gozi | 2e64bcf7031d3082bc3778bdb479c1b8037d647598c10af4318c4e6480fae577

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/09/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-03_9253a49b86bcac4c66363f3e728a4598_elex_glassworm_hammertoss_icedid.exe
Size 4.3MB
Sample260904-e1m2aax1fz
SHA256 2e64bcf7031d3082bc3778bdb479c1b8037d647598c10af4318c4e6480fae577
MD5 9253a49b86bcac4c66363f3e728a4598
SHA1 4d32b3747a68ec7ae171e2e19563b7c8d6903234
SHA512 67b0ad30e393c32b9b8bb86e057f67d2e865ca23886e1c09c426c207619d16b15c624f6b59fabe06676c82c88fcd2cedf65b92192daa4fb22e3365cf5a00c029
SSDEEP 98304:sKQG7uBNCyQ3pWlXK/DBogTw1tAdDRG+y9HA5cvbF6P:sxGgzXK/DBoemtk4+uPvbAP
TLSH
T14026E19972D0A486E71E3F72D5F2F499D7756022B285E7872A87421B0F113F23C1ACDA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker costura discovery gozi isfb packer trojan

Malware Config

Extracted

Family

gozi

Signatures

Family: Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Detects executables manipulated with Fody 3 IoCs

resource	yara_rule
behavioral2/memory/2964-1-0x000001BF10670000-0x000001BF108CA000-memory.dmp	INDICATOR_EXE_Packed_Fody
behavioral2/files/0x000e0000000007e0-24.dat	INDICATOR_EXE_Packed_Fody
behavioral2/memory/3604-30-0x000002A1600B0000-0x000002A16030A000-memory.dmp	INDICATOR_EXE_Packed_Fody

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2026-09-03_9253a49b86bcac4c66363f3e728a4598_elex_glassworm_hammertoss_icedid.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	BhGfVy9VJTt40bs8uZ6daN.exe

Deletes itself 1 IoCs

pid	Process
3604	BhGfVy9VJTt40bs8uZ6daN.exe

Executes dropped EXE 1 IoCs

pid	Process
3604	BhGfVy9VJTt40bs8uZ6daN.exe

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
behavioral2/files/0x000e0000000007e0-24.dat	costura

