDEEP 1536:JxqjQ+P04wsmJC66w8MghW4wNlu9HQIXsW/44:sr85C66w8oFlKwW//
TLSH
T1E1936C13BB928E33D4204AB91C6997B8D4BEF5306F1556E367650A4E8DBC3C22C3925F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WOW_HE~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE
Size 147KB
SHA256 750824b5f75c91a6c2eeb8c5e60ae28d7a81e323d3762c8652255bfea5cba0bb
MD5 3b35b268659965ab93b6ee42f8193395
SHA1 8faefc346e99c9b2488f2414234c9e4740b96d88
SHA512 035259a7598584ddb770db3da4e066b64dc65638501cdd8ff9f8e2646f23b76e3dfffa1fb5ed57c9bd15bb4efa3f7dd33fdc2e769e5cc195c25de0e340eb89ab
SSDEEP 3072:sr85Ce6l8TRpR+EMucyaGoS43IIJNdS3UA:k9e6l8aGo/3VL4kA
TLSH
T15EE38C57B7E134F8E1768A78CC615608EB32B8352A319BAF03A4065A5F273C05E3DF25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arh.exe

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe
Size 125KB
SHA256 fe44ca8d5050932851aa54c23133277e66db939501af58e5aeb7b67ec1dde7b5
MD5 cce8964848413b49f18a44da9cb0a79b
SHA1 0b7452100d400acebb1c1887542f322a92cbd7ae
SHA512 bf8fc270229d46a083ced30da6637f3ca510b0ce44624a9b21ec6aacac81666dffd41855053a936aa9e8ea6e745a09b820b506ec7bf1173b6f1837828a35103d
SSDEEP 1536:JxqjQ+P04wsmJCWM2D57Kykf8d/R8Tyr5J5is7MDjrXDyO4zkm8dbHVLokF8iJTp:sr85CCQw/STyr5Jks7MvrMzkm8PL3Eo
TLSH
T127C3AE22F6A1C432D4920D788919C3B18E3F7D3169A99957F7E80B5E9E607C0EA1D31F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32BITM~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE
Size 142KB
SHA256 3e9da97a7106122245e77f13f3f3cc96c055d732ab841eb848d03ac25401c1bc
MD5 92dc0a5b61c98ac6ca3c9e09711e0a5d
SHA1 f809f50cfdfbc469561bced921d0bad343a0d7b4
SHA512 d9eefb19f82e0786d9be0dbe5e339d25473fb3a09682f40c6d190d4c320cca5556abb72b5d97c6b0da4f8faefdc6d39ac9d0415fdf94ebcc90ecdf2e513c6a31
SSDEEP 1536:JxqjQ+P04wsmJC9S7UmwuBLAefbVH8x+FOI31EmkIY2d5J6WUghEuireklhKsikg:sr85Cs7HN9fN8sFOE1Z5Y2966ilU9xL
TLSH
T1F2E38D21F5C188B2E67205B54D2AA79E942CF6340F3194E3B3E84F2D9D342C39F765A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

64BITM~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE
Size 278KB
SHA256 22a585c183e27b3c732028ff193733c2f9d03700a0e95e65c556b0592c43d880
MD5 12c29dd57aa69f45ddd2e47620e0a8d9
SHA1 ba297aa3fe237ca916257bc46370b360a2db2223
SHA512 255176cd1a88dfa2af3838769cc20dc7ad9d969344801f07b9ebb372c12cee3f47f2dba3559f391deab10650875cad245d9724acfa23a42b336bfa96559a5488
SSDEEP 6144:k9P1UKupTu8ffMb0/GxsZfcJtqQ1UBZ6g:jK+HMYcytZh
TLSH
T105546C1A77D84CF5E467C23DCD528642E2B278551B34D7CB6760022AAF637E0AE3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ADOBEA~1.EXE

Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE
Size 454KB
SHA256 bb07d817b8b1b6b4c25e62b6120e51dec10118557d7b6b696ad084a5ba5bfdeb
MD5 bcd0f32f28d3c2ba8f53d1052d05252d
SHA1 c29b4591df930dabc1a4bd0fa2c0ad91500eafb2
SHA512 79f407735853f82f46870c52058ceee4d91857a89db14868ee1169abd5c0fd2e3fa1ed230ab90b5f479a9581b88998643d69b0df498defea29e73b0d487f3b10
SSDEEP 6144:k9sQsSVWSLjX2PxPNMRyfn7LzPdKblt0K+HAfh0v8axsbQuXYvr6yIll6Jf:+VWnxlMSn7nFKbltn+Ch/m6Xl6l
TLSH
T1E1A47C1077D0C036F1B329768A7FE728546DB9715F6881CFE3881A6E4E706E0AA3571B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.exe

Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe
Size 1.2MB
SHA256 b1ec065f71cc40f400e006586d370997102860504fd643b235e8ed9f5607262a
MD5 d47ed8961782d9e27f359447fa86c266
SHA1 d37d3f962c8d302b18ec468b4abe94f792f72a3b
SHA512 3e33f2cdf35024868b183449019de9278035e7966b342ba320a6c601b5629792cbb98a19850d4ca80b906c85d10e8503b0193794d1f1efa849fa33d26cff0669
SSDEEP 12288:M0ZRHkXVfeeO4LMneqyQsWSjGQCfLBlS7guN1AnQ6i12NI+03Sgouvb:M0ZRHkFfenxyQZXS7gZnQh2NIDSgouvb
TLSH
T19D45E50267F94129F1F37B71EEB993645A77BC61AE39C50E5284025E0DB4A90EE31B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaureg.exe

Path C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe
Size 555KB
SHA256 c5a99f42100834599e4995d0a178b32b772a6e774a4050a6bb00438af0a6a1f3
MD5 ce82862ca68d666d7aa47acc514c3e3d
SHA1 f458c7f43372dbcdac8257b1639e0fe51f592e28
SHA512 bca7afd6589c3215c92fdaca552ad3380f53d3db8c4b69329a1fa81528dd952a14bf012321de92ad1d20e5c1888eab3dd512b1ac80a406baccc37ee6ff4a90dc
SSDEEP 12288:PKv89GDYikjjqggz7/PtFxRNWBYrpkQJ7u:PKqjjg/PzNWyr9J7u
TLSH
T1A5C4BF2079A0C032D17311344D6AE794A63EF6700E7249E777D46FBD7E346C1EB28AA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOIN~1.EXE

