gozi | 1fc54fcaa5c5b1a9c1a5768832778e9ea1aa996cb3f57ca983e527538fe2921d

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 06:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_73ea49aa5fcc4190414985359af340dc_elex_glassworm_hammertoss_icedid.exe
Size 3.7MB
Sample260905-hllrfscd44
SHA256 1fc54fcaa5c5b1a9c1a5768832778e9ea1aa996cb3f57ca983e527538fe2921d
MD5 73ea49aa5fcc4190414985359af340dc
SHA1 ac70bdaba7779ee7341299d8b15a75fa94d13754
SHA512 1ca4dab91e6dc1e91bc5c6e3e4159b06dd6b0c42d9bb19b8da60b2ec163ccd1626c2f9895defd28882d684c216f353ced634920e6d2d0c7a59f27ae3db003f3c
SSDEEP 98304:uKQG7uBNCyQ3pWlXK/DBogaCrtiAmBxscqrA/H:uxGgzXK/DBosDmfsSH
TLSH
T10706E09971D0A486E71E7FB2C5F2F589D7796022B285E7872A87411B0F103F23C5ACDA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker costura discovery gozi isfb packer trojan

Malware Config

Extracted

Family

gozi

Signatures

Family: Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Detects executables manipulated with Fody 3 IoCs

resource	yara_rule
behavioral2/memory/4480-1-0x000001C053990000-0x000001C053BEA000-memory.dmp	INDICATOR_EXE_Packed_Fody
behavioral2/files/0x001000000001c46c-15.dat	INDICATOR_EXE_Packed_Fody
behavioral2/memory/4756-21-0x0000021E03E10000-0x0000021E0406A000-memory.dmp	INDICATOR_EXE_Packed_Fody

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	x1sv4_5p0KO.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2026-09-04_73ea49aa5fcc4190414985359af340dc_elex_glassworm_hammertoss_icedid.exe

Deletes itself 1 IoCs

pid	Process
4756	x1sv4_5p0KO.exe

Executes dropped EXE 1 IoCs

pid	Process
4756	x1sv4_5p0KO.exe

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
behavioral2/files/0x001000000001c46c-15.dat	costura

