xworm | 08b247d6f17fea53b33ce3a38f88fa898e10c96e0f2619ef998e3752d01947a7

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 03:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-06_4a7e83f217e9bce73c7da5c645e994d9_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe
Size 1.3MB
Sample260907-ef4hjayarb
SHA256 08b247d6f17fea53b33ce3a38f88fa898e10c96e0f2619ef998e3752d01947a7
MD5 4a7e83f217e9bce73c7da5c645e994d9
SHA1 753d7a02be1b27656af9edb386c2cb70037a700c
SHA512 53647d4c715ca4d204e5430c5e51c52dc6f2c3702ba472b646d0046dd20a493d1c5ed17e88f45d73deddb0b2bc079b6a7c5b598f36d9ab35d1cdeb5a882ff80b
SSDEEP 12288:jYyDi5rNipDuysMFZzN/E/msumX7scE/msumLV9orQtTzEiuor:EyggUXup9o8tTt
TLSH
T1C3558348E7E50678F5B64B30A8B9654179F7BC179E31C39F125D017F0AA3A808E63B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery xworm persistence privilege_escalation rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

Version

XWorm V5.6

Attributes

Install_directory
%LocalAppData%
install_file
USB.exe
pastebin_url
https://pastebin.com/raw/Fxzr3jeT

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 5 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c526-4.dat	family_xworm
behavioral2/files/0x000d00000001c528-13.dat	family_xworm
behavioral2/memory/4500-12-0x0000000000510000-0x0000000000526000-memory.dmp	family_xworm
behavioral2/files/0x000d00000001c532-57.dat	family_xworm
behavioral2/files/0x000d00000001c527-96.dat	family_xworm

Detects Windows executables referencing non-Windows User-Agents 5 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c526-4.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000d00000001c528-13.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/4500-12-0x0000000000510000-0x0000000000526000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000d00000001c532-57.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000d00000001c527-96.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.lnk	audiodg.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.lnk	audiodg.exe

Executes dropped EXE 4 IoCs

pid	Process
4500	audiodg.exe
3296	shost.exe
3580	audiodg.exe
4304	2026-09-06_4a7e83f217e9bce73c7da5c645e994d9_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe

Modifies system executable filetype association 2 TTPs 6 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	shost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	shost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	2026-09-06_4a7e83f217e9bce73c7da5c645e994d9_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	2026-09-06_4a7e83f217e9bce73c7da5c645e994d9_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	2026-09-06_4a7e83f217e9bce73c7da5c645e994d9_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	shost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "C:\\Users\\Admin\\AppData\\Local\\winlogon"	audiodg.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
3	pastebin.com