Path C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE
Size 121KB
SHA256 405b8bd647fa703e233b8b609a18999abe465a8458168f1daf23197bd2ea36aa
MD5 cbd96ba6abe7564cb5980502eec0b5f6
SHA1 74e1fe1429cec3e91f55364e5cb8385a64bb0006
SHA512 a551001853f6b93dfbc6cf6a681820af31330a19d5411076ff3dbce90937b3d92173085a15f29ebf56f2ef12a4e86860ac6723ebc89c98ea31ea7a6c7e3d7cdc
SSDEEP 3072:sr85CqPo10JOSdhuPlur1Vg9uCRFRzsxeZ:k9qg1MOc4iVmRFJs0Z
TLSH
T114C37C22F9E0C032D4A219B88DACD261593E7A721B3589C337A41BDDDDB03C1AE79357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe
Size 325KB
SHA256 5e2e22ead49ce9cc11141dbeebbe5b93a530c966695d8efc2083f00e6be53423
MD5 9a8d683f9f884ddd9160a5912ca06995
SHA1 98dc8682a0c44727ee039298665f5d95b057c854
SHA512 6aecf8c5cb5796d6879f8643e20c653f58bad70820896b0019c39623604d5b3c8a4420562ab051c6685edce60aa068d9c2dbb4413a7b16c6d01a9ac10dc22c12
SSDEEP 6144:k9/jbN5zFEjGkqkAJHyEzYV/PvyeWPZw22b:GjzzFEoS2cPvyeiZwbb
TLSH
T19D649EA5B3901CF4EC63453ECC258916D6B27C2A0B70C65F13A8366A5F733911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe
Size 325KB
SHA256 e2262c798729169f697e6c30e5211cde604fd8b14769311ff4ea81abba8c2781
MD5 892cf4fc5398e07bf652c50ef2aa3b88
SHA1 c399e55756b23938057a0ecae597bd9dbe481866
SHA512 f16a9e4b1150098c5936ec6107c36d47246dafd5a43e9f4ad9a31ecab69cc789c768691fa23a1440fae7f6e93e8e62566b5c86f7ed6bb4cfe26368149ea8c167
SSDEEP 6144:k9/eWYoTOLHIsPPzAdnz0YutYPDvh2AHdwSc:GeWYoaLHF3z0z04PDvh2Cd9c
TLSH
T15A649EA5B3901CF4EC67853ECC258916D6B27C2A0B70C65F13B8366A5F333911D2DB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe
Size 505KB
SHA256 da73b6e071788372702104b9c72b6697e84e7c75e248e964996700b77c6b6f1c
MD5 452c3ce70edba3c6e358fad9fb47eb4c
SHA1 d24ea3b642f385a666159ef4c39714bec2b08636
SHA512 fe8a0b9b1386d6931dc7b646d0dd99c3d1b44bd40698b33077e7eeba877b53e5cb39ff2aa0f6919ccab62953a674577bc1b2516d9cadc0c051009b2083a08085
SSDEEP 6144:k9/4aKTRnXtTkCgwCzUg/HpjN4IBwu7QTLbpqmHdIvWTiYB2n5:GHWRdTfgwCHKy7GLbbdIvWTi4e5
TLSH
T178B43990F3E414F4F0B79A3589764511DAB67C6A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DISABL~1.EXE

Path C:\PROGRA~2\Google\Update\DISABL~1.EXE
Size 5.7MB
SHA256 3acf99624820fd862ac30780021108f0ff2df60db3df351cd17400404f279d3c
MD5 e63e539e0f0393fdea9da0d6ee80ac45
SHA1 027c8609ca7bb42b61256abb3269e1babce0141b
SHA512 f4d0458b8bfe5a66254cb85b8ba3859c9d6a937e6d14f8e15b95b7e131aaeff8a1be39f0eee3939e305901797d98dd2c5aac1837873a49f786cfcac0c9b1e6d6
SSDEEP 98304:Fog5HQ+hDHQTW6Af4fF7KkOuYO6IgF+IAMk/JexMXP8iuHG9XXYXQz7w7:Fog1P9fIlOuz6IgF+I3m2MXP6HG8QzU
TLSH
T133567C23A4E08034E5F732756D2CA73959327BA29F3145CB86946C946FB83D3293936F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\BHO\ie_to_edge_stub.exe
Size 553KB
SHA256 7b2d809ff4b2691c04855f4bb3d89b88fa4d1d65c8c35d3941a26f015947cde9
MD5 0dfe9b91beadab9c6884972da71f2dca
SHA1 97566314b3243d07713082b08b587e29921b3f4b
SHA512 9e6678f6db3a189d374ca4e1d1e207c6ff2f912012b450b7e2dc8f94800cf48d58df0618528b6c17094ff4bab0646f6bcabad8a5dc1b9b5d49ff51ddaf9ff765
SSDEEP 6144:k9d10k9mqI9PZJroJIxXY720DRaOOcno2m9XlqkuMnHvEU:C0k9mnRT0JIxQ4ObTMPj
TLSH
T12FC48C41B7E445F8E06AC5388E478242EA7278960F64E6DF02E4927D2F3B6E55F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cookie_exporter.exe

Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\cookie_exporter.exe
Size 157KB
SHA256 3ecafed639ffb272e758902d1baa0b399c044bfb744cedd6bda1ed40516ca132
MD5 8da3466d7f38b35a9ea567551b81ff05
SHA1 82867500b6ab5e2edac5e7810828024716ae505d
SHA512 3116e7c1ec65f082653deba2e66e9115cec939845af7578b54f469fa17781f4f14952b1b1c64818522c2156fa775ad5cc339aa7cb278db9a93288567a6354501
SSDEEP 3072:sr85COLYCtagaZzAconl0ZAkvThvss5XU9fCYM1cs4qEm44c:k9kYCAoloFrU9fPM1lEuc
TLSH
T130F38D97B3E124F9E1724A78C8518A14EB77B8311B309BEF03A446891E277C5DD3EB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\BHO\ie_to_edge_stub.exe
Size 562KB
SHA256 533d6da98378d3b1bb120b192bc5bd20bbeed6e123fe9fc6c15a4a3504932c71
MD5 dc797b816795fbca95de068b5fe4d089
SHA1 f5ed348926dd8c5b235dcac434bf3d7fba6b32fc
SHA512 e44d5b42d408ba7ad2c8c4b6f7af9f27650ab540afb68bc79f8bce4ad0b2843c67ab050b9d9568e9006756862199a90c6bf28483f889bf09257ed28af665147c
SSDEEP 6144:k9bLO76tlVr1Il5HlrJHU7kfLeeHVlK8SQBJ9LBKJwgdAmKa5rl6C:0S86nHrUA9HVlK8SQBJ9t4f15rR
TLSH
T161C48E41F3E847F8E07AC534CE528646EA7278960B61A6DF03A0527A2F376E55F3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\INSTAL~1\setup.exe
Size 7.1MB
SHA256 70c13c14a682d65fd82ec72f578e160617f8b7c164414bcce613a9b9ebd0c878
MD5 f80dd7e28ac5795b9cff0de19ea24bd3
SHA1 eb68d7d26bd4f849cefe6638bf4a3b73e3ce7a20
SHA512 af6ebd45c716d5c50395705dfa80c94c17fda338db24046051e82515b742cdc4f0503d2726278ba40a3b77e9b358f2b74704c851f28a8539dd77bee34b0e4fd4
SSDEEP 98304:V6CZetahq+WZxcpwCsJB2++fGOOxRj2vJzRN+T6frL:gCZetaEMGIG5xVqzRdDL
TLSH
T1A8766C47E3E600A8E46ED970CF2A9521DA353C8E47B492EF169476E41A32FD47B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cookie_exporter.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\cookie_exporter.exe
Size 155KB
SHA256 30d26d2f766f716cd6b21cdc15065ee4191760ef0d37de51f67dead898fb8e7c
MD5 ea213110894b1ad78e8e13686ff682c4
SHA1 49ea3bc31236ae9a32c600f7bb5cd66c49dafbdc
SHA512 77ec20210cffff94cf85ea1efb0551bc38000928b2af5f125b0597a281a3489f44d55b97dbbffba4f25e7f996a1d23d8734644f1cbd81ff3f8da42db6c9e64d9
SSDEEP 3072:sr85Co/5vndNI3Kk4+NLlzt4++++YdbeBGnRppeQBMWRywl9:k9ohvndNIaINY++++YtBnRpAFWcwl9
TLSH
T1B3F37B57B2E870F9E1324A78C8118605EB37B8711B21AFEF07A4065A1F277D19E3DB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevated_tracing_service.exe
Size 3.8MB
SHA256 c13ce5f473ff68ffdea61e8a4800008f527054f4561f2bf7853f6769d0c02dc5
MD5 b1de16babff63db612506d5dfcdd28f2
SHA1 4615a0df5812fc95be0f836b9d29a454da5bc67a
SHA512 5b3694c0a5f69d7ac74efe66a5b61f0b85cc73127a7805c0e93b8a368e0ee03eb72920d12988731cd9e43d7166e2cbe743deeeff02dc51a18301c14cfd394579
SSDEEP 49152:g6gu3VyrBme/hqvxbmhLbKqm006NPpIupEoEVu+e6NqcXToRzvUqIzYHBigdQBW:N3mMsYvRmCCENUhIUBbF
TLSH
T1A8063903F29900E8E05DD578CB568122EAB2BC854B35B2DF0750B7562E7BEE4AB3D750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevation_service.exe
Size 2.2MB
SHA256 8c53985c403e44c0c899c2d1f2a0b8afb1f17fb928ff866271de7952c9ff7c66
MD5 0db104178cbb26201b06ca53a8c18e39
SHA1 36cd76eb3cf04bd3cdf0fc3be4ec84fc52663040
SHA512 7c7871ad15851162facfb71f854f72869c833a68ed26c331d21c7900ac4fd87a5dcd9fc7ea2f494155b51d9b2f7c40a29dcd0cf06215ed7255c376106120dfe2
SSDEEP 49152:pb+632BuPkFKRrdE6oh2stBhuXjfS4LWxn9:/3q6DjBK
TLSH
T1A4B56B03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge.exe
Size 4.0MB
SHA256 18f4157c2dabb39cf84662e17c471f69f679840a70be3a4685e0c4ed8ccc207a
MD5 48d1aea6577f190f1e31b4ce9c2c3a83
SHA1 7bc44982c5a6bf7506d6f2dc4b2630caf0b263ce
SHA512 be71c8f0481b619aceb33b32a9222b0b6909fd07866f01374fc92fa08632ff01b7708166239c284bd1429a6b44f3edc351db346d877f174a369be9edb61dbbd5
SSDEEP 49152:GudQuVyBvNszCnSgVdQM3/+TjER7zExldDwUIDtaZHWRdpev2y/BaK:iijnUdYd+RaAK
TLSH
T121164903B29940D8D059C074CE5AD232EB617C8947F162EF3690B7EA2A73AD47B3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge_pwa_launcher.exe
Size 1.8MB
SHA256 2c31887681976e9691cfed32b98a9f81898beaaee9ea3f7a90fe695b84190511
MD5 650cdf4a369b08768ceaa48a2cfd7fdb
SHA1 d105394f9f806863e3d4a8611c76f291e13fe588
SHA512 4679c6a80bedb2de0d405037277b3c32cf04223e048ca90b79d3d709face5240cc8ad97d9bebd5f53617ce06b551421569a9e5434e68b4d6a5b7b8284155c1b6
SSDEEP 24576:Z5kAGu6McqpA7D9ruO3O7Q7OBLLMdus7CtW7KSdHBxmRkkkkkkklQXBysWAk:ZZGu6qG13O7Q7gLYduZrSdHBAVfk
TLSH
T142957C03F6DA80E5E05DC2B8CB768B35EA717C554F20A6DF0680BA652E77AD04B3D394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedgewebview2.exe
Size 3.4MB
SHA256 c0566225b047e50773acde8ada568ef7612809e74f2cc200504e60cf7a917c68
MD5 12403afd3d0b104f1d0f6cf034ed01f7
SHA1 08a9a2c1962f9f522c841dad14a55400a2b9e25b
SHA512 29a14f52b706b966361d9875ef3904560b41924fa959ce90985dd5e694d2ca9d0181509309bcb512563479fd5b5286cbef216e3ed5ed90cc170105f6dd13ec1c
SSDEEP 49152:DuZgk07G0auOj85q7aGScYbb6YErz7z4AkOuaRoBISCaQZCLlrrW:lo/Yhy8OnZ9
TLSH
T16CF54903A29900D8D059D074CF4A9223EBA27C8D47F566EF3690B6D52A77EE47B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_click_helper.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\notification_click_helper.exe
Size 1.6MB
SHA256 0faa9f1f62a95136d454efa51e6f8e8ff06a08d344fd26dc2216de09f6fbee4e
MD5 3b9687342c1ebc56dfa598bf9f0f8358
SHA1 794bcee37bfdcd2e8df01f9773c277629c5891b0
SHA512 addf3d1844271b0e54e8c665df1f85f521f0f14bd66bbf8fdd00eeee46315c294830d6d95e441cddbe6843b230064759e0d12e70b32690a431afdd45ee3aefbf
SSDEEP 24576:pnh1d46If99L9KA4uaiXJVB6HveuTJb9HxeQuJXlPnyF4mfHU9YawsNk:34hoNiZVB6PeuT5lxeHX04mfHIk
TLSH
T145856903F2D841E8D06DD2B8CB568122EAB27C450B34A6DF0791B65A1F7BEE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSEDGE~1.EXE

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE
Size 1.5MB
SHA256 b4bdab2b2c7731923854f254ba1494c25a11331293c0ee4939afd10ba1e2b575
MD5 8042d50db625ec28b95ecd7911222ac0
SHA1 a485755c8216c717a446bce8f2a7644328c59d1c
SHA512 8a0e4a53bb43933937d588fe6bf4754245136995d2603c4e3fcb8dd66cc8714b80255a52e75a31aac09223ed7b2f8d49594c20288aa2beeb802136f0f5f9b799
SSDEEP 24576:ryoteh6euUHmEhK7eTuNdfxINakEtv9kWG2L1oaedpEukUoygGmq/SJ:rfehjvHHKTdfxINPEt99G2Bo7EukU16
TLSH
T14C657B03F2D801E8D069D1B8C7568536E9B2BC450B24AAEF0B90B6591F7BFE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PWAHEL~1.EXE