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_750153672\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_2074316101\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_2074316101\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_1116_1257438707\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_109_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_750153672\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_1775354206\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_2074316101\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1116_745943418\_locales\et\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5576	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	2026-09-03_9253a49b86bcac4c66363f3e728a4598_elex_glassworm_hammertoss_icedid.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	2026-09-03_9253a49b86bcac4c66363f3e728a4598_elex_glassworm_hammertoss_icedid.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	BhGfVy9VJTt40bs8uZ6daN.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	BhGfVy9VJTt40bs8uZ6daN.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	2026-09-03_9253a49b86bcac4c66363f3e728a4598_elex_glassworm_hammertoss_icedid.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	BhGfVy9VJTt40bs8uZ6daN.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134329694953883503"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3986082593-3624157295-3514260330-1000\{70E8DD8B-C40E-4556-97B7-4E53EC0BD06F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2964	2026-09-03_9253a49b86bcac4c66363f3e728a4598_elex_glassworm_hammertoss_icedid.exe
2964	2026-09-03_9253a49b86bcac4c66363f3e728a4598_elex_glassworm_hammertoss_icedid.exe
2964	2026-09-03_9253a49b86bcac4c66363f3e728a4598_elex_glassworm_hammertoss_icedid.exe
2964	2026-09-03_9253a49b86bcac4c66363f3e728a4598_elex_glassworm_hammertoss_icedid.exe
2964	2026-09-03_9253a49b86bcac4c66363f3e728a4598_elex_glassworm_hammertoss_icedid.exe
2964	2026-09-03_9253a49b86bcac4c66363f3e728a4598_elex_glassworm_hammertoss_icedid.exe
2964	2026-09-03_9253a49b86bcac4c66363f3e728a4598_elex_glassworm_hammertoss_icedid.exe
2964	2026-09-03_9253a49b86bcac4c66363f3e728a4598_elex_glassworm_hammertoss_icedid.exe
2964	2026-09-03_9253a49b86bcac4c66363f3e728a4598_elex_glassworm_hammertoss_icedid.exe
2964	2026-09-03_9253a49b86bcac4c66363f3e728a4598_elex_glassworm_hammertoss_icedid.exe
2964	2026-09-03_9253a49b86bcac4c66363f3e728a4598_elex_glassworm_hammertoss_icedid.exe
2964	2026-09-03_9253a49b86bcac4c66363f3e728a4598_elex_glassworm_hammertoss_icedid.exe
2964	2026-09-03_9253a49b86bcac4c66363f3e728a4598_elex_glassworm_hammertoss_icedid.exe
2964	2026-09-03_9253a49b86bcac4c66363f3e728a4598_elex_glassworm_hammertoss_icedid.exe
2964	2026-09-03_9253a49b86bcac4c66363f3e728a4598_elex_glassworm_hammertoss_icedid.exe
2964	2026-09-03_9253a49b86bcac4c66363f3e728a4598_elex_glassworm_hammertoss_icedid.exe
2964	2026-09-03_9253a49b86bcac4c66363f3e728a4598_elex_glassworm_hammertoss_icedid.exe
2964	2026-09-03_9253a49b86bcac4c66363f3e728a4598_elex_glassworm_hammertoss_icedid.exe
2964	2026-09-03_9253a49b86bcac4c66363f3e728a4598_elex_glassworm_hammertoss_icedid.exe
2964	2026-09-03_9253a49b86bcac4c66363f3e728a4598_elex_glassworm_hammertoss_icedid.exe
2964	2026-09-03_9253a49b86bcac4c66363f3e728a4598_elex_glassworm_hammertoss_icedid.exe
2964	2026-09-03_9253a49b86bcac4c66363f3e728a4598_elex_glassworm_hammertoss_icedid.exe
2964	2026-09-03_9253a49b86bcac4c66363f3e728a4598_elex_glassworm_hammertoss_icedid.exe
2964	2026-09-03_9253a49b86bcac4c66363f3e728a4598_elex_glassworm_hammertoss_icedid.exe
2964	2026-09-03_9253a49b86bcac4c66363f3e728a4598_elex_glassworm_hammertoss_icedid.exe
2964	2026-09-03_9253a49b86bcac4c66363f3e728a4598_elex_glassworm_hammertoss_icedid.exe
2964	2026-09-03_9253a49b86bcac4c66363f3e728a4598_elex_glassworm_hammertoss_icedid.exe
2964	2026-09-03_9253a49b86bcac4c66363f3e728a4598_elex_glassworm_hammertoss_icedid.exe
2964	2026-09-03_9253a49b86bcac4c66363f3e728a4598_elex_glassworm_hammertoss_icedid.exe
2964	2026-09-03_9253a49b86bcac4c66363f3e728a4598_elex_glassworm_hammertoss_icedid.exe
2964	2026-09-03_9253a49b86bcac4c66363f3e728a4598_elex_glassworm_hammertoss_icedid.exe
2964	2026-09-03_9253a49b86bcac4c66363f3e728a4598_elex_glassworm_hammertoss_icedid.exe
2964	2026-09-03_9253a49b86bcac4c66363f3e728a4598_elex_glassworm_hammertoss_icedid.exe