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_379252134\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_248_1354222995\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_109_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_1033868014\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_768267776\_locales\id\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1664	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	x1sv4_5p0KO.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	2026-09-04_73ea49aa5fcc4190414985359af340dc_elex_glassworm_hammertoss_icedid.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	2026-09-04_73ea49aa5fcc4190414985359af340dc_elex_glassworm_hammertoss_icedid.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	x1sv4_5p0KO.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	2026-09-04_73ea49aa5fcc4190414985359af340dc_elex_glassworm_hammertoss_icedid.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	x1sv4_5p0KO.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134330645937739237"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3986082593-3624157295-3514260330-1000\{C264EA1D-E672-4BDD-A428-7CBEECA31B52}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4480	2026-09-04_73ea49aa5fcc4190414985359af340dc_elex_glassworm_hammertoss_icedid.exe
4480	2026-09-04_73ea49aa5fcc4190414985359af340dc_elex_glassworm_hammertoss_icedid.exe
4480	2026-09-04_73ea49aa5fcc4190414985359af340dc_elex_glassworm_hammertoss_icedid.exe
4480	2026-09-04_73ea49aa5fcc4190414985359af340dc_elex_glassworm_hammertoss_icedid.exe
4480	2026-09-04_73ea49aa5fcc4190414985359af340dc_elex_glassworm_hammertoss_icedid.exe
4480	2026-09-04_73ea49aa5fcc4190414985359af340dc_elex_glassworm_hammertoss_icedid.exe
4480	2026-09-04_73ea49aa5fcc4190414985359af340dc_elex_glassworm_hammertoss_icedid.exe
4480	2026-09-04_73ea49aa5fcc4190414985359af340dc_elex_glassworm_hammertoss_icedid.exe
4480	2026-09-04_73ea49aa5fcc4190414985359af340dc_elex_glassworm_hammertoss_icedid.exe
4480	2026-09-04_73ea49aa5fcc4190414985359af340dc_elex_glassworm_hammertoss_icedid.exe
4480	2026-09-04_73ea49aa5fcc4190414985359af340dc_elex_glassworm_hammertoss_icedid.exe
4480	2026-09-04_73ea49aa5fcc4190414985359af340dc_elex_glassworm_hammertoss_icedid.exe
4480	2026-09-04_73ea49aa5fcc4190414985359af340dc_elex_glassworm_hammertoss_icedid.exe
4480	2026-09-04_73ea49aa5fcc4190414985359af340dc_elex_glassworm_hammertoss_icedid.exe
4480	2026-09-04_73ea49aa5fcc4190414985359af340dc_elex_glassworm_hammertoss_icedid.exe
4480	2026-09-04_73ea49aa5fcc4190414985359af340dc_elex_glassworm_hammertoss_icedid.exe
4480	2026-09-04_73ea49aa5fcc4190414985359af340dc_elex_glassworm_hammertoss_icedid.exe
4480	2026-09-04_73ea49aa5fcc4190414985359af340dc_elex_glassworm_hammertoss_icedid.exe
4480	2026-09-04_73ea49aa5fcc4190414985359af340dc_elex_glassworm_hammertoss_icedid.exe
4480	2026-09-04_73ea49aa5fcc4190414985359af340dc_elex_glassworm_hammertoss_icedid.exe
4480	2026-09-04_73ea49aa5fcc4190414985359af340dc_elex_glassworm_hammertoss_icedid.exe
4480	2026-09-04_73ea49aa5fcc4190414985359af340dc_elex_glassworm_hammertoss_icedid.exe
4480	2026-09-04_73ea49aa5fcc4190414985359af340dc_elex_glassworm_hammertoss_icedid.exe
4480	2026-09-04_73ea49aa5fcc4190414985359af340dc_elex_glassworm_hammertoss_icedid.exe
4480	2026-09-04_73ea49aa5fcc4190414985359af340dc_elex_glassworm_hammertoss_icedid.exe
4480	2026-09-04_73ea49aa5fcc4190414985359af340dc_elex_glassworm_hammertoss_icedid.exe
4480	2026-09-04_73ea49aa5fcc4190414985359af340dc_elex_glassworm_hammertoss_icedid.exe
4480	2026-09-04_73ea49aa5fcc4190414985359af340dc_elex_glassworm_hammertoss_icedid.exe
4480	2026-09-04_73ea49aa5fcc4190414985359af340dc_elex_glassworm_hammertoss_icedid.exe
4480	2026-09-04_73ea49aa5fcc4190414985359af340dc_elex_glassworm_hammertoss_icedid.exe
4480	2026-09-04_73ea49aa5fcc4190414985359af340dc_elex_glassworm_hammertoss_icedid.exe