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE
Size 1.4MB
SHA256 df233ebee614cd9117f7e467f16f4c2225aadbc59213a5695913a4a87f792d6a
MD5 67a7c8fa88aa1c40a5715ad4e0f8c4f0
SHA1 3d61b3c5b653549b835cbb5cae396e0e7b435b4e
SHA512 fbce329738386cc1670b58ea7c58d67cef047977d831af84e50cb811dd6cffdda5552156a0e1756d60fde2c67f3cd672bc4b6e12e2728eec70d4288e49f5efbb
SSDEEP 24576:WZGY26UEU3RyRPW+uSmS86IU8Gc7QGsVa4i6h27d3WlE:1Y2fF8FhmS86IUJWQn+6h27d/
TLSH
T152657C03F29940E8D059D1B8CB56853AEAB27C450B34A6EF0B90B7552F7BEE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
Size 1.4MB
SHA256 cd0adfcf43373e05fcf8836cc998cb17e3aaade9f8b190e28ce4331bd026f23c
MD5 aeb91dca670fae787b272163af7828ca
SHA1 a40927cc53e24d516f86042279684973fc85b77a
SHA512 f7a6aac88fcc029cd551cb4f336fb860d06b4f0094fea7a38a70aa8f25aa1f17300fda60a989ae89e558be15dc4e31dd74365e53ed44d3a3a41126e191297833
SSDEEP 24576:YmjDvw6qZ04SuTjPn68TQuD3g9gZLfChjyosZ9HT1zYeHNrk9NrfZ3:BDvwZ2XuTjPb33g9gZLfCdW9HTlXrk9T
TLSH
T113657B03F29900E9D059D1B8C7568536EAB2BC450B34A6EF0B90B7552E3BFE46B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

179611fb-7829-4a14-b413-ae4a4281f6f0.tmp

Path C:\Users\Admin\AppData\Local\Temp\179611fb-7829-4a14-b413-ae4a4281f6f0.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe

Path C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-28_62f8418f52717b02b1460f74e5ab4608_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
Size 3.0MB
SHA256 df7c4a0df410a208e3b1f8e8ed3a28c7a2ac95aec7ea4a3f3fd8880587e49032
MD5 5f17b6b6368300b92f6ddf1187252d65
SHA1 2df79eae282d16be4329e8070740f15ab240de7f
SHA512 9c6893cee22ca7aa992c66ce7db63efb9ad7d5e830f3435efb4919459f83af46eeb174f3ab6078d581547eb3ed9d8ebbdacc2c3c5908dfccd842c35441f9ea57
SSDEEP 49152:b2mtF0GzyW4PBosJfkm4yCYBSBDTtskVc/Q8K8h5AuISn4ftsvZ:FroEtJyCGZ
TLSH
T188E57B03F29A01E8D06ED27997568222EAB1BC450B35B3EF0B6077151E7AFE95B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Users\Admin\AppData\Local\Temp\3582-490\identity_helper.exe
Size 1.4MB
SHA256 4cd3e95e38df0cfb094ceedc26a43312d71f71e1361b3f8498f4996fdef2c73a
MD5 e9eff67e5bcb8b27e3109516d470fc56
SHA1 56a3e9b944260a05f25eacf55ac49af1aadf55b3
SHA512 85832d93f4354a63e39428f7cd80413aa5b094fbb933f84a2f5bcbe8e971b6fe9b38aab0013860d4fc061a769e5c29ff7fb4b488446b7a7984afddc8affa624a
SSDEEP 24576:JmjDvw6qZ04SuTjPn68TQuD3g9gZLfChjyosZ9HT1zYeHNrk9NrfZB:KDvwZ2XuTjPb33g9gZLfCdW9HTlXrk9l
TLSH
T126656B03F29900E9D059D1B8C7568536EAB2BC450B34A6EF0B90B6552F3BFE46B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8a51dec0-4e12-451c-bac8-2852d6e97374.tmp

Path C:\Users\Admin\AppData\Local\Temp\8a51dec0-4e12-451c-bac8-2852d6e97374.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bbae4cd6-d686-4a14-a25f-d427dc1dc855.tmp