2964	2026-09-03_9253a49b86bcac4c66363f3e728a4598_elex_glassworm_hammertoss_icedid.exe
3604	BhGfVy9VJTt40bs8uZ6daN.exe
3604	BhGfVy9VJTt40bs8uZ6daN.exe
3604	BhGfVy9VJTt40bs8uZ6daN.exe
3604	BhGfVy9VJTt40bs8uZ6daN.exe
3604	BhGfVy9VJTt40bs8uZ6daN.exe
3604	BhGfVy9VJTt40bs8uZ6daN.exe
3604	BhGfVy9VJTt40bs8uZ6daN.exe
3604	BhGfVy9VJTt40bs8uZ6daN.exe
3604	BhGfVy9VJTt40bs8uZ6daN.exe
3604	BhGfVy9VJTt40bs8uZ6daN.exe
3604	BhGfVy9VJTt40bs8uZ6daN.exe
3604	BhGfVy9VJTt40bs8uZ6daN.exe
3604	BhGfVy9VJTt40bs8uZ6daN.exe
3604	BhGfVy9VJTt40bs8uZ6daN.exe
3604	BhGfVy9VJTt40bs8uZ6daN.exe
3604	BhGfVy9VJTt40bs8uZ6daN.exe
3604	BhGfVy9VJTt40bs8uZ6daN.exe
3604	BhGfVy9VJTt40bs8uZ6daN.exe
3604	BhGfVy9VJTt40bs8uZ6daN.exe
3604	BhGfVy9VJTt40bs8uZ6daN.exe
3604	BhGfVy9VJTt40bs8uZ6daN.exe
3604	BhGfVy9VJTt40bs8uZ6daN.exe
3604	BhGfVy9VJTt40bs8uZ6daN.exe
3604	BhGfVy9VJTt40bs8uZ6daN.exe
3604	BhGfVy9VJTt40bs8uZ6daN.exe
3604	BhGfVy9VJTt40bs8uZ6daN.exe
3604	BhGfVy9VJTt40bs8uZ6daN.exe
3604	BhGfVy9VJTt40bs8uZ6daN.exe
3604	BhGfVy9VJTt40bs8uZ6daN.exe
3604	BhGfVy9VJTt40bs8uZ6daN.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2964	2026-09-03_9253a49b86bcac4c66363f3e728a4598_elex_glassworm_hammertoss_icedid.exe
Token: SeDebugPrivilege	3604	BhGfVy9VJTt40bs8uZ6daN.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1116	msedge.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 4744	2964	2026-09-03_9253a49b86bcac4c66363f3e728a4598_elex_glassworm_hammertoss_icedid.exe	89
PID 4744 wrote to memory of 6080	4744	csc.exe	91
PID 2964 wrote to memory of 3604	2964	2026-09-03_9253a49b86bcac4c66363f3e728a4598_elex_glassworm_hammertoss_icedid.exe	92
PID 3604 wrote to memory of 3444	3604	BhGfVy9VJTt40bs8uZ6daN.exe	93
PID 3444 wrote to memory of 3332	3444	csc.exe	95
PID 3604 wrote to memory of 1116	3604	BhGfVy9VJTt40bs8uZ6daN.exe	96
PID 1116 wrote to memory of 1772	1116	msedge.exe	97
PID 1116 wrote to memory of 484	1116	msedge.exe	98
PID 1116 wrote to memory of 5576	1116	msedge.exe	99
PID 1116 wrote to memory of 484	1116	msedge.exe	98
PID 1116 wrote to memory of 484	1116	msedge.exe	98
PID 1116 wrote to memory of 4912	1116	msedge.exe	100
PID 1116 wrote to memory of 4912	1116	msedge.exe	100
PID 1116 wrote to memory of 6072	1116	msedge.exe	102
PID 1116 wrote to memory of 4368	1116	msedge.exe	103
PID 1116 wrote to memory of 6072	1116	msedge.exe	102
PID 1116 wrote to memory of 6072	1116	msedge.exe	102
PID 1116 wrote to memory of 4368	1116	msedge.exe	103
PID 1116 wrote to memory of 4368	1116	msedge.exe	103
PID 1116 wrote to memory of 4336	1116	msedge.exe	104
PID 1116 wrote to memory of 4336	1116	msedge.exe	104
PID 1116 wrote to memory of 4336	1116	msedge.exe	104
PID 1116 wrote to memory of 5856	1116	msedge.exe	105
PID 1116 wrote to memory of 5856	1116	msedge.exe	105
PID 1116 wrote to memory of 5856	1116	msedge.exe	105
PID 1116 wrote to memory of 5900	1116	msedge.exe	106
PID 1116 wrote to memory of 5900	1116	msedge.exe	106
PID 1116 wrote to memory of 3764	1116	msedge.exe	108
PID 1116 wrote to memory of 3332	1116	msedge.exe	109
PID 1116 wrote to memory of 3764	1116	msedge.exe	108
PID 1116 wrote to memory of 3332	1116	msedge.exe	109
PID 1116 wrote to memory of 4292	1116	msedge.exe	111
PID 1116 wrote to memory of 3412	1116	msedge.exe	112
PID 1116 wrote to memory of 3412	1116	msedge.exe	112
PID 1116 wrote to memory of 5664	1116	msedge.exe	113
PID 1116 wrote to memory of 5664	1116	msedge.exe	113
PID 1116 wrote to memory of 5568	1116	msedge.exe	116
PID 1116 wrote to memory of 5568	1116	msedge.exe	116
PID 1116 wrote to memory of 4752	1116	msedge.exe	117
PID 1116 wrote to memory of 4752	1116	msedge.exe	117
PID 1116 wrote to memory of 200	1116	msedge.exe	119
PID 1116 wrote to memory of 2100	1116	msedge.exe	120
PID 1116 wrote to memory of 6056	1116	msedge.exe	121
PID 1116 wrote to memory of 604	1116	msedge.exe	122
PID 1116 wrote to memory of 604	1116	msedge.exe	122
PID 1116 wrote to memory of 240	1116	msedge.exe	126
PID 1116 wrote to memory of 240	1116	msedge.exe	126
PID 1116 wrote to memory of 3868	1116	msedge.exe	127
PID 1116 wrote to memory of 3868	1116	msedge.exe	127
PID 1116 wrote to memory of 5432	1116	msedge.exe	128
PID 1116 wrote to memory of 5432	1116	msedge.exe	128
PID 1116 wrote to memory of 1480	1116	msedge.exe	129
PID 1116 wrote to memory of 4236	1116	msedge.exe	130
PID 1116 wrote to memory of 4236	1116	msedge.exe	130