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	shost.exe
File opened (read-only)	\??\O:	shost.exe
File opened (read-only)	\??\P:	shost.exe
File opened (read-only)	\??\S:	shost.exe
File opened (read-only)	\??\T:	shost.exe
File opened (read-only)	\??\W:	shost.exe
File opened (read-only)	\??\Z:	shost.exe
File opened (read-only)	\??\B:	shost.exe
File opened (read-only)	\??\D:	shost.exe
File opened (read-only)	\??\K:	shost.exe
File opened (read-only)	\??\R:	shost.exe
File opened (read-only)	\??\V:	shost.exe
File opened (read-only)	\??\Y:	shost.exe
File opened (read-only)	\??\J:	shost.exe
File opened (read-only)	\??\Q:	shost.exe
File opened (read-only)	\??\G:	shost.exe
File opened (read-only)	\??\I:	shost.exe
File opened (read-only)	\??\L:	shost.exe
File opened (read-only)	\??\M:	shost.exe
File opened (read-only)	\??\N:	shost.exe
File opened (read-only)	\??\U:	shost.exe
File opened (read-only)	\??\X:	shost.exe
File opened (read-only)	\??\A:	shost.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\RCX196B.tmp	shost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	shost.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe	shost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\RCX164C.tmp	shost.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	shost.exe
File opened for modification	C:\Program Files\Windows Defender\Offline\RCX2432.tmp	shost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\RCXE27.tmp	shost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	shost.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\RCX312D.tmp	shost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	shost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\RCX18AA.tmp	shost.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RCX1AB8.tmp	shost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	shost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe	shost.exe
File opened for modification	C:\Program Files\Internet Explorer\RCX340.tmp	shost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX7F7.tmp	shost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\RCXBC1.tmp	shost.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	shost.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	shost.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	shost.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	shost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	shost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\RCXD00.tmp	shost.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	shost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX5A4.tmp	shost.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	shost.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe	shost.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	shost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	shost.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\SenseImdsCollector.exe	shost.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCXE98.tmp	shost.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	shost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\RCX370D.tmp	shost.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\RCX3CAE.tmp	shost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX583.tmp	shost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	shost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	shost.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	shost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	shost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\RCXD42.tmp	shost.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCXEB8.tmp	shost.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCXF3A.tmp	shost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	shost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX6A6.tmp	shost.exe
File created	C:\Program Files\Java\jre-1.8\bin\jjs.exe	shost.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCXFCD.tmp	shost.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	shost.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe	shost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	shost.exe
File created	C:\Program Files\Windows Media Player\wmpshare.exe	shost.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe	shost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\RCX46F.tmp	shost.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	shost.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	shost.exe
File created	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	shost.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	shost.exe
File opened for modification	C:\Program Files\Windows Media Player\RCX3474.tmp	shost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\RCX446D.tmp	shost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCX46FE.tmp	shost.exe
File created	C:\Program Files\7-Zip\Uninstall.exe	shost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	shost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\RCXD22.tmp	shost.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	shost.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	shost.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_697535358\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_697535358\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_1233129650\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_697535358\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_1144367810\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_1233129650\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5796_166424249\_locales\fil\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3816	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134332268560469181"	msedge.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	shost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	shost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	shost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	2026-09-06_4a7e83f217e9bce73c7da5c645e994d9_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	2026-09-06_4a7e83f217e9bce73c7da5c645e994d9_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\Documents\\diagnostics\\shost.exe \"%1\" %*"	2026-09-06_4a7e83f217e9bce73c7da5c645e994d9_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3986082593-3624157295-3514260330-1000\{9F20966E-73D0-48E6-A8AF-929237FB3C01}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5140	msedge.exe
5140	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4500	audiodg.exe
Token: SeDebugPrivilege	3580	audiodg.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5796	msedge.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 4500	1988	2026-09-06_4a7e83f217e9bce73c7da5c645e994d9_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe	89
PID 1988 wrote to memory of 3296	1988	2026-09-06_4a7e83f217e9bce73c7da5c645e994d9_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe	90
PID 3296 wrote to memory of 3580	3296	shost.exe	91
PID 1988 wrote to memory of 4304	1988	2026-09-06_4a7e83f217e9bce73c7da5c645e994d9_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe	92
PID 4304 wrote to memory of 5796	4304	2026-09-06_4a7e83f217e9bce73c7da5c645e994d9_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe	94
PID 5796 wrote to memory of 4432	5796	msedge.exe	95
PID 5796 wrote to memory of 2744	5796	msedge.exe	97
PID 5796 wrote to memory of 3816	5796	msedge.exe	98
PID 5796 wrote to memory of 2744	5796	msedge.exe	97
PID 5796 wrote to memory of 2744	5796	msedge.exe	97
PID 5796 wrote to memory of 4944	5796	msedge.exe	99
PID 5796 wrote to memory of 4944	5796	msedge.exe	99
PID 5796 wrote to memory of 1668	5796	msedge.exe	101
PID 5796 wrote to memory of 672	5796	msedge.exe	100
PID 5796 wrote to memory of 1668	5796	msedge.exe	101
PID 5796 wrote to memory of 1668	5796	msedge.exe	101
PID 5796 wrote to memory of 672	5796	msedge.exe	100
PID 5796 wrote to memory of 672	5796	msedge.exe	100
PID 5796 wrote to memory of 2636	5796	msedge.exe	102
PID 5796 wrote to memory of 1072	5796	msedge.exe	103
PID 5796 wrote to memory of 2636	5796	msedge.exe	102
PID 5796 wrote to memory of 2636	5796	msedge.exe	102
PID 5796 wrote to memory of 1072	5796	msedge.exe	103
PID 5796 wrote to memory of 1072	5796	msedge.exe	103
PID 5796 wrote to memory of 4136	5796	msedge.exe	105
PID 5796 wrote to memory of 4136	5796	msedge.exe	105
PID 5796 wrote to memory of 5536	5796	msedge.exe	106
PID 5796 wrote to memory of 5536	5796	msedge.exe	106
PID 5796 wrote to memory of 5536	5796	msedge.exe	106
PID 5796 wrote to memory of 5236	5796	msedge.exe	107
PID 5796 wrote to memory of 5236	5796	msedge.exe	107
PID 5796 wrote to memory of 5468	5796	msedge.exe	108
PID 5796 wrote to memory of 5468	5796	msedge.exe	108
PID 5796 wrote to memory of 6104	5796	msedge.exe	110
PID 5796 wrote to memory of 6024	5796	msedge.exe	111
PID 5796 wrote to memory of 6024	5796	msedge.exe	111
PID 5796 wrote to memory of 1448	5796	msedge.exe	114
PID 5796 wrote to memory of 1448	5796	msedge.exe	114
PID 5796 wrote to memory of 4708	5796	msedge.exe	115
PID 5796 wrote to memory of 4708	5796	msedge.exe	115
PID 5796 wrote to memory of 4120	5796	msedge.exe	116
PID 5796 wrote to memory of 4120	5796	msedge.exe	116
PID 4304 wrote to memory of 1216	4304	2026-09-06_4a7e83f217e9bce73c7da5c645e994d9_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe	117
PID 5796 wrote to memory of 4532	5796	msedge.exe	118
PID 5796 wrote to memory of 4532	5796	msedge.exe	118
PID 5796 wrote to memory of 4532	5796	msedge.exe	118
PID 5796 wrote to memory of 4544	5796	msedge.exe	119
PID 5796 wrote to memory of 4544	5796	msedge.exe	119
PID 5796 wrote to memory of 4544	5796	msedge.exe	119
PID 5796 wrote to memory of 6044	5796	msedge.exe	121
PID 5796 wrote to memory of 1244	5796	msedge.exe	122
PID 5796 wrote to memory of 5304	5796	msedge.exe	123
PID 5796 wrote to memory of 5100	5796	msedge.exe	124
PID 5796 wrote to memory of 5100	5796	msedge.exe	124
PID 5796 wrote to memory of 5896	5796	msedge.exe	128
PID 5796 wrote to memory of 5896	5796	msedge.exe	128
PID 5796 wrote to memory of 3336	5796	msedge.exe	129
PID 5796 wrote to memory of 3336	5796	msedge.exe	129
PID 5796 wrote to memory of 5520	5796	msedge.exe	130
PID 5796 wrote to memory of 5520	5796	msedge.exe	130
PID 5796 wrote to memory of 5140	5796	msedge.exe	131
PID 5796 wrote to memory of 1204	5796	msedge.exe	132
PID 5796 wrote to memory of 1204	5796	msedge.exe	132

C:\Users\Admin\AppData\Local\Temp\2026-09-06_4a7e83f217e9bce73c7da5c645e994d9_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-06_4a7e83f217e9bce73c7da5c645e994d9_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm.exe"
1⤵
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Users\Admin\Documents\diagnostics\audiodg.exe
  "C:\Users\Admin\Documents\diagnostics\audiodg.exe"
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:4500
- C:\Users\Admin\Documents\diagnostics\shost.exe
  "C:\Users\Admin\Documents\diagnostics\shost.exe"
  2⤵
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3296
- - C:\Users\Admin\Documents\diagnostics\audiodg.exe
    "C:\Users\Admin\Documents\diagnostics\audiodg.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3580
- C:\Users\Admin\AppData\Local\Temp\2026-09-06_4a7e83f217e9bce73c7da5c645e994d9_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-06_4a7e83f217e9bce73c7da5c645e994d9_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2026-09-06_4a7e83f217e9bce73c7da5c645e994d9_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x320,0x7ffdeb9dc188,0x7ffdeb9dc194,0x7ffdeb9dc1a0
      4⤵
      PID:4432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,5968385205840896128,17490214021625470730,262144 --field-trial-handle=2352,i,9532077351811744931,7514923477246457656,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
      4⤵
      PID:2744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,4177836965527688918,11733397937291868730,524288 --field-trial-handle=2352,i,9532077351811744931,7514923477246457656,262144 --variations-seed-version --mojo-platform-channel-handle=3048 /prefetch:11
      4⤵
      System Time Discovery
      PID:3816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2448,i,12936080039054630690,5693321623872579074,524288 --field-trial-handle=2352,i,9532077351811744931,7514923477246457656,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:13
      4⤵
      PID:4944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,945412898202972167,2844832673053391275,2097152 --field-trial-handle=2352,i,9532077351811744931,7514923477246457656,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
      4⤵
      PID:672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3552,i,14330368403815931119,1670305403863415681,2097152 --field-trial-handle=2352,i,9532077351811744931,7514923477246457656,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
      4⤵
      PID:1668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,8828194033906437037,6264253376409178869,2097152 --field-trial-handle=2352,i,9532077351811744931,7514923477246457656,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:1
      4⤵
      PID:2636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,5853693376462266544,6656975974293174761,2097152 --field-trial-handle=2352,i,9532077351811744931,7514923477246457656,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:9
      4⤵
      PID:1072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,15085971698002917685,10361855211245375424,524288 --field-trial-handle=2352,i,9532077351811744931,7514923477246457656,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:14
      4⤵
      PID:4136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5496,i,4439377770626184122,5848800599667196907,2097152 --field-trial-handle=2352,i,9532077351811744931,7514923477246457656,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:1
      4⤵
      PID:5536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,15815560264742877173,15886259955616480777,524288 --field-trial-handle=2352,i,9532077351811744931,7514923477246457656,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:14
      4⤵
      PID:5236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3492,i,2679281862485972551,14396772420108641079,524288 --field-trial-handle=2352,i,9532077351811744931,7514923477246457656,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14
      4⤵
      PID:5468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,5499810852165168358,879938576864683544,524288 --field-trial-handle=2352,i,9532077351811744931,7514923477246457656,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:14
      4⤵
      PID:4868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,5499810852165168358,879938576864683544,524288 --field-trial-handle=2352,i,9532077351811744931,7514923477246457656,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:14
      4⤵
      PID:6104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,15005582787541963735,14483040357380841288,524288 --field-trial-handle=2352,i,9532077351811744931,7514923477246457656,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:14
      4⤵
      PID:6024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,3413056384313018706,8038699852567825709,524288 --field-trial-handle=2352,i,9532077351811744931,7514923477246457656,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:14
      4⤵
      PID:1448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,16010337369309790230,3245088486244042967,524288 --field-trial-handle=2352,i,9532077351811744931,7514923477246457656,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
      4⤵
      PID:4708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6796,i,10528056449375450189,10426819273975667208,524288 --field-trial-handle=2352,i,9532077351811744931,7514923477246457656,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14
      4⤵
      PID:4120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6964,i,18051715935493272530,1851256959680412436,2097152 --field-trial-handle=2352,i,9532077351811744931,7514923477246457656,262144 --variations-seed-version --mojo-platform-channel-handle=7072 /prefetch:1
      4⤵
      PID:4532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7192,i,7814866715287166061,3015223229043258509,2097152 --field-trial-handle=2352,i,9532077351811744931,7514923477246457656,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:1
      4⤵
      PID:4544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3736,i,13411318189335830228,13831345345453593324,524288 --field-trial-handle=2352,i,9532077351811744931,7514923477246457656,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:14
      4⤵
      PID:6044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,9155777392122486308,14589796451559192062,524288 --field-trial-handle=2352,i,9532077351811744931,7514923477246457656,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:14
      4⤵
      PID:1244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,6205135358462667444,16900307899450278972,524288 --field-trial-handle=2352,i,9532077351811744931,7514923477246457656,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:14
      4⤵
      PID:5304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4208,i,1153873152521823158,2442810521438305773,524288 --field-trial-handle=2352,i,9532077351811744931,7514923477246457656,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:14
      4⤵
      PID:5100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,16994231359319578172,13313019898678900655,524288 --field-trial-handle=2352,i,9532077351811744931,7514923477246457656,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:14
      4⤵
      PID:5896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,6623321315187246471,16072998425768422439,524288 --field-trial-handle=2352,i,9532077351811744931,7514923477246457656,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:14
      4⤵
      PID:3336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,12152538322891754691,15067230789897539989,524288 --field-trial-handle=2352,i,9532077351811744931,7514923477246457656,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:14
      4⤵
      PID:5520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6740,i,15661014108015377689,16956943912686237584,262144 --field-trial-handle=2352,i,9532077351811744931,7514923477246457656,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6924,i,4448138294373969903,17035019275446300107,524288 --field-trial-handle=2352,i,9532077351811744931,7514923477246457656,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
      4⤵
      PID:1204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2026-09-06_4a7e83f217e9bce73c7da5c645e994d9_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
    3⤵
    PID:1216

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
Size 2.8MB
SHA256 4ca24aca50e205d0f0da6a0f10ea43995bf08ceffdf2eace8ec71fa511ef2bfc
MD5 89acb325dc59663c1916715edb2f2917
SHA1 844ee8b721cdba88fc160221cc88e65c88a11f90
SHA512 0a2731f8df8d38bfb7973d56bfefd33b59e61a96f17dfcf5c784cd31dba3bcf4b4e52409008a366d18f6faad2ae47288ef4e68ddcb50afabf9298a2d14a63db6
SSDEEP 49152:SDvwZ2XuTjPb33g9gZLfCdW9HTlXrk9dBiDvwZ2XuTjPb33g9gZLfCdW9HTlXrkX:8I4Ds9OII4Ds9OF
TLSH
T170D56B03F29900E9D059D1B8C7568536EAB2BC450B34A6EF0B90B6552F3BFE46B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXF8F4.tmp

Path C:\Program Files\7-Zip\RCXF8F4.tmp
Size 377KB
SHA256 e30cd794451d0e1de23257cc3d940a0ede156022bc6f5b219c3038ecb9622baf
MD5 d40d909b435aaca8ba0874277c1cbc83
SHA1 b8e2457b837c947721c0794e9cf2b5eb25ce31ea
SHA512 38154c150a4dcf44f2534ed639535820d1c5fd26118caf16ab7f20a23ddf1196662fd29b5ac53a7451e54a08cfd1b21b05628e7357c8a9f93a2d6c76ce2a3bc4
SSDEEP 6144:p+GYnA0zeWsDi5rJzip8kd3f+RysMFZzN/E/msHOtbMrbqNsarw:pYyDi5rNipDuysMFZzN/E/msumX7s
TLSH
T177848C06F75408FDD49BC57489964596DA39BC8B0B72EAEF17C8422A2F337E08E39750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18a644ba613d5b4137dabc346f57eca622b6888922eaec751025ab3c0a002fd5
MD5 5eddc74c05def624cfd47ea0a7e304a5
SHA1 b5f795fcc3846bb781e66e0373fce119975b2659
SHA512 1c777d774c154e89b80817ce7344495d83eecf133c36e0ad7c60dd14d76e628697535cc3fc379ca4eeb776f3bea5096f94d0fd76a2394ecd2e52f5ca8dc0053f
TLSH
T133D09B5672455C4CD641343224E55217E3008821654546194353F0768DD668717ABD9A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da739d58d61b2ac7b5d9bb7ad60982cb15b364d9c7c9297fd0c9719c271cd985
MD5 2d2e0ac0da9a175b4b6a8be7c9d51cce
SHA1 ff15c8a5ff11faefae3f7491c7968a2163702b81
SHA512 0ae78f15909f04e1a81109917b8eeb5b8062a49558d8a40f15c02076b087f36e82b88b329e9d984fc68c62cb15408123b9db7f705f2745bfefc30b5aa2e164e6
TLSH
T1EAD09B5A72455D4CD641343224E55217E3108821754546194253F0768DD668717ABD9E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d315b04e18a1c3326b30ee95c834daaea788a9873c68ad7d3e565b9a5d767412
MD5 a6f8b6ce707249e3f8791715cac292ff
SHA1 075e57cf3eb11025accaefb818eb24fe91b61160
SHA512 8a3be587397eca9cdc0c78cd7070333139b1dad6c573f6694345f7fefea2749d315105ab16f829546b4ada52d116735d032eaeb5bc4391d329933cc12dc3ec79
TLSH
T17171C6B1636209D1F729AABF24D2D41B31F4BA59553F2E205288AF702E06F3490DC07B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599f24.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599f24.TMP
Size 3KB
SHA256 571997eca8faf3c93a3af7ee7b457e74f07dd1876e5785397d1a20fe7070b870
MD5 f48ed9351ee22fef6733fde69440f686
SHA1 407b2ab07840356fd482a505e1cb1fad2ec667b5
SHA512 75fd8478c06304883714b014f808a690af8ef76222d95323fb2567fc24334daf0a2786e5edc0675a7eaa46785550e7f641c11975972011f812365765f7ccc6db
TLSH
T1256195B1532219E0F329A9BF24E2D04B32F5B646593F6E241688AF756F06F3590DC07B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b24e3453223c9af1e76d2a792acf70798688119f2d6be4b5b2d7748630c6b260
MD5 1a15be715f7666df89cd2e36dcffc8a3
SHA1 8099b30bbbbfc0c41e2c9e65fba14e40312e62e9
SHA512 35f5e47bc184a227a067b3582465d5bd0685e38ef3be47b32231d1e8a71ee1d424c495e0dc3c85e2309c24972f90838986c96745c15b8af76ff2e4175a03a159
TLSH
T1FF51BFF783F4856E8E01A6F0AA14AF2FCE2D0511431C7D5989D0AE27D3E3472E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 aefb0a2e6b8facd95a0ab0407d3fc79966888050f2a477dc8e3052b0f6e8a584
MD5 57877e1b5527e12d223aea025461eb34
SHA1 4a41e68c0723a638e133bee1ff5626d1c0d5ac4d
SHA512 19429be6f844585354824872e38202c31446574e8a9624ddfc77d99215b77c39fa7b72966c5303708f5ec1dbb6bd620bd8cfd4201e53aa15bae771ee0c22b86f
SSDEEP 192:sxR/Rq7C1/fssZvy0dYCbw4zoA8p9t/g6+WNB3U/AlEhaXa3hG97IgVIJ:sxR/AO1/fssZa0PqH/5u/72C
TLSH
T1B342C8166D68A93B9CC7D21DFA55BF63D6F91033A0911F48EAFC8A1C04E7ADD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 00867ef7244ce8524bfe28ddea9904ba183b0e277ee51b7ae1dbdd9480b70601
MD5 576c11e31a39920d7cf9d5e025a523f9
SHA1 7abef5943556fc1b7d512762a2f8de8ccd651b14
SHA512 4884b2bc425b0945b5276f9da53ebd28efb5444d5b0e36c322594ecfc8798da6dc4d569269c2fd724df47ad20816f2402d672f3f5a79c706538171c2a2f35cfc
SSDEEP 192:sxRQRq7C1/fssBvy0lPZzajzoA8p9k/g6+WNBYffAifznaXs3hG97IgDRDDfJ:sxRQAO1/fssBaIRzvC/52fZ2X
TLSH
T18F42C956AD68A97B9CC7E21DFB55BF23D2F95032A0901F44A7FC8A1C04E7ADD620340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e94c7406def36c6e7359d3670bdece5e474a92d7d5fe1c9ce1f1b7b817faa8e9
MD5 51ded51902c85465ed9bcb0ba1a6f713
SHA1 c3ece6c1ca25b27e443a81db2a1efcd1a15a36ce
SHA512 03821ce0dadb502d2cb4aa4e96ec43268c1eca614ad935e065b63da195577ca3f46a2e838a5c3ba564377ed2edb83f85ca6785705fd1f3224c96b1d4a444ec91
SSDEEP 192:sxRQRq7C1/fssBvy0dPZzajzoA8p9k/g6+WNBYffAifzeaXa3hG97IgDzDDfJ:sxRQAO1/fssBa0RzvC/52f02h
TLSH
T1E642B956AE68A97B9CC7D21DFB55BF63D2F95032A0902E44A7FC8A1C04E76DD620340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b47782eb7466f50842f05e5ac3e368359537a24478946b7120a5b13c1789d4a1
MD5 e9cd1962a72a7f30bb57a9b9ff6b5ab4
SHA1 e356d5adef3964dfb85120926d4c7e7664020eca
SHA512 b08d8a5694b1d55decca0b12e91ba025c055cb0c76a98beb4b02ff7525b998bf82c55c5072c156552e7632dcc67809d4b1274658f9b20c763e80571d49cce573
SSDEEP 768:40Dk6DJQD8AF7pLuL7N0DbWgQ6DjfIQDF8F1+UoAYDCx9Tuqh0VfUC9xbog/OVgK:40Dk6DJQD8ATE7N0DbWgQ6DjfIQDFu1x
TLSH
T117C2DA7B640CCB7F4F804ADDAD197A8A6D6802CB96D8CD8047FE991C02C7BEE51154DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e6849922-ea2e-4f37-836e-9fef14646487.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e6849922-ea2e-4f37-836e-9fef14646487.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 2556462cbd3e351206ccf9c5d66fbdfeca316175bb6f66561e09e7791e69c320
MD5 c5bf009ae89cf536581059fea352031a
SHA1 70da4b16098ffe247baf3b60a8cedd7ed3e48283
SHA512 89c3b4041b1d8ab850761915462bd93e3f30f8322e4a3ff8cedd9111f7e9c89d008f4b2affa660a9d0a10062972a4a838bfbff0c2d9b88bd57923cb57c256601
SSDEEP 768:Dh3VYbr4DTd+ZdeX6+qTko0u229a4vsTKcTRYg:Dh3VasvVTVKa4zcTRYg
TLSH
T158F2C072ACA58D7348EAD38476173653AEB520B385C81E44E5EDAF1D0047B6D2B4FC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 1f968ff9f06f6203d54616151e64a0fad697d22008958337838ddf2a967302cb
MD5 5dda22cf3b571e6ec0607ffa6e4b64bf
SHA1 672ac60e58bfaf8942672d9d8a89aaf58d56d068
SHA512 f6c4cb5238b1d951111917ca5f8b60ba989b6c8bb17cb2fda57f092850d96baf3bd15e4590aac6474fb2bc8dce7b4e46dc4f4b4220fd73452b4601146da04544
SSDEEP 768:qh3eYxEDTd+ZQeX6+qTko0u229a4vsTKcTRYg:qh3eE/vVTVKa4zcTRYg
TLSH
T19DF2C072ECA58D7348EAD38476173653AEB520B385C81E44E5EDAF1D0047B5D2B4BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 a93180967a56d8b9bf223335151fbec4d6d3aa4caa529e69b443b46a92935a8d
MD5 1756001ad84dced2c623848881ed91d0
SHA1 8e78f5f0bd8b9c3f3e76abeece033d6cf2fca9a6
SHA512 d818f8de54987be816813fd6df358830b35a3fa4584aa788361bf5fa5f2d9c33da2b81fc1a1fd8ebdb97f951d0f9ea0a98ffc79503906041f01e22fe0de3c7e4
SSDEEP 768:jrv+4UNbdG3j0KDTd+ZHeX6+qTko0u229a4vsSKeVH1SdW:jbsbU3iWvVTVKa4sEH1h
TLSH
T10703CF32E8698D334CE69784B14B36477FB820B385880B84D9EDAF4D064769D274FD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6e08323fb673e119d4504137f8af6edbe63bc4f36a264daa60b914d4459f84bc
MD5 fd18f8fbd90f5be1eb2b2f3d38d1a7e6
SHA1 ce23b6c23594cdfd362e3d1aac3cc414122aaa4b
SHA512 6a2b7263c926c42b96e69723afaa30069cc6d3142e8678b2d635ec4630a3510de550eb32a5c546bb6bb7a9019b48cd3d546765cdf5e991bbc5a3f72453f54a62
SSDEEP 768:mFH+31wgTYbrynZReX6+qTko0u229a4vsTKcTRYg:q+3n5gvVTVKa4zcTRYg
TLSH
T1D2038C72ECA5CE7B98E6C7C5B7163647AEF110A385CC99C4EADC9E0D008769D170AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6470e77d9947f49b4c32d83c1540e5480a3a547063c4db893ac32444d4e8b3f6
MD5 310c70859c70cd28e636226fbe66d9d5
SHA1 4f13862d23ac7e8bd4b05232e2dd5491e134cb2a
SHA512 f53db57115b45889792f14c8fad7ff4b101bfb6b0d98842d1496a0c0a4cfc9c488f57b1c83f4e5a5ffeb75f4c9c7f1f5453f45181f57de177df2169ae23901ad
SSDEEP 768:2rv+4UNbdW3iYcEDTd+ZveX6+qTko0u229a4vsTKo/:2bsb43iRuvVTVKa4zo/
TLSH
T1BD03BF72FC699D7389E6D284B21736537FB420B385C80A84D5ED9E0D014B6AD2B4FD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 1e209c95505ab18be1fb7b14fd05d10be9aed02da8579f864664b64a1e4d7fb8
MD5 05844ee1ef03f9c68ee9564ecb617862
SHA1 0a36c7d438adc88b03027eefb95a51453f88ecdc
SHA512 17b863554fd14393e5c21f5f7a948d6a6c13a4c53817bcd8004e0ad3dab45d294c7438672ee43b62688ffa1f8b12fc209beb0b299a5c312e1b093f4756129d34
SSDEEP 768:prv+4UNbdG3bxoDTd+ZjeX6+qTko0u229a4vsD+eVH1SdW:pbsbU3DivVTVKa4bEH1h
TLSH
T1A503CF33E8658A778CE79784714B75173EB96163C6D80B80D9ED6F0D068B5AC230BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

93100432-0c87-438a-9711-177b25b452c5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\93100432-0c87-438a-9711-177b25b452c5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json~RFe594491.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe594491.TMP
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

2026-09-06_4a7e83f217e9bce73c7da5c645e994d9_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe

Path C:\Users\Admin\AppData\Local\Temp\2026-09-06_4a7e83f217e9bce73c7da5c645e994d9_cobalt-strike_glassworm_icedid_ryuk_satacom_stealc_vidar_xworm..exe
Size 949KB
SHA256 d1cad25d64fee3c7c7b4608a76ef07516ea2bde5ac4b521602993602317ce659
MD5 f46edc74449dbff174a4c03462e577f2
SHA1 fe0b86000bd11662f87c0a2d2248378acf046931
SHA512 f7cacaddbbf3d79d0adb196780f4ec9036fd97e5478f949f3841ab981c8cdbbdc788e6c2a34cdacb78dd98dc18c37b633199a50baf3dac84d26551945eb8c647
SSDEEP 6144:ZE/msHOtbMr/VbxfQaI9VHJZhzrJ2tqmbycEiuor:ZE/msumLV9orQtTzEiuor
TLSH
T16225DD48A7F90635F5B20B30ACB9A58175F7BC179D31C39E115D117F4AA3A408AA3BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3167aa17-63fe-4c15-9a1e-69d27c87bf28.tmp

Path C:\Users\Admin\AppData\Local\Temp\3167aa17-63fe-4c15-9a1e-69d27c87bf28.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

029478413487.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\029478413487.ico
Size 1KB
SHA256 d70944fea4517b3b68ee043da9e5f8cd1ab6559e98666ea93ed7468254ce0785
MD5 aea8653be6803940e5f5017482ed8f31
SHA1 83d770a087be76863aca353d9e394c29b126874a
SHA512 192e1f7ceebdf78cce0e32a6162790775fa8210ae4fa4210547f93ea059d592a04434030a3c69e03094e9931dc0952173c4772a25a0c1b20464314c14990f71f
TLSH
T1492167C47ECCF9ECC5D84172F1408ABF808B880210E09633816BFB62ED1009104DBB7A
MD5 SHA1 SHA512 TLSH

Submit Download

210999094126.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\210999094126.ico
Size 1KB
SHA256 fe526d6535d43c577cf54d22f446498ad613635860a6300f5b7654765ee9b929
MD5 1e584fe5a5d9ab1880f2dbc475aaf5e3
SHA1 0a18f23ef372593dee476bb852745b2490bc8421
SHA512 c5db0686030e1dcb5297c3174fed0f75f3c84ab2ef9a6f3f4b60802049dd0e5c21f9182e2d723f666948c9d0cef1441b890539ae662efd0f71957b0b56012bdc
TLSH
T1AD219851F19E78C7F42252B4CD11535B46C557456DB18311A0B18D2C3E718CC14145DB
MD5 SHA1 SHA512 TLSH

Submit Download

287788168651.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\287788168651.ico
Size 1KB
SHA256 3568edd042f59b52c726b5ff682e65fcad53b953397e49838bd017f730436f9d
MD5 4a3be9e27a938152348d20edbc4c08ee
SHA1 1128ce0b28864c359a424ca0e0d2350de111cf89
SHA512 a0669f50668e3cc7555f88a100a3f947a42c3d30c42c66b9e3b871f54830768238ca19e62082f5b9b217f0ae3a507966f0370b5cda76434f8581e6cc777b00e7
TLSH
T15821BF370D209559E6A8D430430A797B146DF842A3BC18C723C1AA8EBE67FF231786DD
MD5 SHA1 SHA512 TLSH

Submit Download

408892856625.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\408892856625.ico
Size 1KB
SHA256 c6ac3a2d4ea590ba6a624de69c86e20852b72c71cc7724a3ff4577fb15b32b2c
MD5 53dd1bca3d1d23e9c8548abf4ee8d45e
SHA1 13470460552d9f4c465130d654b2095316b22854
SHA512 4ea4d797fab4510df9ee507c2da9764863b0ccd518b2b33c8a7b35871daccf3dbbe5566ac62426dc45419cb108432fab0f042a54e66b66bc3db32bc1f46d7a31
TLSH
T1212149662BA57D70FA890CB380E181DC9D7CB181A6B3DD49D6FD1E523F012D14A788CC
MD5 SHA1 SHA512 TLSH

Submit Download

469258810678.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\469258810678.ico
Size 1KB
SHA256 325e37428cb5578f7f88dcc924a6a2a398d707d3cad6406802a9a06aac630126
MD5 cb4265d1bed8a3606c50c3ace6452c94
SHA1 fab9b5c1c0138c5a03848f1111a61a97d9efe6cd
SHA512 93f7872007f873a5c7838af267caba5e42e0cb7ecee4833a762ea1d5ab755fae4a750e269a961885c782123e471989c4baba00d9de90f66e2948b28ec08535b1
TLSH
T11D219E9C68A19F0EC7D050700135771559EA8D0F55655E2B500CBE0B3DE56C438D956E
MD5 SHA1 SHA512 TLSH

Submit Download

592359867966.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\592359867966.ico
Size 1KB
SHA256 bc1363b69ec13c49d94af754cce4bffe81b589f3bf2039c84bf1472b3b483f6f
MD5 3d272e20bb157f11d4ae75abc33aef1a
SHA1 d7412ac8cc848ecc21b00fe10227eaa33935cc73
SHA512 7c1d692afca057778c3ab89b888ecd234c99d5a93c3d3797aa18bc3de8b2647efd00e2a553fb3bbbf10ab08c21750c462efc14b3f41d723504050d84e1dc2155
TLSH
T194213F806E6ECAF4C4000130CB4E9FF10968AC02F8501203A371BDBFFCB9754E41A668
MD5 SHA1 SHA512 TLSH

Submit Download

593500050298.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\593500050298.ico
Size 1KB
SHA256 80b6b561da261f5549cc3f1b3baad5efc025770ce206b0250977dbab229fe4d7
MD5 d91c5d1ab9c7e29648ace11bcb875f98
SHA1 7930fbe299b30d4b4bf13b5bd6aa93bce3d4c15a
SHA512 bedf38e398af1bf847b65d67421f1c1050c937ba9dfaebd62106263592f46a5d67a49853bf61df2094df49f02e7b4d695b05c3a7734a07dfd4d148b179f0d426
TLSH
T1ED21ED352B18C8E4CC12923082872AF7496C6CC3E5F4E45760F17C6EEF67FB1A522666
MD5 SHA1 SHA512 TLSH

Submit Download

717117960902.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\717117960902.ico
Size 1KB
SHA256 06d58ca32d62202496baef4f3dec37ee2cacdb5775341c6fb4cccfa4448a03f9
MD5 1af3523517c4a23a831af16191e71ba5
SHA1 34674885738a8717def95b016697802778f0d520
SHA512 f9c3b8c2eda242dd58aca7170caee4ed275d0ad4a7de9c0fb303b06837e99ab4d00f3a235f3e929621cc23e8c9149e32f6d7d4bb24cd54f1b327eeb3c51151a1
TLSH
T1B521274FA7C27B9CF9D8113DD1762B9139086DA58AE0C89B1A887D13FAF204510DC36D
MD5 SHA1 SHA512 TLSH

Submit Download

730173066569.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\730173066569.ico
Size 1KB
SHA256 6573d3579ab0ce71f8d95d6a89d2a4d75f6bbe31a6861ab5b8002ddedb76a477
MD5 bdc7cdea596ddc3d6542f6eae40a3509
SHA1 562637184de8add47b602c9f25c0c1f3cef3b7c9
SHA512 3fe9b8a0544163812cbedfc07fd76daa9aa8b8d59bf799e87ecdda796641b80c5f4ac7d1297dc0ad06855282289c75405d41c8ec1892e0da0a56ffc3b6781112
TLSH
T16D21658A76C1DAA0C8051B388C9B2FD32C7E2C4FE948774B344977025DB0AE2951592D
MD5 SHA1 SHA512 TLSH

Submit Download

836453067580.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\836453067580.ico
Size 1KB
SHA256 b15cc5b7b654156b96c718da8c6a5402aa2d7afab332ec98038ce8a6b6efd052
MD5 eacc2d68b6aac8c25d01a76fd292ebf8
SHA1 90bae45731dd564088bf7fce380e39266bea02b4
SHA512 ad8760c2c91c46238f9b80f85074ae3574bfe7bdb0d2b9ac85e94349e82d5d70f2adc6762beb07d0747794a571febd96bf5e08ea9b3bc44bcd789e0d0043c3a2
TLSH
T18B21A459BA5CD77BC0653330D5170BF529709D01D86D472FB7053E8AF8B4A0409D9994
MD5 SHA1 SHA512 TLSH

Submit Download

847662302873.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\847662302873.ico
Size 1KB
SHA256 69868f3977849e6f0726f505ed8ce7ffaadd07268f061d3705980aa32ba74885
MD5 81e2b09e1f33b8c702aed3d14d341a13
SHA1 91b406871c7ef167179bd7136b1fbe66110c03ae
SHA512 d1ab21ea6cdd0795f8b30e0d548b2a01085b40f455b477a513dc4b813d0a39bf27783c31e5fbf2372b14815f4fc8f4765fb298bed5eecae6f126b2de81d32094
TLSH
T151218BD1B950E8A6D16F8E749CF1583160F247EF4FD1101852A8BB20686CAC3411BCFA
MD5 SHA1 SHA512 TLSH

Submit Download

859949414771.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\859949414771.ico
Size 1KB
SHA256 99143e3c977916ae0bffcd76fb770cce778f63459bf49ab42b639bb4da8555c6
MD5 1242320e51856e417a3b897993ed3862
SHA1 1a8e37c65a34144d55e135dbe5c80f1d3cb54995
SHA512 7e362214be096890c16bb2d19ad6119d8e441b25995221a02e10a9a7bb62b83f10f3df8b5e20444ee2c068fca8153097f12d098f15f71ca550121a6642e5f425
TLSH
T14D2112C4FF993060D8D9F735F395AA0A5766F2C298A40684105DFC69BCB84247847E39
MD5 SHA1 SHA512 TLSH

Submit Download

894285758797.ico

Path C:\Users\Admin\AppData\Local\Temp\PROGRA~~1\894285758797.ico
Size 1KB
SHA256 2ea5c025b0613b1a20bc146508cf692b5de4d285f7acc17dc4035315952fd7f8
MD5 6ed58acd10d2c394c7638d5e4d4e4d04
SHA1 665abe2fa6f4c84fb6925d64f75573ab030189c1
SHA512 61756eeefd0222af1d0c5ffdbc1b6e428e7cd40153e75dcff5d62851f56d1735017cde22304d14b0ba8c9222e6f42eb471b90c1053290d4ec3c935af071475e5
TLSH
T15B21981123965B4EDD2527315003071BEBF61427A0EE233554B2CA0DBE5512D5F3F335
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5796_722271042\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

audiodg.exe

Path C:\Users\Admin\Documents\diagnostics\audiodg.exe
Size 62KB
SHA256 76957a7db92abf1667474a4e45477cea7297e9a25c78c1fadd94795fc5390833
MD5 9367eafefd3471a59df9ee9ffa198573
SHA1 e944938360ba8825ba0bed160c74d7985a6bc833
SHA512 a1ac5d7c0429a9f2e968a94433547c672f9d060257cb66857c265b28a6783c8abfb7ba400495c50ef0c1c9b1a8a4fc209eca57b086f99af8d3d5af5d05a94b4a
SSDEEP 1536:QAw5A/msOFA3asSkD6nFHbAVecYpVwaExJO1EA+Bdd:QE/msHasdDOFHbAMCaExJO1Ebdd
TLSH
T1A2537C18BBE54129E5BF6FB159F13276DB39F7635903862F28C5028B1A23E85CD006F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shost.exe

Path C:\Users\Admin\Documents\diagnostics\shost.exe
Size 375KB
SHA256 3aa91ce324a8eb71ff87087a5c00d25356753080f4b241a82e6254df9d8846d5
MD5 d510cbe8d3d803dd50f52bb92358c5eb
SHA1 14f1f2200e4ebab7620419c22a3dbb691f030149
SHA512 598e1b1bd084a8ab403977e5a8e6493236611042c165380b66afc165dc7cf71d39e9c2c10e2b777fdead01635dd74a07f2645947bef6afaa5253418dd191c791
SSDEEP 6144:j+GYnA0zeWsDi5rJzip8kd3f+RysMFZzN/E/msHOtbMrbqNsarw:jYyDi5rNipDuysMFZzN/E/msumX7s
TLSH
T1D7848D16F75408FDD5ABC57489924546DA35B88F0B72EAEF17C8422A2F23BF08E39750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logs.txt

Path C:\Users\Admin\Documents\logs.txt
Size 4KB
SHA256 5fbf191875921ac5b946de1eb18b6f7d28f2dbfe41fed6d1163841aa81d94884
MD5 e0dd683cb8892d513a68b80b62d8f40f
SHA1 4d6924c0f4db7ecefabb1cf2018a0e6f53e099f4
SHA512 3b987b0b3763467e1c51acba5f1d89493b4c63d5f99ce42209e84df2d5f07913a7b2c65b39a9941f62056c9ae29dd97255222d9f11ded1af915211baedc1107c
SSDEEP 96:2mW5WFWrWdWAW2W3FW3oZ8ZpRU8VPmPr0ofwGbIE:2UwbD
TLSH
T1A09176B1DD45C285732331842F113D01279F8C896B4D80AAE78C97CBE8D9A999E5BEF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3580-562-0x00007FFDEF740000-0x00007FFDF00E4000-memory.dmp

Download

memory/3580-222-0x00007FFDEF740000-0x00007FFDF00E4000-memory.dmp

Download

memory/3580-182-0x00007FFDEF740000-0x00007FFDF00E4000-memory.dmp

Download

memory/4500-1938-0x00007FFDEF740000-0x00007FFDF00E4000-memory.dmp

Download

memory/4500-1965-0x00007FFDEF740000-0x00007FFDF00E4000-memory.dmp

Download

memory/4500-18-0x00007FFDEF740000-0x00007FFDF00E4000-memory.dmp

Download

memory/4500-12-0x0000000000510000-0x0000000000526000-memory.dmp

Download

memory/4500-10-0x00007FFDEF8CF000-0x00007FFDEF8D0000-memory.dmp

Download

memory/6104-4004-0x00007FF78CD90000-0x00007FF78CF0A000-memory.dmp

Download

memory/6104-3995-0x00007FF78CD90000-0x00007FF78CF0A000-memory.dmp

Download