Path C:\Users\Admin\AppData\Local\Temp\bbae4cd6-d686-4a14-a25f-d427dc1dc855.tmp
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2804_597693880\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LCO7OCMROX5ISO8RPLRW.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LCO7OCMROX5ISO8RPLRW.temp
Size 4KB
SHA256 942c2f84842bb5974970db42048415b76cc7e77cff0187fbcde342e5e3cba2c0
MD5 cdfd238c83a7aa54940211b3542ac7e5
SHA1 aa31d0987de23082273386e49702be270f04a38b
SHA512 1c0b59efcc91095bf896b3a4480715fa4a4720afaa7a6f0a3f8a482789ac72d49ce34f573252036bc5631b763ccab78b2564d3dea506a883e7c59d926c4124d5
SSDEEP 48:01gdOoEF+Mv4KoODJ9zf3fCdLXuH/72u78pE8gdOoEF+Mv4KoODJ9ze3fRgdLXuK:0lVJf3fquzX8u2VJe3fRIuze
TLSH
T16D91FE115FE61E16F2F39EB290727B11BB7BFD085A088E0D118A510D0C32B149AADFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Windows\SystemTemp\scoped_dir1676_1148450065\Crashpad\settings.dat
Size 280B
SHA256 0921b62f876be515250ad77d5c83b467662f0d206d655edd4d0f16efaf0fc7c5
MD5 88f57f80e5972e5a2069aa623d771348
SHA1 7cd3db37eeade5f875cb52dfd74630529cd6c690
SHA512 f13dc3eeaa86f99e6987f34d2b661e1ab1bf366e0c7aeb164f129286ef56d51d8cf4bf5dad47dce6556bc392cfc36b5d7160e5136f749daf158d05da7c1d5105
TLSH
T140D02B98BDDC21B0D0033034332363583CC6B014DF06101AD0B05393489110131AC579
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Windows\SystemTemp\scoped_dir1676_1148450065\Crashpad\settings.dat
Size 280B
SHA256 835672edda5509fce0c4dba35085c8f7adbecbbc1ee1c7a9096dfbcb54081d8e
MD5 71c15cb6e90022d40525836f4e8856f4
SHA1 a2ea57ff183dc2345f734ecab19abfa49051c017
SHA512 9f0ce2cb50c6d23096217e6872ec4f959f8ddc202e2ff96e89e8d504889a2a8f11c8b836bdb7c442a81dcd64c4346d1d7307eb4b1cfe0093bc85ebdc8b819064
TLSH
T1C6D02B9475C89260D0623838432043DA308CB50187034016C0D2018104401C333915B5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Windows\SystemTemp\scoped_dir1676_1148450065\Crashpad\settings.dat
Size 280B
SHA256 480a5224d51cfe618dcd5c1473e774fe24be2ea7ddf8467be19cf6d335eba3a5
MD5 563316a2bf0e9b674439787631373901
SHA1 97cf926a594724aaa10c2050513bd5a4e0dfcf47
SHA512 b8f85910ba0d8e592af5fa22d4d5584e71a2a85ff26d1ef21c8940d208e21c1c58c29cf449fee0c65136c347efbb03911a7f938afe124957f9815a5d9f189239
TLSH
T175D0245031D30444F3005073D3D471C4175CF3344D031100C051011404743C570D10C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Windows\SystemTemp\scoped_dir1676_1148450065\Crashpad\settings.dat
Size 280B
SHA256 bd027322eec31ded70c9ce9b5ea26732c884e0de193f76d09d65d457da1e0caa
MD5 44d0ea33e2feb1d6895f934911f7cd64
SHA1 860c5982d3bfb3689e3bff9513cf04631561077c
SHA512 293879b2a941cedcbb20f8f1b2cff2fe8c2e3b00c147b4814c22c8d73d1125cba9f7036d4d73359f467e9ba0445bb137691dd4c52b112b8dcc3670fe3d3a84ee
TLSH
T1FDD0235871E4F7A5FD335879E33583EE36CDB9029713832DD0C112570B871A612D69E1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Windows\SystemTemp\scoped_dir1676_1148450065\Crashpad\settings.dat
Size 280B
SHA256 1c15e45f80ef90e82cdc2867fdc256669fa2bd76e6a3ebd8f3e23db1ef5268db
MD5 8a26fba1eb545fad152351d2fe5e3ba9
SHA1 5dba6370142a63678277159efdade0d317de0035
SHA512 b0849048651a9404726417a0355cd82e6b6dfdffc0a2d21659821861c01b33643899a17f5b5ff475cf2469dee30ccd5f9a061f1805a1111c32a12a4160048fd1
TLSH
T14DD02B5035D100B4E1015072725572880DA5F238CE051404C02093114864144B0AD19B
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Windows\SystemTemp\scoped_dir1676_1148450065\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 19305d799907999b5d092d925bf9bf84d1a5173637d31e863c84cf15d52a72d4
MD5 8437e0462f984a33a3c8d1fc8a0b945c
SHA1 787d7ce4cff5d71447fc8de9ee1ecebc217614a9
SHA512 087c1181d91dbde4aeae1ab5ca6a303760b66ec7658ace4173c9178ae8d9d72843f0425e9d8c7df4f3c1fe5713d79568c300095e99ba9240a836ee632678201a
TLSH
T1E781624456C8E72EFF362CBCDDB84C44263AF3A9396A7F43B14C982959AF2E50B4010D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59cb45.TMP

Path C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Code Cache\js\index-dir\the-real-index~RFe59cb45.TMP
Size 2KB
SHA256 cb8aae7256ee5ac37de6255093e2cf73a77e131640985c0fc9979b731755dc12
MD5 f1e46a3f1c60c7829d264dcbc16a8eba
SHA1 44fff67a46b37c03ac9e9425bcbaafb94540c125
SHA512 a8f35c7f819661cc9290d140d29db60f8514f65d3430910e23b318781496fc92d7f2acb30e60cd108fb0b61a7730c8835ac0eaf78c34bfc1029158dedb34d832
TLSH
T12851B8415AECE4ADEB791C3CDEF898583634F3925C8B3F4312545078558A7FA0F9454E
MD5 SHA1 SHA512 TLSH

Submit Download

e82589df-24c9-4d41-891d-eb9d741591df.tmp

Path C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\DualEngine\e82589df-24c9-4d41-891d-eb9d741591df.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

73b56407-f96c-4599-bc1f-d9a30d79ca66.tmp

Path C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Network\73b56407-f96c-4599-bc1f-d9a30d79ca66.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Network\Network Persistent State
Size 4KB
SHA256 d6525bc0273cb9f0ed52021050aa7c976df49cc743ae49acf4049bd82f9828ca
MD5 0ebf140e1b3d5e86628b2ffbfc66cbcf
SHA1 1faeb040c300c2c164bc14d8f6bb14d0f7d12779
SHA512 a5f0edc209b87f5e803872602d710c924ad5e8223f12d46dbc758317900b8b04c60ab2f6dc09d7965bab6b489dc1572f67c5c2dd2e1541e187da619e00749ffe
SSDEEP 96:DhODPlzAaP04a7dGwB5GOjnOxH8LG7Nf/tO:DUDPlcada7dGk57jnOxMG7h/tO
TLSH
T12391BDF3C3A6416DCA1195F0AE14AF1BCE1C055643AC3D5A89E46F1B93B28B2E011B8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Network\Network Persistent State
Size 5KB
SHA256 a2056803ea6f10e835a18e5642f73151492404da89fd8da48788030ffa9fe13f
MD5 b0a00d2d21f31f06b423976e9ec010e4
SHA1 b040c6cce93140e2cc7eb951664d8a2b276f34d4
SHA512 56ce5b906351e098aa695faa5d914251f31b179f9ab513def801d9980b260536f9812b1c026efabf0379ad3fec38bbc34416772ac2ca103898aced38b04e8ff1
SSDEEP 96:DhODPfHv2wzBP0BmTa7gGOjEOxcHG/P2OGwuiO:DUDPfHv2w1ImTa7g7jEOxcm/P2OGfiO
TLSH
T144B1ECF3C3E5826DD91195F0AA14AF1BCE1C0552436C3D5E88E4AF4B93F24B2E151B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Preferences
Size 10KB
SHA256 26c58f2057700bc6bbd1b6746940ea16c1e14bd5311cda2eb25eec0e52f962b0
MD5 ee5530c8bbb1ccf0e2100bff6ab327d1
SHA1 cfae2e24e11f7fc9a3405f6bdf7753bd20539ace
SHA512 8a9d5c33be3d78f54b1cfcda7755c84db5d950ec3bf331894e16714c1dbc55731aaad4545cb1123395f73ca3be8df09dd60897b894313339c98767f9eb9d8fe2
SSDEEP 192:zRZgRuM16/fsfs6O3HzybZAupP8/gb+WN4OA/5vGD9ni+SIgmJ:zRZg916/fCs66+TE/cW/5zHy
TLSH
T12322D7526B24693B4DCBD61EFB147F53E6F99132E4D40E58E6FC8A1C04E66CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Preferences
Size 10KB
SHA256 5dfc07f92e9e26025bfed78fe79094ce6a1ecbeb0c7dd431b52f46d78785c580
MD5 379e7501caa538ae161c77203365fc03
SHA1 7174b377973fa70d104af5ba4649549363fce764
SHA512 d6fd2279e37606fa2419f8d152cded48cef28a48145a9c9fa1f4af4e6b2a769374c08a7f2ee7c3c3622b526d3899f7f0c5aa27cf554dbfbfd55333e00dc7d1ff
SSDEEP 192:zRZgRuM16/fsfseO3HzybZAupP8/gb+WN4OA/5vGD9ni+SIg5kJ:zRZg916/fCse6+TE/cW/5zH6
TLSH
T16B22D8526A24693B4CCBD71EFB14BF53E6F99132D4C41E58E6FC8A1C08E66CD221780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Preferences
Size 11KB
SHA256 7b66b611c5014a484f8625731a6a76a3a15730d9a74b70115e95588a67aa72b1
MD5 434370abb07e86b41296162df0ef2752
SHA1 8ee7179565d6f373bc1a8d4cb137dd662d8d3f63
SHA512 421fa54568bc35684d8a0b46c0d76b858f5a96dd7a5911b3c745ca7efba117e91cd317a37bc75c851728b178cbc1732b353c3bf37ee00c3315c35499ca3d0d02
SSDEEP 192:zRZgRuM16/fsfshFg9QO3HUqkbZ1upP//gb+WN4Zmf5vRufv6i7SIg5M/J:zRZg916/fCsha9Q6UHA3/czf5uOiB
TLSH
T15E32E7526A24693B4CCBD65DFB14BF57E6F89132E4D40E58E6FC8E1C08E66CD221780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Preferences
Size 11KB
SHA256 a13f938b926639145ef9afe1aff6de4f960aaa2a1a241b59dca23374ba37ce88
MD5 5b5c00149462e28dd3092e5e2cc51f69
SHA1 2cd78893e8d3d8855c6412644dfb129b783b2b08
SHA512 27e92b16dfbcb98a71cc77b39858c2ce81187cb7615a36783049eca3ec07374b304a416596e89406f7beaabcf7598646b4bd703334c8a0ce9ced513f7ed2b9dc
SSDEEP 192:sxRZgRuM16/fsfshFg9Q/gl3HUqkbZ1upP//gb+WN4Zmf5vRufv6i7SIg5M/J:sxRZg916/fCsha9QuUHA3/czf5uOiB
TLSH
T15F32F8566A24683B4CCBE65DFA14BF57E6F89132D4C40E58E6FC8E1C08E66CD620781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a26a608c-69db-40d3-88bb-717dd2672b7b\index-dir\the-real-index
Size 72B
SHA256 90e61d269f33ce79eacf8224f7ce057edb890f2c8d70830c449f07ef979ccaf9
MD5 c42e73a87a5c62930199fd44b7e3d566
SHA1 8b5273833960d21d9e4199d93c1a9b15e2558cec
SHA512 b0c3e5499d43bd285bcd75c0f5417d2ffca4419405a40c919578d21f21256b123fc5ccca3f251b212b28528a861ce60b979a30f68db40c8b07f4fb10821954a2
TLSH
T1EAA0025443804CC2D04356F2259A82912321FF251246A30751984C4DDC60A4F8D4141C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5952ba.TMP