4480	2026-09-04_73ea49aa5fcc4190414985359af340dc_elex_glassworm_hammertoss_icedid.exe
4480	2026-09-04_73ea49aa5fcc4190414985359af340dc_elex_glassworm_hammertoss_icedid.exe
4480	2026-09-04_73ea49aa5fcc4190414985359af340dc_elex_glassworm_hammertoss_icedid.exe
4756	x1sv4_5p0KO.exe
4756	x1sv4_5p0KO.exe
4756	x1sv4_5p0KO.exe
4756	x1sv4_5p0KO.exe
4756	x1sv4_5p0KO.exe
4756	x1sv4_5p0KO.exe
4756	x1sv4_5p0KO.exe
4756	x1sv4_5p0KO.exe
4756	x1sv4_5p0KO.exe
4756	x1sv4_5p0KO.exe
4756	x1sv4_5p0KO.exe
4756	x1sv4_5p0KO.exe
4756	x1sv4_5p0KO.exe
4756	x1sv4_5p0KO.exe
4756	x1sv4_5p0KO.exe
4756	x1sv4_5p0KO.exe
4756	x1sv4_5p0KO.exe
4756	x1sv4_5p0KO.exe
4756	x1sv4_5p0KO.exe
4756	x1sv4_5p0KO.exe
4756	x1sv4_5p0KO.exe
4756	x1sv4_5p0KO.exe
4756	x1sv4_5p0KO.exe
4756	x1sv4_5p0KO.exe
4756	x1sv4_5p0KO.exe
4756	x1sv4_5p0KO.exe
4756	x1sv4_5p0KO.exe
4756	x1sv4_5p0KO.exe
4756	x1sv4_5p0KO.exe
4756	x1sv4_5p0KO.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
248	msedge.exe
248	msedge.exe
248	msedge.exe
248	msedge.exe
248	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4480	2026-09-04_73ea49aa5fcc4190414985359af340dc_elex_glassworm_hammertoss_icedid.exe
Token: SeDebugPrivilege	4756	x1sv4_5p0KO.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
248	msedge.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 4480 wrote to memory of 4756	4480	2026-09-04_73ea49aa5fcc4190414985359af340dc_elex_glassworm_hammertoss_icedid.exe	89
PID 4756 wrote to memory of 1712	4756	x1sv4_5p0KO.exe	90
PID 1712 wrote to memory of 420	1712	csc.exe	92
PID 4756 wrote to memory of 248	4756	x1sv4_5p0KO.exe	93
PID 248 wrote to memory of 4736	248	msedge.exe	94
PID 248 wrote to memory of 1664	248	msedge.exe	95
PID 248 wrote to memory of 5944	248	msedge.exe	96
PID 248 wrote to memory of 5944	248	msedge.exe	96
PID 248 wrote to memory of 5944	248	msedge.exe	96
PID 248 wrote to memory of 3600	248	msedge.exe	97
PID 248 wrote to memory of 3600	248	msedge.exe	97
PID 248 wrote to memory of 2948	248	msedge.exe	99
PID 248 wrote to memory of 2948	248	msedge.exe	99
PID 248 wrote to memory of 2948	248	msedge.exe	99
PID 248 wrote to memory of 3176	248	msedge.exe	100
PID 248 wrote to memory of 3176	248	msedge.exe	100
PID 248 wrote to memory of 3176	248	msedge.exe	100
PID 248 wrote to memory of 1972	248	msedge.exe	101
PID 248 wrote to memory of 1972	248	msedge.exe	101
PID 248 wrote to memory of 1972	248	msedge.exe	101
PID 248 wrote to memory of 852	248	msedge.exe	102
PID 248 wrote to memory of 852	248	msedge.exe	102
PID 248 wrote to memory of 852	248	msedge.exe	102
PID 248 wrote to memory of 1700	248	msedge.exe	104
PID 248 wrote to memory of 1700	248	msedge.exe	104
PID 248 wrote to memory of 3060	248	msedge.exe	105
PID 248 wrote to memory of 5492	248	msedge.exe	106
PID 248 wrote to memory of 3060	248	msedge.exe	105
PID 248 wrote to memory of 5492	248	msedge.exe	106
PID 248 wrote to memory of 5892	248	msedge.exe	108
PID 248 wrote to memory of 3956	248	msedge.exe	109
PID 248 wrote to memory of 3956	248	msedge.exe	109
PID 248 wrote to memory of 5084	248	msedge.exe	110
PID 248 wrote to memory of 5084	248	msedge.exe	110
PID 248 wrote to memory of 4476	248	msedge.exe	113
PID 248 wrote to memory of 4476	248	msedge.exe	113
PID 248 wrote to memory of 2404	248	msedge.exe	114
PID 248 wrote to memory of 2404	248	msedge.exe	114
PID 248 wrote to memory of 948	248	msedge.exe	116
PID 248 wrote to memory of 5068	248	msedge.exe	117
PID 248 wrote to memory of 1540	248	msedge.exe	118
PID 248 wrote to memory of 4336	248	msedge.exe	119
PID 248 wrote to memory of 4336	248	msedge.exe	119
PID 248 wrote to memory of 2140	248	msedge.exe	123
PID 248 wrote to memory of 2140	248	msedge.exe	123
PID 248 wrote to memory of 3064	248	msedge.exe	124
PID 248 wrote to memory of 3064	248	msedge.exe	124
PID 248 wrote to memory of 2368	248	msedge.exe	125
PID 248 wrote to memory of 4544	248	msedge.exe	126
PID 248 wrote to memory of 4544	248	msedge.exe	126