C:\Users\Admin\AppData\Local\Temp\2026-09-03_9253a49b86bcac4c66363f3e728a4598_elex_glassworm_hammertoss_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-03_9253a49b86bcac4c66363f3e728a4598_elex_glassworm_hammertoss_icedid.exe"
1⤵
- Checks BIOS information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\2026-09-03_9253a49b86bcac4c66363f3e728a4598_elex_glassworm_hammertoss_icedid.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_7601868791564d04a15ff25c7f2ee2b5.cs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4744
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB50E.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF0369F077CBE4AA3A8F01FD1D41E3FE3.TMP"
    3⤵
    PID:6080
- C:\Users\Admin\AppData\Local\Temp\BhGfVy9VJTt40bs8uZ6daN.exe
  "C:\Users\Admin\AppData\Local\Temp\BhGfVy9VJTt40bs8uZ6daN.exe" --is-new-copy "C:\Users\Admin\AppData\Local\Temp\2026-09-03_9253a49b86bcac4c66363f3e728a4598_elex_glassworm_hammertoss_icedid.exe"
  2⤵
  - Checks BIOS information in registry
  - Deletes itself
  - Executes dropped EXE
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3604
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\BhGfVy9VJTt40bs8uZ6daN.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_c493a04e0cdb49a2981d6b90d7a9b696.cs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3444
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBDD8.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF91FEE9FD65B44FA8536A2CF445CCF9.TMP"
      4⤵
      PID:3332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://v0-helper-setup-guide.vercel.app/
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x220,0x7ff934d3c188,0x7ff934d3c194,0x7ff934d3c1a0
      4⤵
      PID:1772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,10380832492398667022,8247745411809116170,262144 --field-trial-handle=2328,i,1863296012636757475,16277159202160026445,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
      4⤵
      PID:484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,13468061919216294825,16631162264972764074,524288 --field-trial-handle=2328,i,1863296012636757475,16277159202160026445,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:11
      4⤵
      System Time Discovery
      PID:5576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,4202024918396601355,15953279432491870112,524288 --field-trial-handle=2328,i,1863296012636757475,16277159202160026445,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:13
      4⤵
      PID:4912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3520,i,2868349979561027103,9964041124007193519,2097152 --field-trial-handle=2328,i,1863296012636757475,16277159202160026445,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
      4⤵
      PID:6072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3524,i,6123140060710749619,2881584622740357265,2097152 --field-trial-handle=2328,i,1863296012636757475,16277159202160026445,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
      4⤵
      PID:4368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4172,i,14162064949188681825,17551611499183433053,2097152 --field-trial-handle=2328,i,1863296012636757475,16277159202160026445,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:9
      4⤵
      PID:4336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4148,i,6847173223407617153,17023987908278836159,2097152 --field-trial-handle=2328,i,1863296012636757475,16277159202160026445,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
      4⤵
      PID:5856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,8645413635721265186,12993321280490037320,524288 --field-trial-handle=2328,i,1863296012636757475,16277159202160026445,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
      4⤵
      PID:5900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,15242340563042550053,15955254809228779646,524288 --field-trial-handle=2328,i,1863296012636757475,16277159202160026445,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:14
      4⤵
      PID:3764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,1772321273225272021,5249431576186065075,524288 --field-trial-handle=2328,i,1863296012636757475,16277159202160026445,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
      4⤵
      PID:3332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,743305975664766461,16213713152369182031,524288 --field-trial-handle=2328,i,1863296012636757475,16277159202160026445,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:14
      4⤵
      PID:2484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,743305975664766461,16213713152369182031,524288 --field-trial-handle=2328,i,1863296012636757475,16277159202160026445,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:14
      4⤵
      PID:4292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,11950518709938748731,16776391213148449777,524288 --field-trial-handle=2328,i,1863296012636757475,16277159202160026445,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:14
      4⤵
      PID:3412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,14205408504816555014,4905416167451692232,524288 --field-trial-handle=2328,i,1863296012636757475,16277159202160026445,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
      4⤵
      PID:5664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,17752303921835867061,4727120548872547174,524288 --field-trial-handle=2328,i,1863296012636757475,16277159202160026445,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
      4⤵
      PID:5568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6572,i,15430090129596739139,173082151825658935,524288 --field-trial-handle=2328,i,1863296012636757475,16277159202160026445,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:14
      4⤵
      PID:4752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4208,i,9833694157184950086,4118567365685379441,524288 --field-trial-handle=2328,i,1863296012636757475,16277159202160026445,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:14
      4⤵
      PID:200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,17293163489678830567,13720997147102974378,524288 --field-trial-handle=2328,i,1863296012636757475,16277159202160026445,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:14
      4⤵
      PID:2100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4256,i,7913462971992618685,1865884130549657200,524288 --field-trial-handle=2328,i,1863296012636757475,16277159202160026445,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:14
      4⤵
      PID:6056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,6559684375884549308,9650293999886052217,524288 --field-trial-handle=2328,i,1863296012636757475,16277159202160026445,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
      4⤵
      PID:604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,4416030224532001113,5816950313037916466,524288 --field-trial-handle=2328,i,1863296012636757475,16277159202160026445,262144 --variations-seed-version --mojo-platform-channel-handle=2996 /prefetch:14
      4⤵
      PID:240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=924,i,15300934317024248277,11266226978902269648,524288 --field-trial-handle=2328,i,1863296012636757475,16277159202160026445,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:14
      4⤵
      PID:3868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,4693888506994282200,2529945259250219600,524288 --field-trial-handle=2328,i,1863296012636757475,16277159202160026445,262144 --variations-seed-version --mojo-platform-channel-handle=920 /prefetch:14
      4⤵
      PID:5432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6748,i,11655570457929533445,4671094144183534205,262144 --field-trial-handle=2328,i,1863296012636757475,16277159202160026445,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:10
      4⤵
      PID:1480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1192,i,18018270783942251703,6868991265318423171,524288 --field-trial-handle=2328,i,1863296012636757475,16277159202160026445,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:14
      4⤵
      PID:4236

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18a644ba613d5b4137dabc346f57eca622b6888922eaec751025ab3c0a002fd5
MD5 5eddc74c05def624cfd47ea0a7e304a5
SHA1 b5f795fcc3846bb781e66e0373fce119975b2659
SHA512 1c777d774c154e89b80817ce7344495d83eecf133c36e0ad7c60dd14d76e628697535cc3fc379ca4eeb776f3bea5096f94d0fd76a2394ecd2e52f5ca8dc0053f
TLSH
T133D09B5672455C4CD641343224E55217E3008821654546194353F0768DD668717ABD9A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da739d58d61b2ac7b5d9bb7ad60982cb15b364d9c7c9297fd0c9719c271cd985
MD5 2d2e0ac0da9a175b4b6a8be7c9d51cce
SHA1 ff15c8a5ff11faefae3f7491c7968a2163702b81
SHA512 0ae78f15909f04e1a81109917b8eeb5b8062a49558d8a40f15c02076b087f36e82b88b329e9d984fc68c62cb15408123b9db7f705f2745bfefc30b5aa2e164e6
TLSH
T1EAD09B5A72455D4CD641343224E55217E3108821754546194253F0768DD668717ABD9E
MD5 SHA1 SHA512 TLSH

Submit Download

2ccf71f5-b7c8-4996-9c05-a36fc6f9cdf0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2ccf71f5-b7c8-4996-9c05-a36fc6f9cdf0.tmp
Size 12KB
SHA256 5442d23b5d528d7b9d85a9ad7d189b39b48321c86f63e06a32bb3c98cdaf5c58
MD5 d5c606a94a2d9691a37483dec45cff2b
SHA1 fcbc13ac82235bb70b25687b5287b492941a043a
SHA512 0438bafe9ffeca7d7f4e3cb95daa0a194608d148eb6558dc707dba86ee8949767d6ff9760bd45f04c996e5db1ad2349fccacde09a6077a4df36395b61f1c2408
SSDEEP 192:sxRZRiCU/fH+scneZiIzoA8pkG/g6+WNiBn/YEJou1G8pIgDN48qJ:sxRZ/U/fescnYiR7/58/NFY
TLSH
T11142B7156A28A93B6CCBD25DFB55BF53E6F95032A1901E48A7FCCA1C04E76CD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c2a209ea56869aed6fafe7259a79ff0534136fc1d837e26a9dfa9bacbc3b20bb
MD5 dd52d8cb0194cc133cc969b1307e1abe
SHA1 cec3e9b6bb3ecc656c17a9e58d1858855b20af7e
SHA512 18eb46400aed6f649812458b848349bd53194482e3184c527b34ec6f697453974be5dfaebac8dc591e8bfe3bba02e8fa9bb9f886e15c468100a071ba84a094cf
TLSH
T15C615E54636B07D2E73745B1A0D369DF3FB89E86858FAF429F80B378560A7D0290217E
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 5940d7f0ff7cb72ca100c6c115a87cd665dc73256dd243da88ddb66780594667
MD5 2934955fca71adb94492461c2f2c2fa2
SHA1 760e373c31c57de1ee6202e949b2663d5cb196c2
SHA512 239f07baac1bca667e869a95dacd389d658c3c1320aa50ed87ade9971544cca19bc2e4903fcd2d1ab14f18cdd0c6a831c1ba24555f8bbfcbe459d309470c5b65
TLSH
T1AA61ACF3C3E4856DDE0256F4AB146E2BCE5C0515433C3C5A84E8AE5BA7E24B1E241A8F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e29a8a90febbe16bc27b0668e5912aa7fbe7154ca7493b36d9ce11b321f2dd79
MD5 0a6cc1ecefaac4c4fd0f4ca42cb9ca11
SHA1 1364ec6122744fe70beb446224d82379bf9bff71
SHA512 d78ba241f033347094ee62a682f1367256d5ba122ac6b180d95a6c0783ca0ded21b624f760d6aea24bed6bb77e462096ab949111e7f9a8bd02b9dc25a0655146
SSDEEP 192:sxRKRiCU/fH+sxieZiIzoA8pkG/g6+WNiBn/YE7+u1G8pIgV48qJ:sxRK/U/fesxiYiR7/58/dF8
TLSH
T15F42C8156E28A83B5CCBD25DFB55BF53E6F95032A1905E48E6FC8A1C04E76CD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 053e4cb54da130a5bffeac40a8ae36dbe2f7dc4fe03deff90b8840745283aca1
MD5 d733ba677b805481042c5b5c6e6bf646
SHA1 ebee057431f6b0281ee7d691ac19a30088eca6d6
SHA512 da905c550d2418ba83488b1c816e24cc2650596d4a6fea684477350fd3f2bd581ea3ae0ae98877ed4d7f19255809dc2faf822c4a1dfaafeebb6718507d10881f
SSDEEP 192:sxRZRiCU/fH+scieZiIzoA8pkG/g6+WNiBn/YE7+u1G8pIgD/48qJ:sxRZ/U/fesciYiR7/58/dFS
TLSH
T19A42C8156E24A93B5CCBD25DFB55BF53E6F95032A1A01E48E6FC8A1C04EB6CD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 5511ce863b72a381a21ce6f1bc152dd5252db71ed484fdfa0f70260bb337b083
MD5 e73a11f27a947506649ecde74686168e
SHA1 1687e599011371e87e27fe82f1800a3023235cc4
SHA512 e83c8ba068ce10d027b9f3897e6d5400f46bf9a4a5e99e97599916cc770d0c6a4958619f4a3d492e43ebe25cadc00b536f65e9a767eec392fb1f69d709ba29a3
SSDEEP 768:40Dk6DJQD8H07pLuLzn0DbWgQ6DjfIQDF8F1+UoAYDCx9Tuqh0VfUC9xbog/OV4b:40Dk6DJQD8H4Ezn0DbWgQ6DjfIQDFu1e
TLSH