Path C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a26a608c-69db-40d3-88bb-717dd2672b7b\index-dir\the-real-index~RFe5952ba.TMP
Size 48B
SHA256 709d90acd5b650515ed9040b0baa172ad260625bdc755b524c6ca35da7e1a79e
MD5 b931f045ac11fe4d801e029209e5c78c
SHA1 c6170898913340800cc269d5f8e727d22bba2e1b
SHA512 3c6d2b79f7b46bdc176513c345afaababf63fe66f982f1d71b47f28d761775814682e3e944e7da233fb4a0332800155b4223aad822a813d5c4ce13dc726492dc
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b33e66e0-a8aa-4590-95eb-3f92b3f9daa4\index-dir\the-real-index
Size 3KB
SHA256 b1de63f6bfcf2f4b3d5f76c8083570b56d4b5dc66a3040378ee4bcab78f9e434
MD5 7ee2dcc0ebd86fba43495339163208e2
SHA1 f298076eac07c2e9f25fed573c4af49e96cce51e
SHA512 f7c6edfe0edbbb36e0203b082437c5eb416b6f2e2b8c7309fb83fbd6b9c0e0aa0e4699ad9389b0182fab8e29ab0bf5623694e8cc48fc1ef1b9eca5b9b11a68bd
TLSH
T1CC51D74F4E4A1FB5DCA871B218B60C83333434EE13886E0746ECEA35A8D33646C5E54D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596363.TMP

Path C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b33e66e0-a8aa-4590-95eb-3f92b3f9daa4\index-dir\the-real-index~RFe596363.TMP
Size 3KB
SHA256 c8d4b35a289f354f485463f657f9d538b1878d7b2cc2df9173ae5828298e1bec
MD5 94c1259600640f31c9008175c9b8aac9
SHA1 016beafa4a340198189cde7a102cf705511e8d1c
SHA512 ed21eb5ba3494bf2831d73012c0db3d23844d83ee682f8b0f354c11602e583fbcd637fb885b02ea5788ea71da7b7ab72a6d4dbfec5a46b1df5040217b2b18ccc
TLSH
T18E51732F5D020B35E89452B309EA58A63739B145864C7E1B62ECE631ECC37ADBC9D394
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 1caedbd39178bf228453a3528be068719952930bfc4a317158b5664e9c4433e2
MD5 25ac55f4f88a193b229a4a3167d8af30
SHA1 6a3ce96d3ae83aea7e1731905cd7f4a790e8eeee
SHA512 ca41e3453889d2b1a520ead8c14735064c53bf2b870ddf7a25cac8c1a874703dac926c3be5a3c7119986927e4921b121c859cabcadcd51b59b8262d7dd703c6f
TLSH
T147E0C0F66EF31C10ECBBC3F22C714061040134489800ECCE413A538364723A13805CE2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 279B
SHA256 50d1561d123718f51120499306c0b0ecccd9688607b1262a81b238a71a77a2f2
MD5 0662fe1825b08462fae7929a08a2f681
SHA1 a81d49281b99f4ec41e95d5f41ccdbdc3c706b74
SHA512 52cde1f59ad30acd9fbf644babda4ab0fd2030bf2cdfec0a7776e22b1333c26f659a64ab5e83422a71cdb99cec8f179c485a46e4829b9ff4c5f4a5c328e677ff
TLSH
T178D02BFA09E50820DD7B53E35C32909205023C549D04AC8E006D738364713623906C91
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 375B
SHA256 c8fe3fa1025928e0b04bd3c84d820972fab7c39f7113132dfef33dccb1a6dafb
MD5 a480b462a60faddd40d42b940a4e5d7a
SHA1 2537ffd21a53bedfb7202051b51781a4a906245b
SHA512 e25ed9fea11970b906b1d1dbb36928984035b5fff71b2b7391dc8402aa91bd61ef5e819044b9420fdb71900ebfcd5d74160f8057e4ec52d84947e36d7a415774
TLSH
T11FE020B61EE31C50ED7BD3F76C7140A105417D48D840ECCE953FB78364723A12819C56
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 279B
SHA256 73a472f249ca7955d84f626d3dc9ce4ad734229763c41f51e34b011144917317
MD5 5f72750f473141a47a18b4efd7085ca5
SHA1 2e73a13bb0564f45d387df455bc2e6d4e169c56d
SHA512 382dc0c335460a1b78df9eda7976f401fa5f970113bf6376d362735d0ddba58add52742875fc0f3605ef07fe7b7bfe7a1ff83f2969d1adaa853a30363fe68819
TLSH
T1E6D02BF62C6F0014DCBB53D214B294E485127C609E42FDDF905DF28B14B12127456CA1
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 271B
SHA256 9c34ce9fc68b5cd4d59b4e7c268ab86c9d2f54364aba4c7886ffceb052e1f0c9
MD5 fd6de405258b26bd668b5e9474087dca
SHA1 8787374536e12724f24dfcc9ac79c08a1009c91f
SHA512 2ecc4550dc799a9f4899ec17ea3a9d7b9212cb6359dba159769be6a539cd6140c5c68351b86b2c5f8dad600c16b7fc3163ecc73e320ad449483865e69ea28f5b
TLSH
T17FD02BF72CAF4014DCBB93C110B295A4850178A09A42FD9F605DD28B14912117856C61
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59019c.TMP