C:\Users\Admin\AppData\Local\Temp\2026-09-04_73ea49aa5fcc4190414985359af340dc_elex_glassworm_hammertoss_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_73ea49aa5fcc4190414985359af340dc_elex_glassworm_hammertoss_icedid.exe"
1⤵
- Checks BIOS information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Users\Admin\AppData\Local\Temp\x1sv4_5p0KO.exe
  "C:\Users\Admin\AppData\Local\Temp\x1sv4_5p0KO.exe" --is-new-copy "C:\Users\Admin\AppData\Local\Temp\2026-09-04_73ea49aa5fcc4190414985359af340dc_elex_glassworm_hammertoss_icedid.exe"
  2⤵
  - Checks BIOS information in registry
  - Deletes itself
  - Executes dropped EXE
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\x1sv4_5p0KO.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_5091c820fb3f41c4909c424caeb6c792.cs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1712
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4116.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD1A3FDA48754DAE8FFBF2E6E97C72F2.TMP"
      4⤵
      PID:420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://v0-helper-setup-guide.vercel.app/
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x358,0x7ffc3f80c188,0x7ffc3f80c194,0x7ffc3f80c1a0
      4⤵
      PID:4736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,10731846801107127165,13731939709745144519,524288 --field-trial-handle=2404,i,17239853467823147350,553061863217754598,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:11
      4⤵
      System Time Discovery
      PID:1664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1608,i,5190815033014815390,18211779643889790898,262144 --field-trial-handle=2404,i,17239853467823147350,553061863217754598,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:2
      4⤵
      PID:5944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2336,i,3777725788901124184,11924029532287390096,524288 --field-trial-handle=2404,i,17239853467823147350,553061863217754598,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:13
      4⤵
      PID:3600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3524,i,17493117467033857064,16546094835950001396,2097152 --field-trial-handle=2404,i,17239853467823147350,553061863217754598,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
      4⤵
      PID:2948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3528,i,10829495441618930502,658116497628104075,2097152 --field-trial-handle=2404,i,17239853467823147350,553061863217754598,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
      4⤵
      PID:3176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,7942689634278979795,3928090233305624289,2097152 --field-trial-handle=2404,i,17239853467823147350,553061863217754598,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
      4⤵
      PID:1972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,16112888047659258930,8433024264711105126,2097152 --field-trial-handle=2404,i,17239853467823147350,553061863217754598,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:9
      4⤵
      PID:852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,17768304867959429412,883193356675082801,524288 --field-trial-handle=2404,i,17239853467823147350,553061863217754598,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:14
      4⤵
      PID:1700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,3116410684946801780,3459886416653480450,524288 --field-trial-handle=2404,i,17239853467823147350,553061863217754598,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
      4⤵
      PID:3060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,9233377236394759468,8542551574060127712,524288 --field-trial-handle=2404,i,17239853467823147350,553061863217754598,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
      4⤵
      PID:5492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,13885187665480667438,3336680907636041734,524288 --field-trial-handle=2404,i,17239853467823147350,553061863217754598,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
      4⤵
      PID:4884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,13885187665480667438,3336680907636041734,524288 --field-trial-handle=2404,i,17239853467823147350,553061863217754598,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
      4⤵
      PID:5892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,13262508961681955650,15751022559988965401,524288 --field-trial-handle=2404,i,17239853467823147350,553061863217754598,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
      4⤵
      PID:3956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,509533669702257703,7159612942947425580,524288 --field-trial-handle=2404,i,17239853467823147350,553061863217754598,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
      4⤵
      PID:5084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,16004216227067107815,7352202086446933686,524288 --field-trial-handle=2404,i,17239853467823147350,553061863217754598,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:14
      4⤵
      PID:4476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,7158427576927265331,16661346784031724844,524288 --field-trial-handle=2404,i,17239853467823147350,553061863217754598,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
      4⤵
      PID:2404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4180,i,17388178653512315752,5564255946171047204,524288 --field-trial-handle=2404,i,17239853467823147350,553061863217754598,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:14
      4⤵
      PID:948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,17594411688963371891,15838219754707131309,524288 --field-trial-handle=2404,i,17239853467823147350,553061863217754598,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:14
      4⤵
      PID:5068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4268,i,5842162405396968240,13186769136595057288,524288 --field-trial-handle=2404,i,17239853467823147350,553061863217754598,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:14
      4⤵
      PID:1540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2852,i,2991892494746499534,4577722200789448047,524288 --field-trial-handle=2404,i,17239853467823147350,553061863217754598,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
      4⤵
      PID:4336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,9785378778799059115,9525305251854390364,524288 --field-trial-handle=2404,i,17239853467823147350,553061863217754598,262144 --variations-seed-version --mojo-platform-channel-handle=2000 /prefetch:14
      4⤵
      PID:2140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,7021518213872255712,15945866817389714202,524288 --field-trial-handle=2404,i,17239853467823147350,553061863217754598,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
      4⤵
      PID:3064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5148,i,17145547139161696796,8608037054806056039,262144 --field-trial-handle=2404,i,17239853467823147350,553061863217754598,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:10
      4⤵
      PID:2368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,10999810240644935561,6049114488039712862,524288 --field-trial-handle=2404,i,17239853467823147350,553061863217754598,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
      4⤵
      PID:4544

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18a644ba613d5b4137dabc346f57eca622b6888922eaec751025ab3c0a002fd5
MD5 5eddc74c05def624cfd47ea0a7e304a5
SHA1 b5f795fcc3846bb781e66e0373fce119975b2659
SHA512 1c777d774c154e89b80817ce7344495d83eecf133c36e0ad7c60dd14d76e628697535cc3fc379ca4eeb776f3bea5096f94d0fd76a2394ecd2e52f5ca8dc0053f
TLSH
T133D09B5672455C4CD641343224E55217E3008821654546194353F0768DD668717ABD9A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da739d58d61b2ac7b5d9bb7ad60982cb15b364d9c7c9297fd0c9719c271cd985
MD5 2d2e0ac0da9a175b4b6a8be7c9d51cce
SHA1 ff15c8a5ff11faefae3f7491c7968a2163702b81
SHA512 0ae78f15909f04e1a81109917b8eeb5b8062a49558d8a40f15c02076b087f36e82b88b329e9d984fc68c62cb15408123b9db7f705f2745bfefc30b5aa2e164e6
TLSH
T1EAD09B5A72455D4CD641343224E55217E3108821754546194253F0768DD668717ABD9E
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 2a0b0e226e27d66b220cbcd3416487460d253bb4ae759c375dfc1f7a442c65df
MD5 40e882496814d773230a3647327a11e0
SHA1 03c398d3734a7c1b024db1a5cfb49319c8d10021
SHA512 5bd5e178db223d4c09cf0a190b26fec5e79c313823195157ad2eb06fba639213b70306db5215001e9293f7a286d2a142ab0044e3ccca3b18d68726bfbc9cc898
TLSH
T1AE41FA6453B81ADEFBA1C9F36FE2BE6436B4C8FD841F6F0144C0A2F43A4636424913A0
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 e257a1c2ea0167c296f38ce075d9a0b10a73cd0b0aa4aa44c536c6661465b7b7
MD5 397838a00e7aaa7b931000aed72d983f
SHA1 7cbe7903dc74360a063b1f58bf84e8e5d63cfb85
SHA512 bffc20f547c9d61c365fbe5fa6a16457b5afffe6f67376dd4436b5e13f144ef0ddc15bfaa3cdb8b2f77ba4c421e8a3ec37d0cc1e61c532115df261bf88c12e67
TLSH
T1D161ADF3C7E4856DDA0256F4AB187E27CE5C0515433C3C9985E4AE1BA3E34B1E241A8F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 7300f7920b72a220d6177ee1073ebd5b823213e6b463e8aa34e9d08db2fdd447
MD5 d2962ac59b17c0964b2749d38c540b5a
SHA1 c5f93301da911ce5d94915910c93be8dae5754de
SHA512 ff6eba131aa3d89fab0df77cd897a7a13478306120bd38f4d767dda879f61b1ce8ea3f07d01c4e60fd80d171e3d99d0e6e2f3d9ce8bfae10f8653b0ffa69447b
SSDEEP 192:sxRsRZyM/jK1Ml8UQHCD/fZsboJZYRozoA8p2j/g6+WNif9/YEx83AGfBIgDktxN:sxRsXqiD/fZsboHY3Q/58/eZO
TLSH
T17762D715AA349977DCDBD209FA517FA3D6F85472A1941E44AAFCCB0C04E6AED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 635ae24bfad6fdafd8cc9b2d1e932d9a02767f2e684c1ef17de068904e906f0e
MD5 2973c8deae824962fe300fe5fc29c020
SHA1 be98d4815c26c2dc8689c7b0c7359bd38f1c5b2d
SHA512 6707a2778ddf174b11ca39ec38ce7cfed82d4b300a2828a79cd12ad207935c854b728cb7f524d790e1d46425c9e58049728c55569f4fd4997719ee62b0a9bfa6
SSDEEP 192:sxRbRZyM/jK1Ml8wCD/fZsfVJZYRozoA8pkj/g6+WNif9/YExq3AGfBIgVtx7J:sxRbX8D/fZsfVHY3y/58/sZn
TLSH
T16762D915AA34A977CCDBD20DFA557F63D6F81473A1945E44AAFC8B0C04E6AED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 2e0da1e0ada3f2db5117047e540928e0255cc91dd29441e642a0b9fc43f7182e
MD5 02bcca825f84b2762016e4986e6aa314
SHA1 8445ffa72ce68c257be3658094eaf8238757d5b3
SHA512 c5dbbfdebf51d4496a56444d558210cead12e61cbf6b25930d58861b72bdfdac7b069fd2025399ea05febc7b53e20a0636325850468cecf4ed56185c40a0bd67
SSDEEP 192:sxRsRZyM/jK1Ml8wCD/fZsbVJZYRozoA8pkj/g6+WNif9/YExq3AGfBIgD+tx7J:sxRsX8D/fZsbVHY3y/58/sZI
TLSH
T14662D915AA349977CCDBD20DFA557F63D6F81473A1941E44AAFC8B0C04EAAED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 ec7727f19e2d022b202bc067e003c0da0ff64d617d67dfcc5e567c25a95a47b3
MD5 643b1548580dcd37cec28c06eba51fe4
SHA1 790b224f8c39fdd923faf91e2243606d1988d640
SHA512 2946397f2dfc9fb96a108418be5e075fc14f072ce648493a35f3f0bb350030200db7ae496f5165f58389272af9a38b215eee1d3475f199d8f9405016c46a5095
SSDEEP 768:40D76DrQD8kK7pLuLzb0DbWgQ6DjfPQDF8F1+UoAYDCx9Tuqh0VfUC9xbog/OVqy:40D76DrQD8kiEzb0DbWgQ6DjfPQDFu1B
TLSH
T18AE2EB3B680CCB7F4F8049DCAC29BDDA6DE801CB56D8899447EA881C03C67EF551A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b4acf1a93788ecc653c50323b75e84aa4899f8a9c0e04a0ce0fb44970cf2f441
MD5 e99556f899172e108b80425d99e1bfcd
SHA1 59d94e8d562fa986a87753d438f670d980cfbd70
SHA512 ba7c3ec35d41e62c67f73a89dc7018da8a1f6a8116a7b994ceacb700002dfcbc35189ee186d47cdf4fad3e86e6fb2e2befd276d939cad7b156e33e1093016aaa
SSDEEP 96:KRdqjXNn7vWj4mgfvK4+gBvcldQzLkHv4dZvtNhW528gBhK4Igvhc3f+BtiHhevd:CdqjXNn7Oj4XfV+gBkldQzLkHv4dZvt7
TLSH
T15D91B154723BC3C1387EA58882B9C46F82C271A27158A53B3BA901559B37E179DFFCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5538e260-1d09-4f56-b50e-28d465ce52a3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\5538e260-1d09-4f56-b50e-28d465ce52a3.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 205c5885dbd592e1af78432f63c32121a9684109d779126cd6f9d10e1d8a4685
MD5 b51baf98643920658569b5822833438b
SHA1 736f7ee5469ac23602b347014556787c0e025c71
SHA512 29845479c39f044fa8779cbc11bcbcd592c20d08f40029f4af1bd43e16b248c84696d2be6af5e57de8ac06f054181314223c29e775dae7a105f1315ba83f4523
SSDEEP 768:cc3qo6DTd+ZD00O8gBeX6+qTko0u229a4vsTEcTR+Gl:cc3P1MQvVTVKa4BcTR+Gl
TLSH
T18CF2CF71F8659DB388FAD28572173683AEB511B3C9C80E44E9DDEB1D094B6681B0FC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 d0d8cbb6f5a35c9ffab44f21d3a63490fd699ff77af13bd751a7bc56bae283eb
MD5 495d54f75520c69e96e0cb3339af8ca8
SHA1 4c5ae8033bbcc7f6fd86f2b2700542fb6f841ca7
SHA512 f20a49e24622dc38a0ca456e9eb90203a87953e157f0130875c944ad8222c62fbda0c739b857825575b753579a8e8d544bddbdff0160a0b7668d2a20169b30ed
SSDEEP 768:7FQf3lwgI1xnZD00O8gdeX6+qTko0u229a4vsTEcTR+Gl:Of3w1MsvVTVKa4BcTR+Gl
TLSH
T1C0134BF198D38977D8AE8387633D6D469DBCD0A3B5885984BBC85E0DCC461BFC70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 6a70ca372de83350c0b2bc544547fa9443dc21864386bd1c2747604ccc890d50
MD5 a528c020bc469c9d72e75c8eb342e468
SHA1 f212be2a19a79f480e39a763c8e860dc787d9a74
SHA512 e025292253f059d68b3bb53c2facd63deefb3f06494382c597320d626e14653abe0036d6939d5f73d613ce1166b830e24ba9a4216cc6f15a9663374a94c85cd2
SSDEEP 768:prv+4UNbdG3VhBDTd+ZD00OaeX6+qTko0u229a4vsDFeVH1SdW:pbsbU321svVTVKa4sEH1h
TLSH
T11B03CF32E86989778DE7D784B14B75472FB81163C6C81B80D8ED6B4D068F5AC270BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 fcf605ccfa560ce9fe1697ebf96ee196e5fca44213c94be0326dce6620e08fa6
MD5 ca4fddf7ca8c7f18cd6e305d82c6d481
SHA1 d06338ce1fa88f67c8233b18a26ad6e0b5ad2f57
SHA512 8ae77b7fae2637d635d1288050e9ea20b6aabe6a3f2cffa4ccdffdc95d52682dc216e556000c1f94d1bbb829ef9920652b983a54f6c8768b75e24ea912384763
SSDEEP 768:mc3Lo6DTd+ZD00O8gBeX6+qTko0u229a4vsTEcTR+Gl:mc3K1MQvVTVKa4BcTR+Gl
TLSH
T1FCF2CF71F8659CB388FAD28572173683AEB511B3C9C81E44E9DDEB1D094B6681B0FC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 3b2da33850a6c9c8bfd09263efcfe091720634da738a4085b1b6735711236580
MD5 a2724f5a88b86f692c07a06e9951859f
SHA1 2a3e5b179bc694ad4556782cdbdd8c6d3703c4a7
SHA512 38a6e7e6d142a35cb927f85f70c8c6b859f32344c3801fbbceee4cac6f48e38e33ab632ebef4e702435e25ee3f0da8f783fcc4b0c3fc631774910161b2764ee8
SSDEEP 768:Vrv+4UNbdG3za4DTd+ZD00O8gDeX6+qTko0u229a4vsSEeVH1SdW:VbsbU3u1MCvVTVKa4SEH1h
TLSH
T18003BF32E8699D738DE6D685B14772872F7821B38AC40F94D8DEAB4D064B15C2B0F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 c4c56d2bacc9e9e3408acba914794f92f7afb91aa470db24d56b64121a9effb3
MD5 a91c6da01d7cc8cd9042c648c18a85fd
SHA1 f6adbb6cb889b58d3a2360690a0a54b324bb679b
SHA512 124b54794bb1165e90d8b9efdc907532058e5999c3986d20d4e5d8ccc3a65d24c007f822631e8d8573069fb5febc6895dc1bf50f1362e7bfbb8b30b47a3a985a
SSDEEP 768:Crv+4UNbdj3L16DTd+ZD00O8gweX6+qTko0u229a4vsTEcTR7:Cbsbt3R1MfvVTVKa4BcTR7
TLSH
T1C103CF31F8299D738DB6D285B10B36937FB421A389C50E54E9DDAB4D094B5A82B0F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e98a161a-fe19-48c2-b093-3e37a1cb9c3f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e98a161a-fe19-48c2-b093-3e37a1cb9c3f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json~RFe599198.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe599198.TMP
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

4ed3121d-d490-45f3-854e-e87cda30babd.tmp

Path C:\Users\Admin\AppData\Local\Temp\4ed3121d-d490-45f3-854e-e87cda30babd.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

RES4116.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4116.tmp
Size 1KB
SHA256 d01134957a0f0b212ddff5afb4df0e2a4875a21621a1b8447a0a6b03d1c5185d
MD5 13755fa177028b61851ea2bc15594649
SHA1 7c870a046da7ea259c3cf63a31e587e8d3448104
SHA512 830c5a0999fe3a30382c0dd872d6f6bfe2cb95bd6d9483311303c6223268edaba6635cc040f198d7f5b8c3be85c2e84912451e9956e327140f1cc0b30d1db121
TLSH
T16B41004183DC8B1FF172473228F7972AA678BD95AE9A475D7488132E1E42644CDC3272
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir248_1947268169\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x1sv4_5p0KO.exe

Path C:\Users\Admin\AppData\Local\Temp\x1sv4_5p0KO.exe
Size 4.2MB
SHA256 32dcc1f004f5ea0d908215973adbf2fc2aab03887d5a2d24bda289c4504df527
MD5 a2e4ccdf27dbe3c5cd2dc13ac8a3c40d
SHA1 ec3324c870ef8c204ec0a05769f564c6fd03877b
SHA512 8b526eac5c3708b60dd8c7b01b3c93d86cfe1244033dd72a16f852cd1c29282c467491c118598fde8cde2366395fff2899d231ae364a0ebeab1272fc101d9a07
SSDEEP 98304:PKQG7uBNCyQ3pWlXK/DBog+CrtiAmBxscqrA/O4h0muSCKmM:PxGgzXK/DBoIDmfsSO4ymuzu
TLSH
T13B16E0D971D0A486E71E7FB2C5F2F589CB756022B285E7872A87411B0E103F23C5ADDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCD1A3FDA48754DAE8FFBF2E6E97C72F2.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSCD1A3FDA48754DAE8FFBF2E6E97C72F2.TMP
Size 1KB
SHA256 9686bb845d55a4662a841313a52cedc6ed57ba6deecd4a1d29332be4664deda0
MD5 6da40bfb5d4a993d053d11824a0b3065
SHA1 fd98186e7b8a1d553264e0cd9ada72b6f5851875
SHA512 15f508356ba32bf8bb63b160bc2965226682ed4335561b13a480c29e1e5704a41588d674530b6f530504d654601bff5b972628f88089de552676c1ad5566605c
TLSH
T12F21EB85A3E8821EF2F3473279F2C363916CBE969D7A43EC3488171B1F159048593AB1
MD5 SHA1 SHA512 TLSH

Submit Download

guardian_src_5091c820fb3f41c4909c424caeb6c792.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\guardian_src_5091c820fb3f41c4909c424caeb6c792.cs
Size 4KB
SHA256 3ee1bf1ab210527e7543dc78ca3511904bf7770d571eb0d11746edd9f5bf814a
MD5 b7d40eb7e1328728d647678e1ea0a4dc
SHA1 43850a88c7f012df9e7349886497271c83e2bdaa
SHA512 a531df01588357b0d669d563fada88e78b0b3d1453e40605a872e9fba6091bb46a623b0817aafab946b01f92d5810ed7eb97ed9373eaeacb9970b316278667a4
SSDEEP 96:noO1V0E4Yt1YOC3idfygNzkfK1Sg5vpVIHZZ:jl481hC3i1ygNzw5g5vpVw3
TLSH
T19F911298954DA2D69872223AFB03D15BF603103322FF9A20FEADD3505F3D0018678F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4480-16-0x00007FFC43EB0000-0x00007FFC44854000-memory.dmp

Download

memory/4480-10-0x00007FFC43EB0000-0x00007FFC44854000-memory.dmp

Download

memory/4480-129-0x00007FFC43EB0000-0x00007FFC44854000-memory.dmp

Download

memory/4480-9-0x00007FFC43EB0000-0x00007FFC44854000-memory.dmp

Download

memory/4480-2-0x00007FFC43EB0000-0x00007FFC44854000-memory.dmp

Download

memory/4480-3-0x000001C055960000-0x000001C055999000-memory.dmp

Download

memory/4480-18-0x00007FFC43EB0000-0x00007FFC44854000-memory.dmp

Download

memory/4480-1-0x000001C053990000-0x000001C053BEA000-memory.dmp

Download

memory/4480-0-0x00007FFC4403F000-0x00007FFC44040000-memory.dmp

Download

memory/4756-32-0x0000021E05E10000-0x0000021E05E49000-memory.dmp

Download

memory/4756-21-0x0000021E03E10000-0x0000021E0406A000-memory.dmp

Download

memory/4756-23-0x00007FFC43EB0000-0x00007FFC44854000-memory.dmp

Download

memory/4756-28-0x00007FFC43EB0000-0x00007FFC44854000-memory.dmp

Download

memory/4756-41-0x00007FFC43EB0000-0x00007FFC44854000-memory.dmp

Download

memory/4756-38-0x00007FFC43EB0000-0x00007FFC44854000-memory.dmp

Download

memory/4756-39-0x00007FFC43EB0000-0x00007FFC44854000-memory.dmp

Download

memory/4756-40-0x00007FFC43EB0000-0x00007FFC44854000-memory.dmp

Download

memory/4756-25-0x00007FFC43EB0000-0x00007FFC44854000-memory.dmp

Download