T15CD2EA7B640CCB7F4F804ADDAD197A9F6DA802CB96D8C98047FA891C02C77EE51194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 380992507b0c1018be78483fb31efe1201964cd9a96115b7a4eb41709b7fb592
MD5 e2cea506444c104e1d2db1b0d3db2206
SHA1 5930103ee745ed96aafc9a2516d72a975b7685af
SHA512 068d69c5ed56b643a7b3cbf217e8663203ace2cd07305b37b3ffa11e7ca0f34aca1f2d05719bd82bd86c3849bd098080151972b85a2946266c7ec4163afded97
SSDEEP 96:KRpm3zBj3TWH0ig7TK4Kg1Tc5xMv3wHyX+SkE0SWcJhgCSK4Xg4ScCqRw944KZKA:Cpm3zBj3CH0j7JKg1A5xMv3wHyX+SkEu
TLSH
T16B916310757B9241387E66588279952F4293B4B3301CE97B7BB811A24F2BE064DFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c7d0ed90-9083-4d7d-98d2-83b7c8dc95c2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c7d0ed90-9083-4d7d-98d2-83b7c8dc95c2.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 d57b155f510e43927592bb19256f4bd6138616c997eb707e5c09a0b2d25927e5
MD5 6d565e881b0bfe123002670a664092e6
SHA1 331e7df3775b33b0603fc6fff3e519424ad0e70b
SHA512 518937bcf222c22f7a7bec4309bda0ed6794cfb1fb1e9e3e338823157f3de0cd60a604568c5af34a22190332a50e97add897db4e6e698adf6e6b65882078c93e
SSDEEP 768:LFQ735wgRInnZc0UXTtTeX6+qTko0u229a4vsTucTR4KQ:e73sdU4vVTVKa4zcTR4KQ
TLSH
T1AD133AF198E38937D8AE8787633D6D469DBCD0A3B5885980BBD85D0CCC461BFD70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 ab364289f478e94827d0903245dfa93205dba65b62c0c2304dc7872c137b39b2
MD5 39cbb2a23ed245146d93417e18315ffb
SHA1 8654da48f5000c36e501c9093838ad6475493a92
SHA512 dafef48aea2eda4c555ad709b062e6e1bc2b10c8568001a91b9674122bc7eb9faee9623ea553d50b1aee9a8bd5faf38eeee07454dea66a9bbcd0997be97fe28f
SSDEEP 768:prv+4UNbdG3hxtDTd+Zc0U8eX6+qTko0u229a4vsDLeVH1SdW:pbsbU32dULvVTVKa4yEH1h
TLSH
T18C03CF32E8A589778DE79785714B75472FB91173C6C80B80D8ED6B4D028B5AC270FD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 db4290c3b8215cd27e846b8f9d49b79dd96af2e67f5f6cec4cc19d7464e93065
MD5 4a5a1383f65b88e3bd5daf50b59188b2
SHA1 6d061b86e4422756645ac11b1c21799001fe3b59
SHA512 ba9f8c60601c0683546fd9fe8c0d664782cdc37837791ddb7755c2b5b8ff035d9240d2515b948ce9697b721701ebea3a1c324064c667269c21eb651a59c0de5a
SSDEEP 768:AF3XgYDTd+Zc0UXTtfeX6+qTko0u229a4vsTucTR4KQ:AF3wdUYvVTVKa4zcTR4KQ
TLSH
T10FF2BF71B8629C7388AAD385B21772876EF510B389C95E44E9EDEB1D04076692B0FC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 2a72e00eaa47cf4296cb7b8a1a47da9cfa2f4a8b70efd4081d5b1598bb0f4a43
MD5 d0ba1567bbf316e1c229d270e34b3008
SHA1 5f5f6f138c9c17b99d99cc2e6e5a1e6df1921b78
SHA512 e854b567fc56c3445035ca9454b9d48c9e22d718eace92dc530b99423ce1fcef46fc52c132f12839bbac1c8341153c5edb32f105ded2b3d07ba118e349262eb1
SSDEEP 768:Prv+4UNbdG3H3uDTd+Zc0UXTtzeX6+qTko0u229a4vsSueVH1SdW:PbsbU3DdUAvVTVKa4gEH1h
TLSH
T12703CF32E4699D7389E6D685B14B72872FB821B38AC40F44D8EDAB4D064B59C270FD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 f5526d3ae5519591ce24369ae95bdce17d69ad5a98f8f45553d150f9418f7753
MD5 69dd8ac74066e7e6f50defcd0b71d673
SHA1 e31f2c460def871422618afef64288bf023907a3
SHA512 6e82e6086d9d90ad9c6e8da6850ee09186666923c613614b71c01cd5e808345ff47e38ffecb05bd266de7443fb5608c108a912902b144cf62f3a6b2fd383b690
SSDEEP 768:krv+4UNbdC3BgYDTd+Zc0UXTtfeX6+qTko0u229a4vsTucTR4Y:kbsbg3idUYvVTVKa4zcTR4Y
TLSH
T14D13CF31F4699D3389B6D689B10B71977FB820B389C50A44E9EDAB4C054B5AD370FC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 638527dfc3f4fd8783266843a83a8cb1a4f6a6ca6f66e4cbd417bbf13d489e36
MD5 f32a93031807bd31b55ecbd103f2aa34
SHA1 990eeac3a74351644a201178ec487e8b7e291721
SHA512 002de49598213bf21aa8b98415dbd787f6029f7ca2a20d6d4f319a4d4b8d08fdf7e0f12bea568ace9e9a74d93a5a4ecd3bc39b613e73fdb0d141b90bb52b7976
SSDEEP 768:trv+4UNbdC3wEYDTd+Zc0UXTtfeX6+qTko0u229a4vsTuK4:tbsbg3tdUYvVTVKa4z1
TLSH
T1A403BF31F8699D738CB6D688B10B75877FB821A389C40A54E9EDAA4D050B1AC370FD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

49235741-aa3c-434e-b75a-644813de9542.tmp

Path C:\Users\Admin\AppData\Local\Temp\49235741-aa3c-434e-b75a-644813de9542.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

BhGfVy9VJTt40bs8uZ6daN.exe

Path C:\Users\Admin\AppData\Local\Temp\BhGfVy9VJTt40bs8uZ6daN.exe
Size 4.7MB
SHA256 3d1d9ccb9231cac2336a25c038632519a5439a3388662753fe125e76e26bf2b1
MD5 96e37b98136e60292bab222a099ac9ed
SHA1 2c58b7045f11ea9ee9e2c88d96356d1cda5ba760
SHA512 a8d89a1819c6a35beed219248587abea04ca1b2b85158ed648f11189ad2abb2219ed739303119422961acc28d244bbd17c82847c4fb6439e511737167ff93088
SSDEEP 98304:kKQG7uBNCyQ3pWlXK/DBogWw1tAdDRG+y9HA5cvbF6LP/mwBX:kxGgzXK/DBoLmtk4+uPvbALPecX
TLSH
T10C36F1D972D0A486E71E3B72D5F3F499D7796022B285E7872A87411B0E113F23C1ACDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RESB50E.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESB50E.tmp
Size 2KB
SHA256 9f99f2911827332495d936bf5b2b58f4faff4522021c7a2f4b296d7d086e05c8
MD5 c933ce77581f09d984c683c232407295
SHA1 3cf84923562af955c1ee98cb790e90cc2736ac18
SHA512 f2e69149dbedbf1b3560599f5836410fffb5f73754b004a3f2c6da411a87fbbb457f542cdfb826633e05f7f482a667a5d211ad2b8f5735c33ca96f0da53b708f
TLSH
T1DB41F00482EC4B1BF173873169F3971AA6747DD67E695F4D72C4132A0E12740DDC2672
MD5 SHA1 SHA512 TLSH

Submit Download

RESBDD8.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESBDD8.tmp
Size 1KB
SHA256 94462ccca88c009104ebfc33e3900cca70f969e88d5e69134a3f3829fe87bf45
MD5 908087157243b5206cc96186e932ed99
SHA1 048440ad603cd4ccb60abb22013568b84359da14
SHA512 c208b416a4d457a980753d0fa45712f13a04c460994513a7a100b1adcdf874ca884a4adf7f9fcd18a8c6670e353a320241cbf89da7c98b8fda394b23e9cebb54
TLSH
T19941224083D98B1BE133473129F7972AA674BD55AE9E475E7584132F1F23600DD83271
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1116_283907076\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCF0369F077CBE4AA3A8F01FD1D41E3FE3.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSCF0369F077CBE4AA3A8F01FD1D41E3FE3.TMP
Size 1KB
SHA256 f9001f60e7225e3be83dc76c5605c7b591739e4bbc08a1046bb24f0ba5fc96e8
MD5 3339d02ac6a9aabdebfc96c2e512d4b0
SHA1 0d55ae02ed8a7262e476bbedfa5272f651c3423f
SHA512 eb049b25118c39cd75878e8ff6974b7d76303562c1f6cf767b6ac74ca1806d4ca2a7951e4b50cb16c72a3aca6413cf75325ecf7adf1495f3cfc4d22d9483e119
TLSH
T16D31DD4452EC422EF1B3873079F2C363A5687DE36E394ADC31C8171A0A16A41C493AB2
MD5 SHA1 SHA512 TLSH

Submit Download

CSCF91FEE9FD65B44FA8536A2CF445CCF9.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSCF91FEE9FD65B44FA8536A2CF445CCF9.TMP
Size 1KB
SHA256 2eaa605a886bf2b02f0a1f2f4be06e984f64d62f7be2f7aa9d63a93c0bd578d5
MD5 1b7a4dc3d0d1d72a51fd28ef51c6b3ae
SHA1 521c0688e0c31b0134dcb0d3786e7183f371e0da
SHA512 4fa2187b024db3378ee3e28d6f2456c50043782e0b24d4d0e99f41b15ac534380cadfedd22ab828a6d2e1c642200697145f744916f3093c1136fd3144e0a1b4c
TLSH
T1E221C045A3E8861EF2B3473079F6D3639168BE56AC7E43EC3488175F5F26501C5835B1
MD5 SHA1 SHA512 TLSH

Submit Download

guardian_src_7601868791564d04a15ff25c7f2ee2b5.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\guardian_src_7601868791564d04a15ff25c7f2ee2b5.cs
Size 4KB
SHA256 3ee1bf1ab210527e7543dc78ca3511904bf7770d571eb0d11746edd9f5bf814a
MD5 b7d40eb7e1328728d647678e1ea0a4dc
SHA1 43850a88c7f012df9e7349886497271c83e2bdaa
SHA512 a531df01588357b0d669d563fada88e78b0b3d1453e40605a872e9fba6091bb46a623b0817aafab946b01f92d5810ed7eb97ed9373eaeacb9970b316278667a4
SSDEEP 96:noO1V0E4Yt1YOC3idfygNzkfK1Sg5vpVIHZZ:jl481hC3i1ygNzw5g5vpVw3
TLSH
T19F911298954DA2D69872223AFB03D15BF603103322FF9A20FEADD3505F3D0018678F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2964-1-0x000001BF10670000-0x000001BF108CA000-memory.dmp

Download

memory/2964-13-0x000001BF12500000-0x000001BF12539000-memory.dmp

Download

memory/2964-0-0x00007FF9350FF000-0x00007FF935100000-memory.dmp

Download

memory/2964-2-0x00007FF934F70000-0x00007FF935914000-memory.dmp

Download

memory/2964-25-0x00007FF934F70000-0x00007FF935914000-memory.dmp

Download

memory/2964-3-0x00007FF934F70000-0x00007FF935914000-memory.dmp

Download

memory/2964-20-0x00007FF934F70000-0x00007FF935914000-memory.dmp

Download

memory/2964-27-0x00007FF934F70000-0x00007FF935914000-memory.dmp

Download

memory/2964-5-0x00007FF934F70000-0x00007FF935914000-memory.dmp

Download

memory/2964-6-0x00007FF934F70000-0x00007FF935914000-memory.dmp

Download

memory/3604-47-0x00007FF934F70000-0x00007FF935914000-memory.dmp

Download

memory/3604-41-0x000002A17A770000-0x000002A17A7A9000-memory.dmp

Download

memory/3604-33-0x00007FF934F70000-0x00007FF935914000-memory.dmp

Download

memory/3604-34-0x00007FF934F70000-0x00007FF935914000-memory.dmp

Download

memory/3604-32-0x00007FF934F70000-0x00007FF935914000-memory.dmp

Download

memory/3604-30-0x000002A1600B0000-0x000002A16030A000-memory.dmp

Download