Path C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe59019c.TMP
Size 153B
SHA256 23406ea708b811a65baf27275da8bc1c6298d7efcce01d081f550c5e19e48edb
MD5 edae5f976b2444c11698ecc7c8209fbf
SHA1 2890db6d40f6503aff4f7be19801cba993517b80
SHA512 06536e341488887eedf9f76ac76884823cb41bf6d4435b989decc0abbcedb3f9193be39cf826af2b827dc6ceb9e05fda54dde8733ec9877a630f02ceb51e20ae
TLSH
T180C08CFB0E950804CE2662D2423294A282222C884A44AD8D816DB283A0312223222CE1
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe597267.TMP

Path C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe597267.TMP
Size 153B
SHA256 23370ddf54bb3f32f3b4ba78b906696dc0223172afaf4ab2f0f4b15e7011bfc4
MD5 d59b0dfc19e9249f75f752c284fc5a90
SHA1 43d23d7d2bed82e5ae2fbab7cd5bb07d19945f5b
SHA512 79b785f6f88bc52d0ee8f80dfc684267756763e4695dc56f2ea896359f7af416b0ca3aba695ae3decde0218716abd7d24768c92192191167298f8a9d02dbab96
TLSH
T126C08CF72C6D40009A1613C1007188B54722AC859F42EDAA505DF187217013370A2C62
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 a9e3aeb8357b222941354226daa22c6d125913a5ef34b59beccf0211707c380e
MD5 e88290c1d5647bf9f12f9da2b403be9a
SHA1 ca8025a828c4f404ddaaa58ca27b590e514f2050
SHA512 2ab974a5aa21898cb3deb17f8a975330b4b0b4f38059588bd23f1f37d0d7d2bda22eb94b501cce2dd87d666d33b7d662ab824f85a59df9ff85145f9952e8193a
TLSH
T138A002218E418592C09023F111A905846294BFBD4147330346A816C5CFA015063F5344
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 5b8123461a44b51c396a470a8b4045191352e29605781adc47809ae8c9f636cb
MD5 111dd7fe23068bae4ba59b16fa3846ad
SHA1 cd3fdc663c76f03b4559765805228925ce974ed6
SHA512 06a905d549938dfde3c65b94e39817b49869bc20a22616477f56e44d60b9ecce3ab4fe7af9b8ff3bf772a0570feff23e46b730699f7468dd7b54c88916254b16
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe5954bd.TMP

Path C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5954bd.TMP
Size 48B
SHA256 ce6cf03c63df4466e8a4debd0de554af751a4c3820dc2f3da27b0ec293912d71
MD5 51de522c5b6ab2c60a39a6f6548a222e
SHA1 fedebb0798b652b1f4611cc44f51d3811e772308
SHA512 6bdb8dc49b1eb9dea11a5fef8bff3b94734c6d76036fcd07af90672909b8d3ce41b7a000e4aeaa83b8952c4b688a8ee94c3d428e3975609f46edd93d2565473a
MD5 SHA1 SHA512

Submit Download

index

Path C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 ac16fed436e6e31349daef37a2fb7c83a27ca37a86670c8c1654c74495944ee3
MD5 efbd15b2c8236fea9193d1176ca880b5
SHA1 c93c60f3abfee302749eaa064c07033350ca648d
SHA512 639b9075aa72bc6a4c0ac064f0679c59cd3d247726a9000e94dde8936775cc124acd32a7ae127e5d206954a13c1dd96ca7b7dadd2bea3a06fc762066b1278eab
TLSH
T130A0025019D6A806E9238AB4628646546270A96185C7430741918098FC975E1B66544C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593f13.TMP

Path C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index~RFe593f13.TMP
Size 48B
SHA256 f8a5708236e040be57d414c5a709a21f219d4e2b867ba141848b5efbfa4cb8f9
MD5 d0a012072048a1855a9c4fcce25a2ec8
SHA1 6e67d397667d0eb5a62700440748fd0056d261e0
SHA512 8eea4bdcb742116a37e6943f20d5eb6e0dc2a119af94ad6271f03f6ae3bad5b9798c5f4b19799121897cbe0a151c0108d8d6a74570b7ee1c579d86f161d164d2
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ec0c81a31186bc201f49d29966e301d27e930447e50ce55dd88c39be1583f7cf
MD5 d854172091fe1d29a2c8a6f53f5563c9
SHA1 35a0e2288795d21ddc2fc32108bff7f1cf4eeee5
SHA512 5fbd40bf2ff072dbf7286509be1f61836a05dc809e88cd0f61abe4861c05af659fbbdfaad46e61a8d2c1a2c2d2a99396e21babd48dfbead29542f9568a32bd64
SSDEEP 48:KgTIVKU8QryVFI1KGYIKFIRKOcUTyd/CTvlH:KgTKKU8uOFCKGYtFaKOcqR
TLSH
T1EF91DE0172FF12882C7F291CE8D4A67F424374637029A52A3AF854568BE7E10CDFD6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\Sync Data\Logs\sync_diagnostic.log
Size 536B
SHA256 fc7ed148894e56c063de6e29f449f9dabded13d385c9432c3e4e158a7a09f607
MD5 959df16a4ca7288a2cbfdf4fa42a1ddc
SHA1 bda85fa623232ced57dba8717db53cca7f0762da
SHA512 7437626ba1e5de984e4c1b75ae35f57ce0796e7d736afe5c91d83b751e2b51807a34abffef010de88b15c985b11dde477552685bc8e299bfc340edbed8e90998
TLSH
T16AF0AF40A1EE12446C3F654CD4D4D66B42427473742C642E7AF4A8598BD7E00CEFA5A8
MD5 SHA1 SHA512 TLSH

