605a0dacde8281176173131b386fd27475d4ac51de246653e89a52260393e35d

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/10/2026, 12:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_68c9975aa1639d402551f25a3e81d509_elex_glassworm_hiddentear_remcos_xworm.exe
Size 300KB
Sample261001-p7ch8sy1ft
SHA256 605a0dacde8281176173131b386fd27475d4ac51de246653e89a52260393e35d
MD5 68c9975aa1639d402551f25a3e81d509
SHA1 2905bab1149db7c745261927b8d0bd42f50093df
SHA512 e8bc56f325c4a40b03c6e24b6f347a73bc2417aaaf4b67dfa0e96e59487429e88da1a969d703ddbcfa87d23db93e437fb378929fddc8d2e21ac243868d8c11c7
SSDEEP 6144:xF+Tbe+lDAA7hORQXhv4dzLOcQF5Lc4XDwKH:f6dAA7ZXi9/QF5w2DwK
TLSH
T11C642BE1A740C465D8AB96B9843BE6A7A433A24EDC68490D3CD1FF0B7D73347402799B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5776_787748208\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5776_625040726\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5776_625040726\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5776_625040726\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5776_625040726\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5776_2086849128\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5776_2086849128\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5776_787748208\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1808	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{AA36A84C-D577-4A44-A658-5E2B4FD83DAF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5656	msedge.exe
5656	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5776	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 5776	4532	2026-09-30_68c9975aa1639d402551f25a3e81d509_elex_glassworm_hiddentear_remcos_xworm.exe	91
PID 5776 wrote to memory of 6072	5776	msedge.exe	92
PID 5776 wrote to memory of 1808	5776	msedge.exe	93
PID 5776 wrote to memory of 556	5776	msedge.exe	94
PID 5776 wrote to memory of 556	5776	msedge.exe	94
PID 5776 wrote to memory of 3264	5776	msedge.exe	95
PID 5776 wrote to memory of 3264	5776	msedge.exe	95
PID 5776 wrote to memory of 3264	5776	msedge.exe	95
PID 5776 wrote to memory of 3360	5776	msedge.exe	96
PID 5776 wrote to memory of 3360	5776	msedge.exe	96
PID 5776 wrote to memory of 3360	5776	msedge.exe	96
PID 5776 wrote to memory of 472	5776	msedge.exe	97
PID 5776 wrote to memory of 472	5776	msedge.exe	97
PID 5776 wrote to memory of 472	5776	msedge.exe	97
PID 5776 wrote to memory of 5900	5776	msedge.exe	101
PID 5776 wrote to memory of 5900	5776	msedge.exe	101
PID 5776 wrote to memory of 5900	5776	msedge.exe	101
PID 5776 wrote to memory of 2408	5776	msedge.exe	105
PID 5776 wrote to memory of 2408	5776	msedge.exe	105
PID 5776 wrote to memory of 2308	5776	msedge.exe	106
PID 5776 wrote to memory of 2308	5776	msedge.exe	106
PID 5776 wrote to memory of 3448	5776	msedge.exe	109
PID 4532 wrote to memory of 3048	4532	2026-09-30_68c9975aa1639d402551f25a3e81d509_elex_glassworm_hiddentear_remcos_xworm.exe	114
PID 5776 wrote to memory of 5396	5776	msedge.exe	115
PID 5776 wrote to memory of 5396	5776	msedge.exe	115
PID 5776 wrote to memory of 5396	5776	msedge.exe	115
PID 5776 wrote to memory of 548	5776	msedge.exe	116
PID 5776 wrote to memory of 548	5776	msedge.exe	116
PID 5776 wrote to memory of 548	5776	msedge.exe	116
PID 5776 wrote to memory of 1816	5776	msedge.exe	124
PID 5776 wrote to memory of 4300	5776	msedge.exe	125
PID 5776 wrote to memory of 5172	5776	msedge.exe	126
PID 5776 wrote to memory of 3548	5776	msedge.exe	127
PID 5776 wrote to memory of 3548	5776	msedge.exe	127
PID 5776 wrote to memory of 1888	5776	msedge.exe	130
PID 5776 wrote to memory of 1888	5776	msedge.exe	130
PID 5776 wrote to memory of 116	5776	msedge.exe	131
PID 5776 wrote to memory of 116	5776	msedge.exe	131
PID 5776 wrote to memory of 5656	5776	msedge.exe	135
PID 5776 wrote to memory of 1512	5776	msedge.exe	136
PID 5776 wrote to memory of 1512	5776	msedge.exe	136

C:\Users\Admin\AppData\Local\Temp\2026-09-30_68c9975aa1639d402551f25a3e81d509_elex_glassworm_hiddentear_remcos_xworm.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_68c9975aa1639d402551f25a3e81d509_elex_glassworm_hiddentear_remcos_xworm.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2026-09-30_68c9975aa1639d402551f25a3e81d509_elex_glassworm_hiddentear_remcos_xworm.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ff9cbd8c188,0x7ff9cbd8c194,0x7ff9cbd8c1a0
    3⤵
    PID:6072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,2647636241912978959,11407658185127955145,524288 --field-trial-handle=2272,i,17855994148834024505,6792530336287126190,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,12474557513404639552,5588447051304339717,524288 --field-trial-handle=2272,i,17855994148834024505,6792530336287126190,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:8
    3⤵
    PID:556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,5151604769808014690,17169470736874786576,262144 --field-trial-handle=2272,i,17855994148834024505,6792530336287126190,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
    3⤵
    PID:3264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,8722018199348215277,3264570456366310319,2097152 --field-trial-handle=2272,i,17855994148834024505,6792530336287126190,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:1
    3⤵
    PID:3360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,14810230347824334009,10180929170826976232,2097152 --field-trial-handle=2272,i,17855994148834024505,6792530336287126190,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
    3⤵
    PID:472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,2739168157573387998,5535961461037671466,2097152 --field-trial-handle=2272,i,17855994148834024505,6792530336287126190,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:1
    3⤵
    PID:5900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3432,i,436276225086338518,8159274601755282594,524288 --field-trial-handle=2272,i,17855994148834024505,6792530336287126190,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:8
    3⤵
    PID:2408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4828,i,14580916691629524091,15885094196278699637,524288 --field-trial-handle=2272,i,17855994148834024505,6792530336287126190,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:8
    3⤵
    PID:2308
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,3899819107149557326,8320188545472301212,524288 --field-trial-handle=2272,i,17855994148834024505,6792530336287126190,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
    3⤵
    PID:3288
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,3899819107149557326,8320188545472301212,524288 --field-trial-handle=2272,i,17855994148834024505,6792530336287126190,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
    3⤵
    PID:3448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6256,i,11984871174667420684,9428955664086878924,2097152 --field-trial-handle=2272,i,17855994148834024505,6792530336287126190,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:1
    3⤵
    PID:5396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6348,i,426178084506393826,16395722700922575758,2097152 --field-trial-handle=2272,i,17855994148834024505,6792530336287126190,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:1
    3⤵
    PID:548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,2488344277898396912,7918275744552053688,524288 --field-trial-handle=2272,i,17855994148834024505,6792530336287126190,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:8
    3⤵
    PID:1816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,8827059509222785357,7236349320918985147,524288 --field-trial-handle=2272,i,17855994148834024505,6792530336287126190,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:8
    3⤵
    PID:4300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4796,i,4749663399467696457,5859696840568809037,524288 --field-trial-handle=2272,i,17855994148834024505,6792530336287126190,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
    3⤵
    PID:5172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2112,i,5601948846269467418,17554307985099505214,524288 --field-trial-handle=2272,i,17855994148834024505,6792530336287126190,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:8
    3⤵
    PID:3548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,11409196912033713608,5218053518696964969,524288 --field-trial-handle=2272,i,17855994148834024505,6792530336287126190,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:8
    3⤵
    PID:1888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=864,i,11744754021891603591,1547734542964653949,524288 --field-trial-handle=2272,i,17855994148834024505,6792530336287126190,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:8
    3⤵
    PID:116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6572,i,816272842039851609,17236468759940357259,262144 --field-trial-handle=2272,i,17855994148834024505,6792530336287126190,262144 --variations-seed-version --mojo-platform-channel-handle=864 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,4497505640676497898,7600277753214401978,524288 --field-trial-handle=2272,i,17855994148834024505,6792530336287126190,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:8
    3⤵
    PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2026-09-30_68c9975aa1639d402551f25a3e81d509_elex_glassworm_hiddentear_remcos_xworm.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:3048

