875fd0a0045940b4931c9fdcd1f121160fec74a35e850d88a6e118da264fed41

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 04:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_1b5894cd4fa7be54c15dc77402b945a6_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_r.exe
Size 11.6MB
Sample260930-ff1mbatthz
SHA256 875fd0a0045940b4931c9fdcd1f121160fec74a35e850d88a6e118da264fed41
MD5 1b5894cd4fa7be54c15dc77402b945a6
SHA1 d41a1325ae9999ac9c60e5ac97230c25e88966f5
SHA512 3af8c495f9b0645e7168a5c7fae9cb9946c8219fda88ccd635b0dabb980196eda4b103fac42f38de67c01d94929b38b2c870ba8899987df3d6a3889f8d39bdac
SSDEEP 196608:59wiRqa21XWfE+6P/T9SymdAPJ1KpvGkKQMfKIfBAN/CIQm3i:59xMa21XWfF63TV3J14+kKQMfKIah1Qj
TLSH
T131C6AE03B7E64125F5F31A745A7D5529492ABD311B34C0CFA2C92A4E4FF2EE2A931723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence

Malware Config

Signatures

Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral1/files/0x00070000000244ef-7.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Executes dropped EXE 6 IoCs

pid	Process
3512	2026-09-29_1b5894cd4fa7be54c15dc77402b945a6_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_r.exe
1984	icsys.icn.exe
1728	explorer.exe
2264	spoolsv.exe
4888	svchost.exe
1552	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1476_565766087\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1476_169108011\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1476_169108011\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1476_1985236063\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1476_1985236063\nav_config.json	msedge.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	2026-09-29_1b5894cd4fa7be54c15dc77402b945a6_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_r.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-29_1b5894cd4fa7be54c15dc77402b945a6_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_r.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-29_1b5894cd4fa7be54c15dc77402b945a6_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_r.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_1b5894cd4fa7be54c15dc77402b945a6_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_r.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_1b5894cd4fa7be54c15dc77402b945a6_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_r.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2604	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{69D30A4B-EFE4-4623-B571-4FA63C49E87A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1112	2026-09-29_1b5894cd4fa7be54c15dc77402b945a6_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_r.exe
1112	2026-09-29_1b5894cd4fa7be54c15dc77402b945a6_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_r.exe
1112	2026-09-29_1b5894cd4fa7be54c15dc77402b945a6_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_r.exe
1112	2026-09-29_1b5894cd4fa7be54c15dc77402b945a6_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_r.exe
1112	2026-09-29_1b5894cd4fa7be54c15dc77402b945a6_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_r.exe
1112	2026-09-29_1b5894cd4fa7be54c15dc77402b945a6_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_r.exe
1112	2026-09-29_1b5894cd4fa7be54c15dc77402b945a6_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_r.exe
1112	2026-09-29_1b5894cd4fa7be54c15dc77402b945a6_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_r.exe
1112	2026-09-29_1b5894cd4fa7be54c15dc77402b945a6_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_r.exe
1112	2026-09-29_1b5894cd4fa7be54c15dc77402b945a6_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_r.exe
1112	2026-09-29_1b5894cd4fa7be54c15dc77402b945a6_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_r.exe