Submit Download

cf24d773-605b-49b7-9599-625f3064e336.tmp

Path C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\cf24d773-605b-49b7-9599-625f3064e336.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f074c57a-57d5-49a3-a460-c7a931344754.tmp

Path C:\Windows\SystemTemp\scoped_dir1676_1148450065\Default\f074c57a-57d5-49a3-a460-c7a931344754.tmp
Size 24KB
SHA256 29c40d81508bb4aceca06bbfcf84a9f0d7c6fa9fa6ee3b872119374e6df6a1bc
MD5 b85eb627e37190ddc29112dd349fa3d4
SHA1 c2e94e6c413f3d1164eb8e0e95aec538cef0d185
SHA512 140d8e875b9b6c995112230c701897a4d1074977e1270d483987a6c8960613594c0001dba822e045f0db6d1d0163905e2fb70abf6f43ecc2dacf6590d01ec5a9
SSDEEP 768:/HK7IYWDKif198F1+UoAYDCx9Tuqh0VfUC9xbog/OVW43KFroSuP:/HK7IYWDKif19u1jaFcK+XP
TLSH
T1B9B2E97F600DCB7E8FC00A9DD8596F976E6801CB96548E4447F9994C03C77EBA2294CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Windows\SystemTemp\scoped_dir1676_1148450065\Local State
Size 24KB
SHA256 bc906afe03e903bf9c2c289d9dd60b5f764849528ea67a95e203eaf9e8e006fb
MD5 2d58e16887cc0651b78b99638ce64c7d
SHA1 1975b34cfacf443da9f8a6d5522e60a13b7726c7
SHA512 e9dd306ae89da61f7b63e66c28533bcc5d385814b13e37e7f30f7c300a8d86e2614e0d021b6fd309d0dea8f23addb0f8e84c39e1cbec3795909aba9d2ae55025
SSDEEP 384:nasrv+89zHqlDNP9oidM38NHaTy6OOvx4NXzRfY9GvGgXF+ljH1SC8LE1IzDRlf:lrv+4UNbdM3lnKi0vGrVH1SJRZ
TLSH
T1DFB28C31A8A9DE339DE79688B28B76433FF8616784840B88C4D95F0D46876DE170FD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Windows\SystemTemp\scoped_dir1676_1148450065\Local State
Size 20KB
SHA256 36fd4b97507e9cdce119db9cf2e1d46745219fde6f3302ce8f90c4988e6ba0f9
MD5 c37858225926669cded2ee1189102ff4
SHA1 7bf1b17d06e19e549c04b3c7adec6b720aa5ca44
SHA512 58db52ac6ed98dba5f7f26b8c93dce0f87e128a4a7761987f2d5737ef5ee82a4d74dd2e5a4b03cdc2d426e480fcc714a1ebf0ab9e0784f819595d652e944b8d3
SSDEEP 384:nmsrv+89zHqlDNP9oidM38NHaTy6OOvx4NSzRfY9C0GnL8LE1IzVAJ:Rrv+4UNbdM3lnNiI0GnWAJ
TLSH
T1AA927B31B8A8D9739DF78688B24A77837FF4216398850B94D5D85E4C45836DE270FC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Windows\SystemTemp\scoped_dir1676_1148450065\Local State
Size 38KB
SHA256 3bd2f778097b159d70f17d8c5ce4e1af143ec3daeed2da2d8a10a55ce58357d6
MD5 b3b47e151277736889a73c57837fa918
SHA1 5eb8091e0898ee4f94c0fc8bf7b355d0fdb16b96
SHA512 07e183efd6ff54ff7729ae46f3abfff7e8a248f2c08dc9b17a69b3d38fc2ede3073ea874fa9287787db281345317bae489157f8f7ea6ff9556995976bc3f3e56
SSDEEP 768:yrv+4UNbdM3VMviJL3HNHXmTWTbc+evGteVH1Sld:ybsb+3GGeWn1KGtEH1id
TLSH
T17103CF719CAA9F37ADE68A88B18B76477EB8116385C40B84C8D96F4D428B54D070FD3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Windows\SystemTemp\scoped_dir1676_1148450065\Local State
Size 19KB
SHA256 c2dea9b0eb3d5040d5ec2527ab840302db98c958fa66c393722f4743b39cd4c1
MD5 23cae66fbc898f4c439576302d97c9fe
SHA1 b5766b63c4ddc5b8846e30db2f724ec7ca6522ce
SHA512 7eec34fefa3bfbe63cfe56a2a0ff76c02107d895506adc10274a71e34c936eabbf9d630c557e717478d3d22750f296abaef863383c7233fff1f95144b3ec5ce6
SSDEEP 384:nPZcI/38NDTTy6OOsR4N5zRfY95vzfeX4/QHQvdr8LE1IzsNen:H/304MiXzfe81vu
TLSH
T11A927C70A8A1DD779CFBA684BA067747AEF4C26395885B9091EC6F0E01972AD130BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3a7e00f6-f47e-4945-a8fe-73eab323f1f7.tmp

Path C:\Windows\SystemTemp\scoped_dir1676_1148450065\extensions_crx_cache\3a7e00f6-f47e-4945-a8fe-73eab323f1f7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

directx.sys

Path C:\Windows\directx.sys
Size 57B
SHA256 bcafedda46a837ee98f7d8240f4f814dad16982a3db6d38e649fe6b95925e872
MD5 8b6dbdb20a933485f224b31a3a3e42e1
SHA1 dc7def0dd173aea45e38e48bf2aa618d952adf21
SHA512 a0634db794b8398e6b1294864f7ecc4457a733ebe3be8ca44540fd316bbf87d05f514b9aae31efdf390a67140f7bf7dcc9354091d64c389bd25436e82385b028
TLSH
T1DA90020442C7D62949755217056A664DD8A0486C6B4D2B304B128558556180EA5C1251
MD5 SHA1 SHA512 TLSH

Submit Download

svchost.com

Path C:\Windows\svchost.com
Size 40KB
SHA256 e8638156d8ffcd62d1310a66c97859d9d2a3cfa51bb2d68eff1fb3bb5e0b88fa
MD5 bbe7c2a598307f1959111956daa7d18d
SHA1 b5475cb967f67d394929ead4ebb9fc50a7bf9f09
SHA512 24e2481d21c87a464478194213e7692d52631a626f4d7699d4d57f9fad6288353ecec52ac447d5fb6347269c381b35108fb191a7d39cdf1229df51a32ebe455d
SSDEEP 768:eyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJakk0pEDSO:JxqjQ+P04wsmJCHkOz
TLSH
T1BE136C52FAE18871D0301EFCCC1A9258C57A7B303E7A1AF5BAF91D5DEC693D1290C58A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1188-1764-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1556-1758-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2668-2101-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2668-1036-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2668-2125-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2668-1487-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2668-1790-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4380-1725-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4380-2092-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4380-999-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4380-2126-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4380-1316-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4380-651-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/5860-739-0x0000000000400000-0x000000000041B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads