ramsay | 20083f33f536e5385ff6a304986ef762a8f255e1d823aee5e8243fe74fa4cca4

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 20:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-16_794a25a81797829ff6ccecd1a6285510_amadey_coinminer_darkgate_elex_glassworm_manuscrypt_rhad.exe
Size 1.6MB
Sample260916-y2143ss1ft
SHA256 20083f33f536e5385ff6a304986ef762a8f255e1d823aee5e8243fe74fa4cca4
MD5 794a25a81797829ff6ccecd1a6285510
SHA1 37ed810d112e53d260d84e3d5d50b330cd32be6b
SHA512 acb46d4e21c39ba78b1b5c2bdf8f7d62403863f3aef70b5cf4b204fd6d0a253b94ef2ddaada8cfc03c0dcbc477e2bfe5b7f6e206f30c275893e36253bfa4807a
SSDEEP 24576:Rh+BWYp1/alj3DSudvGM3MXTVhtSQWGtxfbAI2+2DR7BWYp9po44HEOaBWJpB1:RhmbFoBdqTDtSQWGt5bAIE7VHiEOKeP
TLSH
T1F175B06123E80435E7B70B3A7D7E58514B36BC385A51E59E1A8E263C08F2B5789F2337
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

darkhotel apt defense_evasion discovery execution ramsay framework rootkit spyware upx

Malware Config

Signatures

Family: Ramsay
Ramsay is a cyber-espionage framework and spyware that collects documents from air-gapped networks.
framework spyware ramsay

Detects Ramsay payload 2 IoCs

spyware apt darkhotel

resource	yara_rule
behavioral2/files/0x000c00000001c57c-54.dat	family_ramsay_payload
behavioral2/memory/5720-56-0x0000000000340000-0x00000000004BA000-memory.dmp	family_ramsay_payload

Detects the HideDriver kernel rootkit component of Ramsay 1 IoCs

rootkit apt darkhotel

resource	yara_rule
behavioral2/memory/5720-56-0x0000000000340000-0x00000000004BA000-memory.dmp	family_ramsay_hidedriver

Detects Reflective DLL injection artifacts 1 IoCs

resource	yara_rule
behavioral2/memory/5720-56-0x0000000000340000-0x00000000004BA000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs

resource	yara_rule
behavioral2/memory/5720-56-0x0000000000340000-0x00000000004BA000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

UPX dump on OEP (original entry point) 3 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c567-15.dat	UPX
behavioral2/memory/5720-17-0x0000000000340000-0x00000000004BA000-memory.dmp	UPX
behavioral2/memory/5720-56-0x0000000000340000-0x00000000004BA000-memory.dmp	UPX

Executes dropped EXE 4 IoCs

pid	Process
4684	cnwqbikblm.exe
5720	jbndzvfuvr.exe
5004	2026-09-16_794a25a81797829ff6ccecd1a6285510_amadey_coinminer_darkgate_elex_glassworm_manuscrypt_rhad.exe
3472	bindsvc.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe

System Binary Proxy Execution: Verclsid 1 TTPs 1 IoCs

Adversaries may abuse Verclsid to proxy execution of malicious code.

defense_evasion

Verclsid

T1218.012

pid	Process
3884	verclsid.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wideshut.exe	jbndzvfuvr.exe
File created	C:\Windows\SysWOW64\wimsvc.exe	jbndzvfuvr.exe
File created	C:\Windows\SysWOW64\racfg.exe	jbndzvfuvr.exe
File created	C:\Windows\SysWOW64\bindsvc.exe	jbndzvfuvr.exe
File created	C:\Windows\system32\msfte.dll	jbndzvfuvr.exe
File created	C:\Windows\system32\oci.dll	jbndzvfuvr.exe
File created	C:\Windows\System32\bindsvc.exe	jbndzvfuvr.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c00000001c567-15.dat	upx
behavioral2/memory/5720-17-0x0000000000340000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/5720-56-0x0000000000340000-0x00000000004BA000-memory.dmp	upx

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2356_1281480584\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2356_1281480584\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2356_1876724432\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2356_1240877025\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2356_1240877025\protocols.json	msedge.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3812	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4204	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-16_794a25a81797829ff6ccecd1a6285510_amadey_coinminer_darkgate_elex_glassworm_manuscrypt_rhad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cnwqbikblm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jbndzvfuvr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bindsvc.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3156	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007acd637b1846dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e0d784b71846dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000023131b771846dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c62a03b81846dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003119b58c1846dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{63C59890-D37A-49D7-80F4-049EC61DBEE0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5720	jbndzvfuvr.exe
5720	jbndzvfuvr.exe
4716	msedge.exe
4716	msedge.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid
4

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	5972	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5972	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5972	SearchIndexer.exe
Token: SeDebugPrivilege	5004	2026-09-16_794a25a81797829ff6ccecd1a6285510_amadey_coinminer_darkgate_elex_glassworm_manuscrypt_rhad.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2356	msedge.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 4684	5000	2026-09-16_794a25a81797829ff6ccecd1a6285510_amadey_coinminer_darkgate_elex_glassworm_manuscrypt_rhad.exe	87
PID 5000 wrote to memory of 5720	5000	2026-09-16_794a25a81797829ff6ccecd1a6285510_amadey_coinminer_darkgate_elex_glassworm_manuscrypt_rhad.exe	88
PID 5972 wrote to memory of 4092	5972	SearchIndexer.exe	90
PID 4684 wrote to memory of 5004	4684	cnwqbikblm.exe	91
PID 5720 wrote to memory of 5216	5720	jbndzvfuvr.exe	92
PID 5216 wrote to memory of 3812	5216	cmd.exe	94
PID 5720 wrote to memory of 4204	5720	jbndzvfuvr.exe	95
PID 5720 wrote to memory of 3472	5720	jbndzvfuvr.exe	97
PID 5004 wrote to memory of 2356	5004	2026-09-16_794a25a81797829ff6ccecd1a6285510_amadey_coinminer_darkgate_elex_glassworm_manuscrypt_rhad.exe	98
PID 2356 wrote to memory of 4448	2356	msedge.exe	99
PID 2356 wrote to memory of 2256	2356	msedge.exe	100
PID 2356 wrote to memory of 3156	2356	msedge.exe	101
PID 2356 wrote to memory of 2256	2356	msedge.exe	100
PID 2356 wrote to memory of 2256	2356	msedge.exe	100
PID 2356 wrote to memory of 2768	2356	msedge.exe	102
PID 2356 wrote to memory of 2768	2356	msedge.exe	102
PID 2356 wrote to memory of 5824	2356	msedge.exe	103
PID 2356 wrote to memory of 5824	2356	msedge.exe	103
PID 2356 wrote to memory of 5824	2356	msedge.exe	103
PID 2356 wrote to memory of 4572	2356	msedge.exe	104
PID 2356 wrote to memory of 4572	2356	msedge.exe	104
PID 2356 wrote to memory of 4572	2356	msedge.exe	104
PID 2356 wrote to memory of 1432	2356	msedge.exe	106
PID 2356 wrote to memory of 1432	2356	msedge.exe	106
PID 2356 wrote to memory of 1432	2356	msedge.exe	106
PID 2356 wrote to memory of 1568	2356	msedge.exe	107
PID 2356 wrote to memory of 1568	2356	msedge.exe	107
PID 2356 wrote to memory of 1568	2356	msedge.exe	107
PID 5972 wrote to memory of 476	5972	SearchIndexer.exe	108
PID 2356 wrote to memory of 1860	2356	msedge.exe	109
PID 2356 wrote to memory of 1860	2356	msedge.exe	109
PID 2356 wrote to memory of 5900	2356	msedge.exe	111
PID 2356 wrote to memory of 5900	2356	msedge.exe	111
PID 2356 wrote to memory of 3824	2356	msedge.exe	112
PID 2356 wrote to memory of 3824	2356	msedge.exe	112
PID 2356 wrote to memory of 704	2356	msedge.exe	113
PID 2356 wrote to memory of 704	2356	msedge.exe	113
PID 2356 wrote to memory of 4064	2356	msedge.exe	114
PID 2356 wrote to memory of 4064	2356	msedge.exe	114
PID 2356 wrote to memory of 4064	2356	msedge.exe	114
PID 5972 wrote to memory of 3752	5972	SearchIndexer.exe	115
PID 5972 wrote to memory of 5892	5972	SearchIndexer.exe	116
PID 2356 wrote to memory of 6668	2356	msedge.exe	118
PID 2356 wrote to memory of 6220	2356	msedge.exe	122
PID 2356 wrote to memory of 6220	2356	msedge.exe	122
PID 2356 wrote to memory of 6356	2356	msedge.exe	123
PID 2356 wrote to memory of 6356	2356	msedge.exe	123
PID 2356 wrote to memory of 6784	2356	msedge.exe	125
PID 2356 wrote to memory of 6764	2356	msedge.exe	126
PID 2356 wrote to memory of 6756	2356	msedge.exe	127
PID 2356 wrote to memory of 5456	2356	msedge.exe	128
PID 2356 wrote to memory of 5456	2356	msedge.exe	128
PID 2356 wrote to memory of 2632	2356	msedge.exe	133
PID 2356 wrote to memory of 2632	2356	msedge.exe	133
PID 2356 wrote to memory of 1760	2356	msedge.exe	134
PID 2356 wrote to memory of 1760	2356	msedge.exe	134
PID 2356 wrote to memory of 4716	2356	msedge.exe	135
PID 2356 wrote to memory of 1780	2356	msedge.exe	136
PID 2356 wrote to memory of 1780	2356	msedge.exe	136

C:\Users\Admin\AppData\Local\Temp\2026-09-16_794a25a81797829ff6ccecd1a6285510_amadey_coinminer_darkgate_elex_glassworm_manuscrypt_rhad.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-16_794a25a81797829ff6ccecd1a6285510_amadey_coinminer_darkgate_elex_glassworm_manuscrypt_rhad.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Users\Admin\AppData\Local\Temp\cnwqbikblm.exe
  "C:\Users\Admin\AppData\Local\Temp\cnwqbikblm.exe" "C:\Users\Admin\AppData\Local\Temp\qrivszxzmf.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-16_794a25a81797829ff6ccecd1a6285510_amadey_coinminer_darkgate_elex_glassworm_manuscrypt_rhad.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4684
- - C:\Users\Admin\AppData\Local\Temp\2026-09-16_794a25a81797829ff6ccecd1a6285510_amadey_coinminer_darkgate_elex_glassworm_manuscrypt_rhad.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_794a25a81797829ff6ccecd1a6285510_amadey_coinminer_darkgate_elex_glassworm_manuscrypt_rhad.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://apps.microsoft.com/store/detail/9WZDNCRFJ27N?ocid=&referrer=psi
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2356
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x350,0x7ff82d37c188,0x7ff82d37c194,0x7ff82d37c1a0
        5⤵
        
        PID:4448
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,10656787190799624519,17207757342092070443,262144 --field-trial-handle=2244,i,5373095105020135901,830555626476690166,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
        5⤵
        
        PID:2256
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,5023431209870141550,11444504105143112667,524288 --field-trial-handle=2244,i,5373095105020135901,830555626476690166,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:3156
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2256,i,1555762414451628294,2024702868971258969,524288 --field-trial-handle=2244,i,5373095105020135901,830555626476690166,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:13
        5⤵
        
        PID:2768
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3612,i,14309907533684746558,13720200808130084160,2097152 --field-trial-handle=2244,i,5373095105020135901,830555626476690166,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
        5⤵
        
        PID:5824
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3636,i,2440660137327564410,8272841387319129172,2097152 --field-trial-handle=2244,i,5373095105020135901,830555626476690166,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
        5⤵
        
        PID:4572
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4308,i,2351058747890142562,11812186907083616516,2097152 --field-trial-handle=2244,i,5373095105020135901,830555626476690166,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
        5⤵
        
        PID:1432
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,4287986692989216112,12433292311876341808,2097152 --field-trial-handle=2244,i,5373095105020135901,830555626476690166,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:9
        5⤵
        
        PID:1568
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,17872012077740067316,4396912392205453791,524288 --field-trial-handle=2244,i,5373095105020135901,830555626476690166,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:14
        5⤵
        
        PID:1860
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3604,i,4063264012638494240,18282582883650684986,524288 --field-trial-handle=2244,i,5373095105020135901,830555626476690166,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
        5⤵
        
        PID:5900
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,522639210074871776,14033843777894535427,524288 --field-trial-handle=2244,i,5373095105020135901,830555626476690166,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
        5⤵
        
        PID:3824
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,15687604707680350385,3573065520214156880,524288 --field-trial-handle=2244,i,5373095105020135901,830555626476690166,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:12
        5⤵
        
        PID:704
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5800,i,2724317784547450653,13703642791444719723,2097152 --field-trial-handle=2244,i,5373095105020135901,830555626476690166,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:1
        5⤵
        
        PID:4064
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,2071036789538618488,4205213441539110657,524288 --field-trial-handle=2244,i,5373095105020135901,830555626476690166,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:14
        5⤵
        
        PID:6640
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,2071036789538618488,4205213441539110657,524288 --field-trial-handle=2244,i,5373095105020135901,830555626476690166,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:14
        5⤵
        
        PID:6668
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,1009742570189349026,350366107103451233,524288 --field-trial-handle=2244,i,5373095105020135901,830555626476690166,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
        5⤵
        
        PID:6220
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,9449772170930666837,8420387814371755520,524288 --field-trial-handle=2244,i,5373095105020135901,830555626476690166,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:14
        5⤵
        
        PID:6356
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,3635925825843302357,7575703629489448650,524288 --field-trial-handle=2244,i,5373095105020135901,830555626476690166,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:14
        5⤵
        
        PID:6784
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6752,i,10641069376097014608,14152876887823152271,524288 --field-trial-handle=2244,i,5373095105020135901,830555626476690166,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
        5⤵
        
        PID:6764
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,6367014897643093623,5413097425773018107,524288 --field-trial-handle=2244,i,5373095105020135901,830555626476690166,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:14
        5⤵
        
        PID:6756
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,2738744556184766004,6956352536375913506,524288 --field-trial-handle=2244,i,5373095105020135901,830555626476690166,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:14
        5⤵
        
        PID:5456
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,11622795303512288188,8418331640853158265,524288 --field-trial-handle=2244,i,5373095105020135901,830555626476690166,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:14
        5⤵
        
        PID:2632
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6848,i,7252982670467733904,5986822818157181137,524288 --field-trial-handle=2244,i,5373095105020135901,830555626476690166,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
        5⤵
        
        PID:1760
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6712,i,10684439087454939753,12325557930711731163,262144 --field-trial-handle=2244,i,5373095105020135901,830555626476690166,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:10
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4716
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,9819840228768512969,5770692219498068228,524288 --field-trial-handle=2244,i,5373095105020135901,830555626476690166,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:14
        5⤵
        
        PID:1780
- C:\Users\Admin\AppData\Local\Temp\jbndzvfuvr.exe
  C:\Users\Admin\AppData\Local\Temp\jbndzvfuvr.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5720
- - C:\Windows\System32\cmd.exe
    /c sc config msdtc obj= LocalSystem
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5216
  - - C:\Windows\system32\sc.exe
      sc config msdtc obj= LocalSystem
      4⤵
      Launches sc.exe
      PID:3812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\mdWCf6Zg.bat"
    3⤵
    - Executes a command shell one-liner
    PID:4204
- - C:\Windows\System32\bindsvc.exe
    "C:\Windows\System32\bindsvc.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3472

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5972
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4092
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:476
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 836 2796 2792 820 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3752
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 836 2824 2784 820 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5892

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6448

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {9E175B8B-F52A-11D8-B9A5-505054503030} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x401
1⤵
- System Binary Proxy Execution: Verclsid
PID:3884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

System Binary Proxy Execution

T1218

Verclsid

T1218.012

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.3MB
SHA256 1501ee9468a298497583e27ae68e8e26b0b8d225b0b038ead4ab785f1de753b4
MD5 f0f49f28c1d5abcb46156db010c4b838
SHA1 7c4366bf2cc3b5c85cc9f55414d0bd2bdf97ac56
SHA512 622705bd8352b88c31c9afc03d6d25d755ade915980fa877a10cdfde4dd9b560a1a1fda78c8bbd1e7ba436634ab3b91e3f30473c07c67eea0669511ad4b5b283
SSDEEP 12288:McLXDBq77y227D0WrlP6vKmpjdXPl5L2JBSilvi:MsDKc7DJm/d/lpQBSilvi
TLSH
T1135518107626CB4FC66D80325E32D1CCAB707D11EE056F0773C98B3F9576A59BAB2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 329KB
SHA256 6bb224b92d7c508a8375133ab575f585f04c4bc96e5da35e62e41fdec8715d2c
MD5 81cefcae2cede9b3df62767d209cc13a
SHA1 b6cf6fa268ac7d69a0da47bc461e0e95f07dc8ac
SHA512 cdc8085062de31fd9e93ad36bbc7044e6667fdffd3cadb102a66fc2141a996763f8b009f8e9717b437527bd2dc551632e26214b9abc5092e7df7e3f237118236
SSDEEP 768:QAlTGolTRxlTrdlTz2+EQMOAlTGolTRxlTrdlTz2+EQMtZNfLAlTGolTRxlTrdlX:OIzBPHYY0wCCwI0SfjBK
TLSH
T1A2746211B764B229C8B280B70870E6A79A3DF513CF1286463FC91D99DCF229B6776F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a0b193400a27c0cdf94ac11f5fb5b0747828b5b461169cefeffb96191b9e4834
MD5 edaab58c014c1abbfa900853b2ab2696
SHA1 e35eb02c0343d109af1ddd7dbd39dee3b989aea3
SHA512 b3cca7ed39fd4708b9c01cbefd67aab972f585372e01b5fa39d4a0840a7f579725d1202ab2916cda4e7635fb16dbc74178888461c7b6a2b3ea91d273ce2909ea
TLSH
T1BBD02B75F96ECC23E85204F940D24208329775818C0441812601CC080A603850000182
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 932f01682de6215b2c3b5faeb96a07b886e28db2ff6f8242a36da556c4292464
MD5 667b54168424526a7188593696f59ace
SHA1 deeb9f5ad1bccaabad57a386f08ba0c0740b2f81
SHA512 698f5a88d262c546b9bf21ead67e8dbe00ce6bd13f196761a5910f59ff69ca7532cacdf03c070f8d3b9f5d4fb8990b358e9b60ace9e48a0848e4a9da1d92b3ed
TLSH
T1D4D02B79F95ECD23E85204F540D1420832A77581DC04418125018C080A603850001182
MD5 SHA1 SHA512 TLSH

Submit Download

f_000060

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000060
Size 4.2MB
SHA256 4fbfe8a9866207d398eb91224dfaf8395de725f3a2a039f58a47c2589993352a
MD5 9df0ea85130c75d0b42546a8e013dfa0
SHA1 a8b3a1429b9a777ed81a763ff44fb92c5642fa90
SHA512 4373d46cfa3b385bd83cc27390114495fe3de527bb5addef0d58d194bf8d19d8491dc93312290fdc8b301e0ebdb206988795ee738c7feafff62a44e6c3b3586c
SSDEEP 98304:OCBh6wkNh3dRBVjVvfnQ85SkHaHoTmeXrzPaWOvJSGc:vh6wOdLVxvI85Spo6rXc
TLSH
T19A1633F222810507406FAFC30F1E3D758E3662A5D2BAB7673997B617BD0D8D1ABE0644
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000061

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000061
Size 4.7MB
SHA256 3036f4eef21e6a352ad641c7a58222cf8bc8714ab7c09f8d47e51ea7fbeb2fcb
MD5 a97e98a843221e27d3a13f7a32875748
SHA1 67823fec43eeb4cc1d192aeabf5417dd0e51d507
SHA512 d0f759a809864d0d2b034585bb85191275d4f62d7df4c507f3bbbdac31eebec3acb7c808b49f46ce2e0e8233f9abda9abf4c3287aa8811faeaf4af18efa08b05
SSDEEP 98304:FCasP+jN1cu2BFPGqZeKGEYWGSCrjBRP1uqrzOXyNsuKkB7VqAWkUs6ECN:casP+zcbD8KGEYW6RNuOIy+kKjN
TLSH
T1A73633B0B121DCD3E05E36FA9687B6523E64A9631666BEB23D5746612F403C31E63F0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000062

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000062
Size 3.1MB
SHA256 eb3d6da68c7662b5539339333740ae04bc0718621820c3705270a63ff967cb57
MD5 61e4419b61d43cff2a4a5b7533771179
SHA1 af885eab7806b2ebb1ae46ec646909064ec7d638
SHA512 7db4a079720a9dcc1c55fa3f6948c0d32a4278119f2f40a44aae94ae7fb4dac61d9aa0d96784c394c8b920c3abc2df0bca5fa7a1490259be49af7ebf21e31826
SSDEEP 98304:3K4cMHDnQVEdn8FZvABM6RswSWJxNmMSFM:amHMViKhAe6RVdJx8MF
TLSH
T1DDE523F08BA9C64B601717D70A465CB293B8419A933CF73B5ABB3D1B60095DBD323E52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 65e9852adcddb6d4e72aaca6bd1efa7ba69c0c8a94bd639fb326b984ee467cc2
MD5 9778029f61aa3f4b4dcbbbcd37603a14
SHA1 e47fea556fcbf010ddc440f15d2a180d9af533d4
SHA512 22f9891ee245832cb270c464a4d426cd6165100e3ac8b780cd08efd02564f0b9c0655d0f84737842ce91b121f50c79edcd67cbee058aa732fc48b67ff3fd520c
SSDEEP 96:1/xV1vS8AOjcT9mRih17P5+i37IaGzBaoQ2GY:VL1v9pYTIw7P5+i/GzsT3Y
TLSH
T170916196A4222713FFFEF23005EC06CB39F8558F7D876E0219AFE47D450AB44A65802D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a205a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a205a.TMP
Size 2KB
SHA256 3268da5ae685bdf88a5770968a2fa69de20dfa8c58217c0cc4a464726426f5af
MD5 a039b3f3fce55dfa74f18f8e072444f0
SHA1 ed1071b3d739ecb1039d142113f851b2641bc740
SHA512 257746d86ced58e12becaf189ec8415b86ce685e75a6075ee47b5af40fde96a766203b92f1175b6c1c8ab294b0945dbd3cbc16d8a04bfc4afd6f4e08761b9fdd
TLSH
T11C51FE8795627647F7FBC23549EC12CB3AB059409E873E5218ABE4B45A0BF54E74C13C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 735fa148d93cdeab9afd44a265a5b69358198a3c43ea60777f5b23e3556e6044
MD5 d193804fd1e41b672da8a7480439a0b5
SHA1 0c299b6b65354f013e82404b3f61e339d5cf711c
SHA512 3782cf2b13359f04259c0c46be949077046262e405fb2e2c1dc41341396521b8e785af9617fc7917566e654e598714d6c9fc19579d51fb0d23c0858026b48fcd
TLSH
T179816EF787E4866ECD0196F0AA18AE1EDE2D0515431C7C6589E4EE2BD3E3472E10265F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 76719358c78ed47e22a77fbc090cc244de1a80667c22fc76a62dd30edb246126
MD5 0654447bb0dcf6d33d3ac11fbbc8435f
SHA1 d83d128080e581b17bb5787d4f7535c5da935e49
SHA512 057fd4e9b3f98ac8dc4a80854abdea21de01c3f0d76ae2183c460910698a8e9eb2d025e89ddd265464498e3dc45f31893096f7c461ecb31b60625c8406f7bd90
SSDEEP 192:sxROR6CH/fhsnYZ73zoA8p9t/g6+WN/jo9l/WTEgtGYIgD4J:sxRO7H/fhsnmaz/5k96w
TLSH
T10C429659AD24693B5CCBD259BA65BF17D3FD5032A0901E48A6FCC71C14E7ADD620340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7895fb5ff7a5d24a46f498a3ea5152de4a4857f14b0ccf7494be0873492f3574
MD5 4f1ac34e3022c51dabf3d04b42347d7f
SHA1 95cf273362c75b290a55bfe3cf30baf35265b5a3
SHA512 b63e166054142b9925d0a4c841c6ec48c11a4d88042d0b31a1c61889c8aade653993ff8c1463a19dd98d6e003ffb904eb8ab5b2dd98e51ea6c8431172fe67906
SSDEEP 192:sxROR6CH/fhsGHRW3zoA8p9t/g6+WN/TzVl/WTEstGYIgDCJ:sxRO7H/fhsGXz/5HVWy
TLSH
T13042A65AAD24693B5CCBD25DBA65BF17D3FD1032A0905E44E6FC8B1C14E7ADE620380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 99f1fd750aad487eaf91ddc8ea66bba406d2a17b6fdd1ace0a02953a82741149
MD5 b119ad97bf790a49eefa07104d568606
SHA1 f98aef7ec231c2024a7fb2cf6af3ea0e9b5ceb39
SHA512 010e226d69d0e6e3491026b6eb752c691834ede372e0725057b349ed698003e62579792489b1b30e970cf00bd1d2e0d1fdad8170a3308250dc948f288ea1e3cd
SSDEEP 192:sxRZR6CH/fhsmHRW3zoA8p9t/g6+WN/uA/l/WTE9tGYIgFJ:sxRZ7H/fhsmXz/5D/9v
TLSH
T1AE42865AAD24A93B5CDBD21DBA65BF17D3FD1032A0905E44EAFC871C14E76DD620380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 dc63c7866dd50ed9dbea6f1a317e873272634b39b32f8f74362ce4f5135f395d
MD5 6b1fcc55e9f31815d5d4e45fde464b7c
SHA1 4d95c1e273f924f2a680c7f605d6a2ef431d12a4
SHA512 fb345563cb3818c43d69c23f21e305513e1a8b1f23f0b1454cf417f6f2052ca6e15dad6df474b9d71a852de08ac404c54357e113fe95e3f8abe5dbbc49aa349f
SSDEEP 768:U/pCPx7pLuLbLmWg8KfrL8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsyhpEroJE2:U/pCPnEbLmWg8KfrLu1ja/8pPG2
TLSH
T105C2D97B740CCB7F4F804ADDA8197A9B6D6902CB9A98CD4047FE941C02C77EE911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\8283dac8-4429-4510-9a1a-b71ddcdb2b49\index-dir\the-real-index
Size 4KB
SHA256 9ad1e8efec52434c539a85ca08efc20ba05a10ae2f307cf08afc54a836e53e42
MD5 44271246d1596fd9b88414e75158c622
SHA1 545b0502e68a52dcd2ee30b3f6706d55babab08c
SHA512 2abbcfb6cbf98d66f95e1dfd34ebe5ef90c411c43e7e01714084b5047d1e488f2dfbbcad724f748f449941cecdffc11fb09569faf347f061e1e3393c9b76cd1c
SSDEEP 96:++Flg8ip2pjms6SyR06BOFHksKq0ImgoGGeauMGZ8:+Ua8iZRZsFEwDmbGYuW
TLSH
T1A381D740BC42EA39C295883360B4DD6E7B363ADD2D8A3F1820ED8DF4AFA311C5E56090
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a3440.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\8283dac8-4429-4510-9a1a-b71ddcdb2b49\index-dir\the-real-index~RFe5a3440.TMP
Size 48B
SHA256 31119963cd7906c1dc6e3d9766b7bc83a1cd558fe839b265f3b732bfd042685f
MD5 bb6549845232ab980ff49174cc3d686a
SHA1 69e021a4ba0d41cb24b4e81fbbede48000c7792b
SHA512 8b8a78aa92b9d905e1ad7c09ddde5484a93007a0884e4e84cae1866bb2c649fd8b71a961cdfab0fb13fbe81032cd655489a263191c5d25b47a023bd3832ffe02
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\dcf8e00e-80a0-42c6-9b8a-1c9ca4ec20c6\index-dir\the-real-index
Size 72B
SHA256 48f22acea7f9a90ef209b4100cdf49976435180f6225e19e796c4aa172b988ec
MD5 f651331ffa7ee548e154bb93c12887a3
SHA1 27f5583228dc560863fc1cc154cf1825626435c6
SHA512 c832f1ba9cfb5dd7535ad154dd06a4a1576ec5d1683c89abbc6b0f7086c0e1f81ee2cf291b97dc25939493f8ff30e27ebb6481ce37dff760fbc1b69ab558c947
TLSH
T1ABA0029159558425DC02CA75D17105CE23114DDF2711431341A900C498945518161432
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a03e9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\dcf8e00e-80a0-42c6-9b8a-1c9ca4ec20c6\index-dir\the-real-index~RFe5a03e9.TMP
Size 48B
SHA256 fd8e5f895e42b6d9c403ca0c35beb2a8d0bcd077b5a6d480fc3ac1ce4e509774
MD5 c4cc44a450265077be0fabdc3b319f82
SHA1 765a021152dfedcc51d1fdfe47f8ac091c9722ef
SHA512 84a7b49319af057512c2d09d10f5c7da8736655f772c5d787cf0815102b7f0d90e515d45d722276c8508d9e53f2cea04658e3094617a205a87c439b775e18304
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt
Size 383B
SHA256 954b4b836356b84d5ad5f38434486919ccaaf7f5029b02d7e9937d5d797259cd
MD5 05a3a38e9551f89b364668a86665aa34
SHA1 59077afe70d999f3a36a2471e6f62500e60e4696
SHA512 7e5e759f2f217b4b6082624ecbd0e362d131d0a3af7540e7072b51e5f8a48cc8b8645c30a3ab4d128e0a25de201a769f5c650165a7289773d70ae146774a7cbd
TLSH
T199E068527333A122EF6149EE0DD8F658D83F3243AA40CF998084A04208AFF6B8092F17
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt
Size 386B
SHA256 c9aeeaf413913bf121a2f3245f069fd1aecfe7493041fea19011dedb0a9e7780
MD5 23f8dcc529c01b5fefd3355587dd746c
SHA1 44aa4fc76f3a3328e711f5ca13c4d537be328aa2
SHA512 f4d81a1b32ccbc16402d1023d33dbe67b5178bd36cdd3e407fc108e7246a69d06c6ce8b996e8c71eb6d2dfcf7c9805c8eeef30b365825e81d10d90c64252ae16
TLSH
T1E7E0615273329111DF6148DD0DD4F158D83F3E435E40CF594084714208BBE5B8192F17
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59b58b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt~RFe59b58b.TMP
Size 195B
SHA256 84a9ee62e5b814bee3759aee6831b669d01f3f6842c681e0eb74431536746b61
MD5 ce2df009fbfedc53b8c24ac535a335ba
SHA1 ad787c5de64fe3e3ca5c5ebb097dc50f9f409290
SHA512 269a49d5ac3de4ec93fff54e1b91e9a497e4454cde84a9c00006a24ebdb6ef2864e0c0f9dc62c23e288c4c867a830c09da9ab96d4e98260f007b11f324645503
TLSH
T13FD0229781322001CB5046AE0D92F288C82F1E436E80CEAA44C8B9800CBA6AB80C2A12
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 e0dc5b92874276a82ccd50fad138fbd399507d11f946ae34c33476f99b88cf14
MD5 5d5cc2b393098947f2e49d9bcfb9c0fb
SHA1 5e691aace900df3a40f2b6d4b2aabecdb787a4aa
SHA512 de3da86d310df958a5b7b468691593c903cfdd2c0e0e287e2653fe7195f607fa9cf503c325b7c9dbebb354fc44641f2fca7367b37f6b2d7e9b329a887c0bd3cd
TLSH
T140A002650258178BC4188776904551C4327058261311521940A84074D8D43404117806
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a00fb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a00fb.TMP
Size 48B
SHA256 06760c46f0498eed6fe56a760d26222f9bc249c2fc60105f3c1c5f25b9c2d05a
MD5 fddebf67c5dc983007b6a0385eaa9277
SHA1 fd6c71bf999072d4ae66c5450f0367aff168d20d
SHA512 a17dd66abc8c7545d2b80621d88593bf16d3b543f70e60bf8e2a287dd97b05b4684a2643e3b5f5a2e5ad5dcef22c33533731f4ffc5e71b06c929de7c7074a8d0
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a8fce.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a8fce.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 abe90ba642965ca1c3a7c7f8b056c8d81e4ca0e08fcf3c4e937d45986a69db4b
MD5 0dc909e533eb59c9fc53a4c6e566273a
SHA1 650a78f6e813d48ca741ae9b56e9968ca0f4090c
SHA512 ac8726c4ab0c83950e779293ff44caed450227f0cce3671296cee7b7f457733c289fc1b0a8bc133cf9cce2eb5c133791aa478a4841f20a3bc227908b444fedc9
SSDEEP 768:ub3ljOc7fZrK9Ck8p5XSwQs88uBkiT2evcTRdf:ub3lRtrSCkCILNBlcTRdf
TLSH
T1BCF2AF38EC94DCA3ACFA93867A573B166FF4605388C80A44D9DDB71E0187B5E270B857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 b423a15d6824626b06604d4ddeb65a3e8a1f8a80a0bd2a9f698728cfb0bf44ac
MD5 3758bae01c79842ebd482db7cd9ec6c0
SHA1 b6b9337fcc2ea95bf2d918a5e6562b931faa2883
SHA512 d64b6bdea6f41498e944c4d2219ea76e944e1748c53c35bdd9daee7f7750a9edac59594a73df0536e845f7328bc6a6172ba3d355c119a89abbbf3df96f578ce7
SSDEEP 768:kb3ljOc7fZrK9Ck8p5XSwQs88uBkiT2evcTRdf:kb3lRtrSCkCILNBlcTRdf
TLSH
T10BF2A038EC94DCA3ACFA93867A573B166FF4605388C80A44D5DDB71E0187B5E270B857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 7f2c4de1161b6fad125ddf400e36e84488ee189519b8dc5f544bdd81824e3e98
MD5 b89b7ad28c8c473c3f295c3935ba7712
SHA1 9fc8aa12e7113715eebd29a9f2fb930779f0ab94
SHA512 f8cf0a302e545bfab8027ec53d537d4dcafcd7a5b474f5574ed21fed7883b00ad0a0d9dec0a53bc4221bafd0497bc0e2023ca2b5cc57559f3956d40b5b6e4d08
SSDEEP 768:cFH43Swg4jGAerK9C7o8p5XSwQs88uBkiT2evcTRdf:E43HYrSC7oCILNBlcTRdf
TLSH
T105039E39EC90C967BCF697C2BB563B06AEF4109388C849C4D9D9AE1E01C779E170BC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 50db65f6e2e712f8f30a7450758f60f6d613cdf39c8066cf4a1948d0984696af
MD5 c42c355fe4c763021a22a24f5d3c1bb7
SHA1 b1f6dea93e1a6322acd9d0c2873be3cd34027b51
SHA512 fa49a507204aa905600f5b772399c28f58f5eb1db1df24d3662d0fc48f418b7677cebd25614de06c6ab58c8460e102a70913e3c871c7d634c73b174c4cb2b782
SSDEEP 768:i/UxvxjgC+q3AoOc7fZrK9CBp5XSwQs88uBkiT2evpGd:nZj3+q3A6trSCvILNBlpGd
TLSH
T10B03C03CF8949C63ACF6A341765B2B57AFF42063C8C40E5889EE670E068775E570785B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 0179d360e9b2f1f071720dcc9d7ecc7047bff5517b901aa075435eb8962dc404
MD5 81a9a1fec9ae9764992462692c839eb9
SHA1 ade4517324e574e6cdec20f1f31646751c228971
SHA512 69190da5e0196ad6626aaea149ac53dc8ad70a78907d459a5fdecf20db78a5a24c3475942cc47954ece69a4900464e4d859f5494b54d6628332b19be4bf71048
SSDEEP 768:R/UxvxjgC+W3TKxc7fZrK9Ap5XSwQs88uBkiTC7/P84g:kZj3+W3TLtrSeILNBWHg
TLSH
T17503C039E8945C63ACF7A385375A275BAFF05063C4C41BA449EE7A0E038B75DA707887
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 583e58818197449af6c3d2453b7ae4ee57f47ceffc8e27601acea1047ba9fe0c
MD5 5641d87959eecd35f01595faed4f3550
SHA1 23543eea279f6d3aed022d70a3331a523d484783
SHA512 10c4a6b2a7675b6760e6fa1f7fecad7c69bafff453320258e7515f7bc028589e097db6dc0dcb047b20bab4da625eea3f33116b86b2380a4fa542fa56b8f12ec8
SSDEEP 768:+/UxvxjgC+q32oOc7fZrK9CBp5XSwQs88uBkiT2evpGd:zZj3+q326trSCvILNBlpGd
TLSH
T1F003C03CF8949C63ACF6A341765B2757AFF42063C8C40E9889EE6B0E068775E570785B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Tmp9428.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp9428.tmp
Size 1KB
SHA256 28c871238311d40287c51dc09aee6510cac5306329981777071600b1112286c6
MD5 a10f31fa140f2608ff150125f3687920
SHA1 ec411cc7005aaa8e3775cf105fcd4e1239f8ed4b
SHA512 cf915fb34cd5ecfbd6b25171d6e0d3d09af2597edf29f9f24fa474685d4c5ec9bc742ade9f29abac457dd645ee955b1914a635c90af77c519d2ada895e7ecf12
TLSH
T10F21CA2FA1324D9E49BDF27D4C0B0CFE85260FB792F4960217541E12B04DD548AF8C4D
MD5 SHA1 SHA512 TLSH

Submit Download

cnwqbikblm.exe

Path C:\Users\Admin\AppData\Local\Temp\cnwqbikblm.exe
Size 51KB
SHA256 c25d90168fc2026d8ed2a69c066bd5a7e11004c3899928a7db24cb7636fc4d9e
MD5 e48b89715bf5e4c55eb5a1fed67865d9
SHA1 89a287da39e14b02cdc284eb287549462346d724
SHA512 4bd77d2fa5da646009ebeeedb5610048c58598ee7e5aeb5660b0c01042f0f34a88f89181e13e86c06cae9984155d0299128a2aee1c2c16f18e284db4745d850c
SSDEEP 768:K43yRHdzUUa4nVIcBr5X91yShU0kkBCEDTnlyQZnowYh:l3qHdgpI7r5XRU0ksgwA
TLSH
T1C7336B1279A0C032D46356718978D7A29F6FBD125BB482DB378806BE1FA23D19F3435B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jbndzvfuvr.exe

Path C:\Users\Admin\AppData\Local\Temp\jbndzvfuvr.exe
Size 580KB
SHA256 3ab288c47914e33cc61985e46502158400faa9d7187b55c19039b8795504a290
MD5 2c2029588ad8b86759c17b7ae885ee03
SHA1 91653b5344d4c210201218e2f215dd5228d76799
SHA512 88531fe6b0f2d66ada368a431f912868f74f9ed8ade9dc88887807b761490fe2cc317e1b6b40e7070411924c80971f237dca68ad2faafa7b4b1ecd2ec90c860f
SSDEEP 12288:8zn3DSudvsh8Awf3XFaZmBITVJPtSrE37yG2Lmx:8j3DSudvGM3MXTVhtSQWGtx
TLSH
T10FC42370A32915D0F15A7338575E9770A71DE36AAFCEC01CA20AD4CD2810EDDD7E661A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mdWCf6Zg.bat

Path C:\Users\Admin\AppData\Local\Temp\mdWCf6Zg.bat
Size 196B
SHA256 131878f84c4003b9e061f64baac6d19bfe7a5c868e0a0ef6f51fd9d3f11973e5
MD5 eb3ab3927822bfc443794197350235b4
SHA1 181008c5ad6021c28d55d333827b426f213ac2a7
SHA512 287e3871b3c2169357ea5d4012bdbe8767944b9ea6ce8cd37cb7a76132bfb58e622e0fd62e36c880391bafeffa1e78bc9c2010ba3f84a99eab80c200b16712da
TLSH
T1C7D0125192FBCB9F1448919B0EE192CEC0A4CC2C3F4E27967A2684CA71D640DBAD7341
MD5 SHA1 SHA512 TLSH

Submit Download

qrivszxzmf.exe

Path C:\Users\Admin\AppData\Local\Temp\qrivszxzmf.exe
Size 843KB
SHA256 a794817cecaa4f8ee071e8ccec6f4b5e42fc6d27fa85d8e71bbc5588d40a9550
MD5 0550f5cea97a4945d4a13fca4832bb1d
SHA1 7cd867b0e914af96fbd1fd772a9c17e7f5c577de
SHA512 0b60c812e99f422145790089db3d47360348f669adc2bc8549b61c6e6735533027f1f30dca5f446d4dc98ab18dfbd206b448b06ae147283b5f49b2a8df9ac8c8
SSDEEP 12288:Fv+6GAIA3+Tac0RDffXJjyYp9poNHSy5viczBBH0N7KafXJjyJpB:EbAI2+2DR7BWYp9po44HEOaBWJpB
TLSH
T161054C6123EC0435E7B70B7ABD7A58521B36BC385942E55E598E263C08F2B5789F2333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2356_105776588\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trnmg.sdb

Path C:\Users\Admin\AppData\Roaming\Microsoft\UserSetting\trnmg.sdb
Size 1KB
SHA256 e3ff925c3e17046e3fc95f91a15566bcbb8769896ee6065ec83b5e502b33bb37
MD5 2d811eadba3a4744f9d480542a9efb89
SHA1 6cc09b9d11730a0acbd3eb512d6b8aaf4c322af2
SHA512 7be5d794d0aec17a13e76726df0352f29c0e67aa2894bfc672bb0eaa78e509b38b5d020710a150c2a84e8450585b90d003015e02251cfa5f736519f867ecbd21
TLSH
T133215C9A5BD33A67813987608BB4C4F7CA23F81D2F8013408217B221CFA35E5132459F
MD5 SHA1 SHA512 TLSH

Submit Download

bindsvc.exe

Path C:\Windows\System32\bindsvc.exe
Size 291KB
SHA256 d032bdc64c9451bbb653b346c5bd6ac9f83a91edeb0155497f098c8d6182ddee
MD5 7c5b397fb54d5aa06bd2a6fb99c62fee
SHA1 a9e0bf7bbabf6ab9e294156985537ae972ebd743
SHA512 daa4702eff625b5dd1edca358c653338cff4eeca4e43d12dfd39bbc52acf8dfde3b963d190cf4426e405d9db8bcc9817cd50868055aa0d4a9efe4d1042beaf0c
SSDEEP 6144:jIKd3DAY+ihcyBOHbqzr1czd1tTsQOm3Ugh5X:BRAY+Y7BOHb2mhjPdUy
TLSH
T1E2545B21B5C0C032E46315718EF9C77A9A7EBD610764A4CBA7D81A7E1F616E1AF3031B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5004-43-0x00000238531A0000-0x00000238531A8000-memory.dmp

Download

memory/5004-30-0x0000023852C00000-0x0000023852CBA000-memory.dmp

Download

memory/5004-29-0x00000238394A0000-0x00000238394AA000-memory.dmp

Download

memory/5004-28-0x0000023837590000-0x0000023837662000-memory.dmp

Download

memory/5004-41-0x0000023852750000-0x0000023852762000-memory.dmp

Download

memory/5004-42-0x00000238530C0000-0x00000238530FC000-memory.dmp

Download

memory/5004-67-0x0000023857450000-0x0000023857476000-memory.dmp

Download

memory/5004-44-0x0000023853200000-0x000002385323E000-memory.dmp

Download

memory/5004-45-0x00000238531D0000-0x00000238531DE000-memory.dmp

Download

memory/5004-46-0x0000023856BF0000-0x0000023856D78000-memory.dmp

Download

memory/5720-17-0x0000000000340000-0x00000000004BA000-memory.dmp

Download

memory/5720-56-0x0000000000340000-0x00000000004BA000-memory.dmp

Download