1112	2026-09-29_1b5894cd4fa7be54c15dc77402b945a6_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_r.exe
1112	2026-09-29_1b5894cd4fa7be54c15dc77402b945a6_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_r.exe
1112	2026-09-29_1b5894cd4fa7be54c15dc77402b945a6_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_r.exe
1112	2026-09-29_1b5894cd4fa7be54c15dc77402b945a6_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_r.exe
1112	2026-09-29_1b5894cd4fa7be54c15dc77402b945a6_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_r.exe
1112	2026-09-29_1b5894cd4fa7be54c15dc77402b945a6_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_r.exe
1112	2026-09-29_1b5894cd4fa7be54c15dc77402b945a6_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_r.exe
1112	2026-09-29_1b5894cd4fa7be54c15dc77402b945a6_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_r.exe
1112	2026-09-29_1b5894cd4fa7be54c15dc77402b945a6_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_r.exe
1112	2026-09-29_1b5894cd4fa7be54c15dc77402b945a6_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_r.exe
1112	2026-09-29_1b5894cd4fa7be54c15dc77402b945a6_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_r.exe
1112	2026-09-29_1b5894cd4fa7be54c15dc77402b945a6_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_r.exe
1112	2026-09-29_1b5894cd4fa7be54c15dc77402b945a6_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_r.exe
1112	2026-09-29_1b5894cd4fa7be54c15dc77402b945a6_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_r.exe
1112	2026-09-29_1b5894cd4fa7be54c15dc77402b945a6_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_r.exe
1112	2026-09-29_1b5894cd4fa7be54c15dc77402b945a6_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_r.exe
1112	2026-09-29_1b5894cd4fa7be54c15dc77402b945a6_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_r.exe
1112	2026-09-29_1b5894cd4fa7be54c15dc77402b945a6_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_r.exe
1112	2026-09-29_1b5894cd4fa7be54c15dc77402b945a6_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_r.exe
1112	2026-09-29_1b5894cd4fa7be54c15dc77402b945a6_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_r.exe
1112	2026-09-29_1b5894cd4fa7be54c15dc77402b945a6_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_r.exe
3512	2026-09-29_1b5894cd4fa7be54c15dc77402b945a6_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_r.exe
3512	2026-09-29_1b5894cd4fa7be54c15dc77402b945a6_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_r.exe
1984	icsys.icn.exe
1984	icsys.icn.exe
1984	icsys.icn.exe
1984	icsys.icn.exe
1984	icsys.icn.exe
1984	icsys.icn.exe
1984	icsys.icn.exe
1984	icsys.icn.exe
1984	icsys.icn.exe
1984	icsys.icn.exe
1984	icsys.icn.exe
1984	icsys.icn.exe
1984	icsys.icn.exe
1984	icsys.icn.exe
1984	icsys.icn.exe
1984	icsys.icn.exe
1984	icsys.icn.exe
1984	icsys.icn.exe
1984	icsys.icn.exe
1984	icsys.icn.exe
1984	icsys.icn.exe
1984	icsys.icn.exe
1984	icsys.icn.exe
1984	icsys.icn.exe
1984	icsys.icn.exe
1984	icsys.icn.exe
1984	icsys.icn.exe
1984	icsys.icn.exe
1984	icsys.icn.exe
1984	icsys.icn.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1728	explorer.exe
4888	svchost.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1476	msedge.exe
1476	msedge.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1112	2026-09-29_1b5894cd4fa7be54c15dc77402b945a6_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_r.exe
1112	2026-09-29_1b5894cd4fa7be54c15dc77402b945a6_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_r.exe
1984	icsys.icn.exe
1984	icsys.icn.exe
1728	explorer.exe
1728	explorer.exe
2264	spoolsv.exe
2264	spoolsv.exe
4888	svchost.exe
4888	svchost.exe
1552	spoolsv.exe
1552	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 3512	1112	2026-09-29_1b5894cd4fa7be54c15dc77402b945a6_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_r.exe	89
PID 1112 wrote to memory of 1984	1112	2026-09-29_1b5894cd4fa7be54c15dc77402b945a6_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_r.exe	91
PID 1984 wrote to memory of 1728	1984	icsys.icn.exe	92
PID 1728 wrote to memory of 2264	1728	explorer.exe	93
PID 2264 wrote to memory of 4888	2264	spoolsv.exe	94
PID 4888 wrote to memory of 1552	4888	svchost.exe	95
PID 3512 wrote to memory of 1476	3512	2026-09-29_1b5894cd4fa7be54c15dc77402b945a6_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_r.exe	109
PID 1476 wrote to memory of 3876	1476	msedge.exe	110
PID 1476 wrote to memory of 2604	1476	msedge.exe	111
PID 1476 wrote to memory of 4920	1476	msedge.exe	112
PID 1476 wrote to memory of 4920	1476	msedge.exe	112
PID 1476 wrote to memory of 4920	1476	msedge.exe	112
PID 1476 wrote to memory of 3756	1476	msedge.exe	113
PID 1476 wrote to memory of 3756	1476	msedge.exe	113
PID 1476 wrote to memory of 2124	1476	msedge.exe	114
PID 1476 wrote to memory of 3676	1476	msedge.exe	115
PID 1476 wrote to memory of 2124	1476	msedge.exe	114
PID 1476 wrote to memory of 2124	1476	msedge.exe	114
PID 1476 wrote to memory of 3676	1476	msedge.exe	115
PID 1476 wrote to memory of 3676	1476	msedge.exe	115
PID 1476 wrote to memory of 1864	1476	msedge.exe	117
PID 1476 wrote to memory of 1864	1476	msedge.exe	117
PID 1476 wrote to memory of 1864	1476	msedge.exe	117
PID 1476 wrote to memory of 1176	1476	msedge.exe	118
PID 1476 wrote to memory of 1176	1476	msedge.exe	118
PID 1476 wrote to memory of 1176	1476	msedge.exe	118
PID 1476 wrote to memory of 1244	1476	msedge.exe	120
PID 1476 wrote to memory of 1244	1476	msedge.exe	120
PID 1476 wrote to memory of 2012	1476	msedge.exe	121
PID 1476 wrote to memory of 2012	1476	msedge.exe	121
PID 1476 wrote to memory of 1036	1476	msedge.exe	123
PID 1476 wrote to memory of 1036	1476	msedge.exe	123
PID 1476 wrote to memory of 1036	1476	msedge.exe	123
PID 1476 wrote to memory of 4440	1476	msedge.exe	124
PID 1476 wrote to memory of 3992	1476	msedge.exe	125
PID 1476 wrote to memory of 4440	1476	msedge.exe	124
PID 1476 wrote to memory of 3992	1476	msedge.exe	125
PID 1476 wrote to memory of 4280	1476	msedge.exe	126
PID 1476 wrote to memory of 4280	1476	msedge.exe	126
PID 1476 wrote to memory of 4280	1476	msedge.exe	126
PID 1476 wrote to memory of 1072	1476	msedge.exe	127
PID 1476 wrote to memory of 1072	1476	msedge.exe	127
PID 1476 wrote to memory of 3124	1476	msedge.exe	129
PID 1476 wrote to memory of 5200	1476	msedge.exe	130
PID 1476 wrote to memory of 5200	1476	msedge.exe	130
PID 1476 wrote to memory of 5208	1476	msedge.exe	131
PID 1476 wrote to memory of 5208	1476	msedge.exe	131
PID 1476 wrote to memory of 5404	1476	msedge.exe	132
PID 1476 wrote to memory of 5404	1476	msedge.exe	132
PID 1476 wrote to memory of 5456	1476	msedge.exe	133
PID 1476 wrote to memory of 5456	1476	msedge.exe	133
PID 1476 wrote to memory of 5940	1476	msedge.exe	134
PID 1476 wrote to memory of 5940	1476	msedge.exe	134
PID 1476 wrote to memory of 6124	1476	msedge.exe	138
PID 1476 wrote to memory of 6140	1476	msedge.exe	139
PID 1476 wrote to memory of 6132	1476	msedge.exe	140
PID 1476 wrote to memory of 5572	1476	msedge.exe	141
PID 1476 wrote to memory of 5572	1476	msedge.exe	141
PID 1476 wrote to memory of 6044	1476	msedge.exe	146
PID 1476 wrote to memory of 6044	1476	msedge.exe	146
PID 1476 wrote to memory of 4348	1476	msedge.exe	147
PID 1476 wrote to memory of 4348	1476	msedge.exe	147
PID 1476 wrote to memory of 3296	1476	msedge.exe	149
PID 1476 wrote to memory of 3296	1476	msedge.exe	149

C:\Users\Admin\AppData\Local\Temp\2026-09-29_1b5894cd4fa7be54c15dc77402b945a6_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_r.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_1b5894cd4fa7be54c15dc77402b945a6_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_r.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1112
- \??\c:\users\admin\appdata\local\temp\2026-09-29_1b5894cd4fa7be54c15dc77402b945a6_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_r.exe
  c:\users\admin\appdata\local\temp\2026-09-29_1b5894cd4fa7be54c15dc77402b945a6_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_r.exe
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.hitmanpro.com/downloads
    3⤵
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d4,0x7fff4ec0c188,0x7fff4ec0c194,0x7fff4ec0c1a0
      4⤵
      PID:3876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,1043659086065689151,13785663407618479797,524288 --field-trial-handle=2304,i,6873964116539916546,14550741508782124968,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
      4⤵
      System Time Discovery
      PID:2604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1788,i,16653756494149576251,8609617585900701177,262144 --field-trial-handle=2304,i,6873964116539916546,14550741508782124968,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
      4⤵
      PID:4920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2624,i,15255992487462977169,6717408766423886322,524288 --field-trial-handle=2304,i,6873964116539916546,14550741508782124968,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:8
      4⤵
      PID:3756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,16605467113310461056,15983373030263149286,2097152 --field-trial-handle=2304,i,6873964116539916546,14550741508782124968,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
      4⤵
      PID:2124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,2866020378033816155,915236667570120782,2097152 --field-trial-handle=2304,i,6873964116539916546,14550741508782124968,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
      4⤵
      PID:3676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,9260149519984658099,4999161781679782239,2097152 --field-trial-handle=2304,i,6873964116539916546,14550741508782124968,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:1
      4⤵
      PID:1864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,1698395960894043419,15637293964443957153,2097152 --field-trial-handle=2304,i,6873964116539916546,14550741508782124968,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:2
      4⤵
      PID:1176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,11284572064939047694,15319054971194390971,524288 --field-trial-handle=2304,i,6873964116539916546,14550741508782124968,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:8
      4⤵
      PID:1244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,13065617838104509799,9396328787456146240,524288 --field-trial-handle=2304,i,6873964116539916546,14550741508782124968,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:8
      4⤵
      PID:2012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5408,i,2846307659656272116,14474421564533134146,2097152 --field-trial-handle=2304,i,6873964116539916546,14550741508782124968,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:1
      4⤵
      PID:1036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,38531058127487945,3227553422666948648,524288 --field-trial-handle=2304,i,6873964116539916546,14550741508782124968,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:8
      4⤵
      PID:4440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,7888338869214333809,9419270496256230704,524288 --field-trial-handle=2304,i,6873964116539916546,14550741508782124968,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:8
      4⤵
      PID:3992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6700,i,18182351767399572082,3026480217101238261,2097152 --field-trial-handle=2304,i,6873964116539916546,14550741508782124968,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:1
      4⤵
      PID:4280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,15447928276349730990,15820513285374994626,524288 --field-trial-handle=2304,i,6873964116539916546,14550741508782124968,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:8
      4⤵
      PID:1072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,3979903633762401510,16390895429784528455,524288 --field-trial-handle=2304,i,6873964116539916546,14550741508782124968,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:8
      4⤵
      PID:1948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,3979903633762401510,16390895429784528455,524288 --field-trial-handle=2304,i,6873964116539916546,14550741508782124968,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:8
      4⤵
      PID:3124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,4784287924589303081,15154439101705860510,524288 --field-trial-handle=2304,i,6873964116539916546,14550741508782124968,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:8
      4⤵
      PID:5200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,12317885347826187925,1540230053583459482,524288 --field-trial-handle=2304,i,6873964116539916546,14550741508782124968,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:8
      4⤵
      PID:5208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6908,i,13193712061002773052,7378170669646609067,524288 --field-trial-handle=2304,i,6873964116539916546,14550741508782124968,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:8
      4⤵
      PID:5404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,2891466975142832319,15702548887847399411,524288 --field-trial-handle=2304,i,6873964116539916546,14550741508782124968,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
      4⤵
      PID:5456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6904,i,14916535681740852185,4794686938788882699,524288 --field-trial-handle=2304,i,6873964116539916546,14550741508782124968,262144 --variations-seed-version --mojo-platform-channel-handle=7088 /prefetch:8
      4⤵
      PID:5940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,5629411616689283033,3782735257454344152,524288 --field-trial-handle=2304,i,6873964116539916546,14550741508782124968,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:8
      4⤵
      PID:6124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,3170436872303352375,17724932410953162908,524288 --field-trial-handle=2304,i,6873964116539916546,14550741508782124968,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:8
      4⤵
      PID:6140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,17442824136740184149,10163659916145900857,524288 --field-trial-handle=2304,i,6873964116539916546,14550741508782124968,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:8
      4⤵
      PID:6132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,5326886971356183033,1217009858575244783,524288 --field-trial-handle=2304,i,6873964116539916546,14550741508782124968,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:8
      4⤵
      PID:5572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,3145671843472663449,2698474485816920345,524288 --field-trial-handle=2304,i,6873964116539916546,14550741508782124968,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:8
      4⤵
      PID:6044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6908,i,9468815374923212606,12631629500484670009,524288 --field-trial-handle=2304,i,6873964116539916546,14550741508782124968,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:8
      4⤵
      PID:4348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,7933553712761920464,17393712696723816177,524288 --field-trial-handle=2304,i,6873964116539916546,14550741508782124968,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:8
      4⤵
      PID:3296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3760,i,17801077088245471252,1196536431144330810,262144 --field-trial-handle=2304,i,6873964116539916546,14550741508782124968,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:8
      4⤵
      PID:4356
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1984
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Modifies visibility of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1728
  - - \??\c:\windows\resources\spoolsv.exe
      c:\windows\resources\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2264
    - - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        5⤵
        Modifies visibility of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4888
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1552

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1476_169108011\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1476_1985236063\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1476_565766087\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 7331d61b72578f10058ae20f1a7351dc99070a754006884c0b775bb57bffd9cc
MD5 df1098b0a62fea8609e624a81ae2865a
SHA1 eb148addd613d8dae155058eacdf967eae295b15
SHA512 0ec5916b4d090394f668a1ee0ca76c2125146f8b8507c9e7dd1bb90a8aed21e61551b85c2a32b975aea241df7bda238c513a58ebe378cd3af3d77e71803ef6d8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7s:fwUQC5VwBIiElEd2K57P7s
TLSH
T1D2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e364ae2365b95ee5142a1a0abe3ee5065b85c554bc5cb9fcb1f31bcd0a1af4e
MD5 75bc6f9debcf49d2312740dfba56733a
SHA1 af0f5dfe4b330cf62c24c0003f6c57159b23e268
SHA512 c0a6cf9272c224460d1e7d25cf8159aa43733ebfb5f2761293ec6a5f2b4d71e061daa60092335856322f566a072c79184d7ad45d2b04b7cf8f3628e3a4bd4d35
TLSH
T176D02B2489E41E90D4131434002141453F8CC03858027113D0B812AE05429D60A21020
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 27f6aa5d39c98b4843eaed7972cf93d10e75e08f497afafa54ccf4057f6d52c9
MD5 a91eafa1aeb7b35d5c7abac6d2c83384
SHA1 a76b97105496dbfe28857282f5b661789a032b25
SHA512 4bebba8a121156a8e7e31bb49955c0375f1ca3be7dcd3c9b113d261a4618ecdf6781fce438d8e56020e438286e1619d3844f48e91b2b2c3cbb4a55d4c199972a
TLSH
T17AD02B24C9E41E90D0131434002241453F8CC03858023012D0B812AE15419D60A21020
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6ccd9c0604d4d7b1a6724b6651324bfdf866e99268d8c15719ab229b23d0bf0e
MD5 56b015a520d2b047c989de08fb08f000
SHA1 db151cf73b0331aa4031d23ef9225f8e9458d99a
SHA512 251badb4bef0d3b7555cbbcea769d943d94d46ec6c6fff640e3bb435ee58f3fc466d3d777b425724146b70c4abb1c46841d60a7adc25b9eb9981d9e264370673
TLSH
T15881834D96BC54B0FB64853B7FC900E7F73099E18CDFCE21CDA4D675686A7909A0428D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595fe9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595fe9.TMP
Size 3KB
SHA256 50156558b302beb7b79628b7c78cabf6559dc1e96653a4868d0bf12442b9beab
MD5 884d1ed384fed5a1219107efc1077bca
SHA1 b52c0e69b1db03c7e3375efad3cc91753811c54a
SHA512 71358c534ec2f1c2970bf26b286adddc58153263c4fc3d51e05f0dc915ce14d77e20d3dc9d01162f01a251a771ae90b072869724086d042a9f047b0c1aa34e9c
TLSH
T1EF61A34DD2AC8574FB68003F77D500EBF33089E04CCFDE429DA4D83A98467149A482CE
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 56f94e8d598fe207529964674a98e0c3cd7f2229679ec363733c537ad33863e3
MD5 479d862ae14039ea74da89b93f5d719e
SHA1 b4f8466054621dbc8d92bfd8e27bd1c8bc0dad08
SHA512 ecec5e598b5b9391b2ba652a4314478c5059ca48349d25bc7884cea422a9a2891fc95f6ecab863cf18e7c4d7d3ce0131fbd4e32b81fc12a6d4e45e5c6d16726f
SSDEEP 192:D5hXjc5J5aBqf16W7ygmMuNwLq36Xg2I6Xx0ijzT:D5hXjcn5aB616W7yBMuNw236Xg2I6h0W
TLSH
T19CD189F383E4D62D8E1196F05B14AE1BCE5D0514672C3D6A88E8BF0B93F2471E25266F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 62d24e4adb5c62d082ca4b6e19077aaeb3713ccbed632f19bf980da96adf2e20
MD5 532978c953efd159deb61246f88dddd2
SHA1 83e8cb6b22fcac77dfebc3fa321ca1bb7f4ee92f
SHA512 3c1bdb97f6db38d3d09d38344f35a6640aed978ac4d55dd9d0ef84a9871cfa220ea6b62903a1e12569d4d36d5332af1474c6776233724b3b5dc5ce6ded1d08f6
SSDEEP 192:sxZpR8sr/fFsx1jlIdpYVHW6+WNk3Q/Zxt1G3gZryIg4J:sxZp7r/fFsxAgHbJ/kc
TLSH
T11D32C9566D68A9BB4CC7E21DBB14BF23D6F9143294D05E88EAFC861C04E66DD320780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 4a3e83634cce91fb2b4cff2f25451c476eaa67003f6d8712812123adc6e61e79
MD5 d4c3650eb02b138b19a721a80a34945d
SHA1 2c24103d4f0baf4c548ebf6c463fdd6f0248f6a3
SHA512 11135823e39910d1cd492507411faa13d6afaebae7d8a902c2dd2d3240bf0fbe3fffb5369d0b6f2cb313f4ecacbe5c5f1bcfea5eb625672efce3cdad3dd7bfdc
SSDEEP 192:sxZpR8sr/fFsJ1jlIdpYVHW6+WNk3Q/Zxt1G3gdCryIg5VJ:sxZp7r/fFsJAgHbJ/RJV
TLSH
T12732C8566D6869BB8CC7E25DBB14BF23D6F5543290D05E88AAFC8A1C04E77DD320780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 4687e134c05661250b274a7c7905995d6420619a2c82a54bf10622c5a2e7bab1
MD5 bf8c6143c01e14002806fe32eb577147
SHA1 fc8c229af968d037ffab45b906eb4f6d6a430b4c
SHA512 e5abff4c9169a0cb3d82a2fd55c94ceeff01926fc1adb15ba9cd43aedbd8c100220a84009166c06da196088f74381bdb038b2021f1240675581cf09ed62b24a5
SSDEEP 768:MZichdf7pLuLbrPWvPZhl8F1+UoAYDCx9Tuqh0VfUC9xbog/OV/nn+LlEKXz7roV:MZichdZEbrPWvPZhlu1jamnn+LKgzIfN
TLSH
T160E2FB7B780CCE7E4FC04A9DDD1A7F9E6DA8028B9698C94047FA945C02C7BEE51160DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d2ca56fbfa550d431f9dbba3caecc79d4d28e77c5540506b6a77b831194d271f
MD5 707f735d041fa31cd652cb7587a3c9f6
SHA1 4d67e034b836342bd10f655a7d9c94e97a582cd8
SHA512 00ad831a66557c80588d41a7ec4c0a40b9473373785f59971593ec6c425536a1a95ac94636528a7afd12821c7130d1ad98039a297a45a17d28f679ddfb2d1fc9
SSDEEP 48:K0Q/26gK+/b2NWISS/K9u10/xIvY1mOUyLL5LILVLpLzL3LLLkbL3LSLPISLBLkR:KgHyKoUW6KgKPKUKcK3KmKAoKBL
TLSH
T1B2A1655172BB0381387E2A488079876F525571A33114EE3B7FBD04668F6EE158DFD8CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fb18a0a7-ca4e-4843-8c3a-6a47aa6ea296.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fb18a0a7-ca4e-4843-8c3a-6a47aa6ea296.tmp
Size 10KB
SHA256 8a7187f132da8e6c117b42e6e7a9c16f7d07d2e5b383757d6779e53103ff78b6
MD5 1c351aa328382f86c26e8cdc1ddc15f1
SHA1 027bd100ab322ac4a67400f7e2bf5ede51069a92
SHA512 567f4508ec5b77e1e220a218d37511a92ea136257e711d85979ca3267e110866bdc235b8a29714474f8f2ef292b31108cfa310bdcff978863b224796608c41ce
SSDEEP 192:sxZpR8sr/fFsj1jlIdpYVHW6+WNk3Q/Zxt1G3gZryIg5rJ:sxZp7r/fFsjAgHbJ/kf
TLSH
T16D32C8566D68A9BB4CC7E21DBB54BF23D6F9043294D05E88EAFC861C04E67DD320780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59d586.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59d586.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 fce04e43d16328f5cd75176f9a19b686324d878bb56ff3f67c4242361094f9ca
MD5 66f95ee286af5b937bfa9fcc30138634
SHA1 4547577a7428725b3a17c25a232f42199183c396
SHA512 d5567111cb05da34c882b8255ac8624f7829789db344ca110880ff088bc0d542c34391e8126bf56c248f48487c08ec4e2280afa3830d6691661d894394de59a9
SSDEEP 384:nvZcIhsNNShp5tlHBGYX5E78pxa++2VMVZh6DKhH5od1:nhR71hGYu7WjlVMfYGH501
TLSH
T1BD828D7598BCAC775CFBB181F48B2A138FF85463AA846F44D1E98B1D00D76882707D2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9e6615a039f68669b4005bf90417174bf0ec16ade0118bc33e71a4328fce3b24
MD5 e716aef9f025eaae202916142657fb98
SHA1 959ef6c8749f6c11a18d397eaf91fcdf18405fe6
SHA512 f4d5a31980d7d35d29e8f2c2ad0cff5170412137f3e557a536322a8da8ed7289b545cf219fe69008a35d34365cbbb733735cd42e8a72ac3695f31e133bdb6d26
SSDEEP 192:LJONg6DphVqQmiUyPwmPy1wGYX59eziC8px2F++2qkIIiq5ZOlU6:lONg61CX1wGYX5E78pxa++27MU6
TLSH
T18512F975A4B9AC770DD7B554F4872A539FE82137AE84AF44D6E90B1C00DB74C370B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 079f9f2153ecd19ba0ae9a11ab25e4d52c1104cbfa8152e828292b799da553e1
MD5 61cd3d0df8dd1d42b21e5681495b7d6c
SHA1 cb829a578109a6d929eedcbe96b834fdcac0dbf3
SHA512 b5fa3ebfca26adc0b74fb5c4ad5819f0968e572dcbe7642f23a6012865fc1d1872b51e4ad8bb7f788cfcd456e3ba3ce023dc716c083b21e4b883e06cd4322551
SSDEEP 384:njZcIhsNN1hp5tlHBGYX5E78pxa++2VMVZh6DKhH5od1:7hI71hGYu7WjlVMfYGH501
TLSH
T1B1828D7198BC6C775CFBB181F4472A138FF85463AA846F44D2E98B1D00D76883707D2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 010353b3b269ae11aa775eb238a2818d10af1a0f009ed337b040c6d63e3603c7
MD5 c80e175d4dbf46a2ec4293082a61e7bb
SHA1 ff5032bd75c68e3c22d3d0c1559f7cae7c1ee55f
SHA512 ffc5801a05e35366a2f7c99dba97e5990a3398bb12f6dc4cf0c37829657191c5cd4a1ca028ad5999ea51ed48a9d82c47de5590a44debe25e9c47de1327f5dc24
SSDEEP 384:nbiFiZcIAzsNX8TUNTUlIl1hp5tvHBtDfQmYX5E78pxa++2LMVZh6DKhH5od1:2FQciwgj7/hSmYu7WjlLMfYGH501
TLSH
T113D2B4F598E79976E8AE5783A73E2E428EBCC05375889984F7C55D0CCC821BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

262a8ba7-7b62-440c-944f-b3714ce0d353.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\262a8ba7-7b62-440c-944f-b3714ce0d353.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f3f562b0-bb49-430d-8a54-eca87dc00738.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f3f562b0-bb49-430d-8a54-eca87dc00738.tmp
Size 8KB
SHA256 293f168e8ceb7c7d7e88daaadca126495e7a2a023044400715e5d44fde82294b
MD5 213da550b1257ab1fc1411aae384a6cf
SHA1 5a4b4d6765346c5c5b943a84368a9a09a849ea5e
SHA512 891a0eb0c6a40b072d07735b9c3bfe2dd11825ef56cda7219341a1e0246c311dc83c991632ad93ef1a86c7e0655ac14794b51cc204eae886b477fb9c8b5371ab
SSDEEP 192:LJONAh6DphmqQmiUyPw4Pyq8wGYX59eziC8jkk7kwxU6:lONAh619FRwGYX5E78bhU6
TLSH
T17102EA35E8787C7B4DE3AE45B5472B135FE8212BAA906B84D6E81E1D01D764C2306937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b412dd6eaf8707960b489665d41eed93037826144c166bba3a6f63785e395d5b
MD5 6e4ecdaaa74ecb2b6686f98501c0af10
SHA1 eec4229e2a043e86248b9d5c8f9d0f3b653104fc
SHA512 4e69dcb67dd9a1178ac35358aece88e25d5a5f211d49ce061a062e6ec55460febf637325b10b38c86a179a1c1f7ff6de69fc6c5a010836899805713fd420ec5b
TLSH
T1B941175CA6FA1148B3B36F56AFF668AD487BB8772E06D45D00110E4F0632B44C8B1B77
MD5 SHA1 SHA512 TLSH

Submit Download

2026-09-29_1b5894cd4fa7be54c15dc77402b945a6_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_r.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_1b5894cd4fa7be54c15dc77402b945a6_amadey_coinminer_darkgate_elex_glassworm_ngrbot_remcos_r.exe
Size 11.5MB
SHA256 747e5ac38581a5ee8d1dd970a18b3df0fd87c22924d35a80d85e73b8639ea13a
MD5 199d50c610003008ae332718360b4cf8
SHA1 def6513fd137cb598af31dcdf394c46b565a0e28
SHA512 a2a6ec4598c7ab71fb2e060440de8c6b026bff49ed008f3c26dac2d2aa4fe23aa45bacb2dcbb04e1c018e81f4ad9c4c8047fc57e23d3ea384dd01b0033ef8514
SSDEEP 196608:M9wiRqa21XWfE+6P/T9SymdAPJ1KpvGkKQMfKIfBAN/CIQm3p:M9xMa21XWfF63TV3J14+kKQMfKIah1QW
TLSH
T16FC6AE03B3E64125F5F31A745A7D5529492ABD311B34C0DFA2C92A4E4FF2EE2A931723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

660d3e7c-705c-48d6-9b1b-0de90984f28c.tmp

Path C:\Users\Admin\AppData\Local\Temp\660d3e7c-705c-48d6-9b1b-0de90984f28c.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

d5f8802a-f108-4906-8c00-2fbb00cd41f0.tmp

Path C:\Users\Admin\AppData\Local\Temp\d5f8802a-f108-4906-8c00-2fbb00cd41f0.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a1a695ad-3b52-4b81-b847-027b7f4fc1be.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1476_1017075491\a1a695ad-3b52-4b81-b847-027b7f4fc1be.tmp
Size 157KB
SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
MD5 088d09e1a5cd1db2f55a4f5131b75b3b
SHA1 4e017079555c92f2f9419a53ab89aae7c5425550
SHA512 f8e7a1652d20778af9e0aefef0f24bb477260eefd5c6cecd3b4e17276b7d6c8d79554e850b9a9fdd9c65095ae16dad8868df304ee7a057ec7cea5a35b9e526ad
SSDEEP 3072:sA30KAb7L7nAnBPxnb8b4HpQgHY15vClaH4d6r1tx:sAkKAb7L0Qb4HpQgoq8tx
TLSH
T182F3E1AD2FEE891ACD0B50BD3B04B38BC90A8F07820A655F735F8015997475D17A2DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1476_2083239188\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

explorer.exe

Path C:\Windows\Resources\Themes\explorer.exe
Size 135KB
SHA256 5d46e2ee8c5ab41566c6f4ac659a605af3ce5a46683b4086da9da597c39cb764
MD5 dc071ed55e79ffe23378e8bac915f34f
SHA1 0a33f5282435f6923be0c470b2fab7350a4ec6d8
SHA512 7b4d4c092f22cbd3eceb961dc53fb48ecf1e3e46a64abd99e8b75544f502e71c0775f19e64fe38153f23c5f4af62d4705109523028779e6fb35a41d010e9cc1f
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbV+0:UVqoCl/YgjxEufVU0TbTyDDalI0
TLSH
T189D30923AF11541FE825C9F128A6E67EB9325E221FA05D07B267FF05A672507B1F020F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icsys.icn.exe

Path C:\Windows\Resources\Themes\icsys.icn.exe
Size 135KB
SHA256 b6e96313c52ef594abe00eb922b3198f8908f68d818f6a600462636520c0d933
MD5 901398b284d387c7b5e5c4fef8cdc295
SHA1 07e0c54ea326886612b1d677d9270ad6c93b6fb2
SHA512 0b56828feba531225b0233d9b8d72b8a0db28296b5c21c787abe3303e1842fb86f00986e1e39c5268ae209fc13d9d882fd695deed82d81c6671a022f0b0ddc7a
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbV+R:UVqoCl/YgjxEufVU0TbTyDDalIR
TLSH
T1E3D31A13BE64452ED81189F528A9EA7DBAB15E211FE0ED173213BB543A72247B0F530F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spoolsv.exe

Path C:\Windows\Resources\spoolsv.exe
Size 135KB
SHA256 823d079954de34e0db025042a0a64642728d5bb3d88c877d6be6640e7dcce216
MD5 1632fe12b5383a0e1a080fa84256ccc3
SHA1 dbe446da85dad16ef2d9780777fec2ea4233ef24
SHA512 22c702290f725e49176a70f25998b861a727b62f5c06c07f7de460ee76a671abbfd8bfecb179e63475fdd73baf0ad057f1e36fe3a610961242aaafa48ee0141e
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbV+l:UVqoCl/YgjxEufVU0TbTyDDalIl
TLSH
T159D31A23BF10A02FEC2189F268A5D6AEBD561D362BE0BC573656BF1225B114371F121F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Windows\Resources\svchost.exe
Size 135KB
SHA256 02a9942c8e3a024906215b8b1dac28759a6b4c5d4251f05f7313c8fb0a7bf8d9
MD5 557f13c78fe2d06d4bc563d3499f3866
SHA1 37b849002bbc2ba2a6567e22707830195a2a3eea
SHA512 18be3482e53662954eda44c6f1beb70e287a12ef901d29f4f9e502078adfb305ba82b6a77e1bee4d0faaaa0133095a826c4953b33ecc038ef4c1938b862f8d7f
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbV+r:UVqoCl/YgjxEufVU0TbTyDDalIr
TLSH
T13CD3F9237E10503ED4528DF928A5DA6EBA215E3A5FD2AE8B6272F711257214773F030F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1112-0-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1112-47-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1552-45-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1728-21-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1728-687-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1984-48-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/2264-46-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4888-688-0x0000000000400000-0x000000000041F000-memory.dmp

Download