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5776_2086849128\manifest.json
Size 53B
SHA256 7612538ef6ea25a2078adf4ebda2b0565546d80189b6af46bb0e1c9744d720d5
MD5 46b34a0f2dbd5b58337d4cf05bdb4797
SHA1 b190fc81ede34f9fe8f4f5dee1b915331b76cc19
SHA512 49d0691d8eea580f863190f3073552b74bd550ec8b0a1b748fa0c5a18f05a515390735264f62f1aee0590017a1e4e85e470c32bfd49dfd371a47d1493ecab664
TLSH
T1B79002600414921716C10E906571B895A391661955850D1D04551558029586CE150298
MD5 SHA1 SHA512 TLSH

Submit Download

deny_domains.list

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5776_625040726\deny_domains.list
Size 12B
SHA256 f51a7acfffec56d6751561966d947d3fd199b74528c07dabdcf5fcb33d5b2e85
MD5 085a334bdb7c8e27b7d925a596bfc19a
SHA1 1e4ad53dc335af5c6a8da2e4b4a175f37fafe2f2
SHA512 c883cb43c97a136825c6fd143f539210c234c66f9b76dfd8431f6ff014094e20b9410d7462aadee2344df8ca158def6b9a807e7cadbdfa947f6f8592e7283e34
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5776_625040726\manifest.json
Size 177B
SHA256 0e9ec9e79542b4a26ff5da5ff91ed23c0fc9d4ee655cc135b64726daafb364a0
MD5 b06cf477c7639438f14301777daaaeb4
SHA1 77f7a86139f01bf8838df12e4c839143c0958932
SHA512 526576792f56bae509e5de7936815bacbdb262884c7b06110b5ad649b8ea8260622eba0244043ee6a972395297cbcbdc830cc105bd2526b619885c6c0ce42ce5
TLSH
T18CC012DFDC509DB119EB4332156D43C4D733CF0B1546450935FB66082E25985C193500
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5776_787748208\manifest.json
Size 118B
SHA256 3f89d5f63524c77efb5facb385319a03aee54129aa22bca5f6061b8654f7bc5b
MD5 064a722d540bb9c42e4db8268426a4e1
SHA1 dbf4fe6aba40365a0646508d6f1f558d767e234a
SHA512 ce6a19905edea82b03cc4b70907393c2fd31e308c9d6e6dac649bdfbf44b04bf0ca2ffc8f0e354784258ef3d0b25bc72655302dca37897c36f0848bc9debe394
TLSH
T196B092B00C1AA03B22849320ECA066C283F80A19E8021B1E088036481F8817881366B2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 406e1aaaa5c8b619a159005e48c820d78751217c6516d8853640cbddf2a63735
MD5 27023676fdf18d7e1b4a7e6f3eced403
SHA1 ded644512ebb0dd1b6ded7856255a79781d9abfb
SHA512 ea2cc8a100eeb6fd4d770615096da8b6bfeebceacfc84a93dbde88808fbcc6068d5696423543cc15b62cc06acb300ee1b9492e062541fa680f646f5154c97d53
TLSH
T1F0F028B5C821EC3B08FD1B3960A40746F750232B2A419C5F3B3D810C8FB093B4686D2C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 919e5e4c0de6aefe806cb7266202f0e67a0a4342983a010558f4d5f70d7deac1
MD5 2752314e2f185cb2718b9dae7c8d8a5d
SHA1 fb474895bc6b6417e6c900d6d502bbe9226dcad6
SHA512 37d744dbdb8c7959d3c78b0adeb1dafe3e06eacb36fa3c469de358ed3e569c6edb2737065ed5fe5fda08b5e5c9cd026ae93ef9b66799dd2e8d84dc173ce2a72e
TLSH
T129514F86E1C25CD9DBAC5F7288C910BB763845F1B043ED0E1864C83A7B87704721C38C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598b00.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe598b00.TMP
Size 2KB
SHA256 a6a8456a590706b543b1c3f9de04281ba2b3b8eaed65d09e84596d8eeb9ad408
MD5 34c1da194b71ae68244e9b270824bc2b
SHA1 d61d37f03983ebfe5aa5f42a7f1b05f9039aa36f
SHA512 5eec3bbe961e4daf59d86c244393e8d52f9e11fe0c7d9d69b9f0255e17d0b148b503a407d8703712e3b946251005c10d223599ccf164f635482c6b736bd549a6
TLSH
T18B411D96E2401CD9EBAD4F76C9D520B7763848F27497ED0E4864D83A7B8B318B31839C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 406d9405a89b0e051ab484eb02c019cc785b75c72b5cf34b0243fb3c053fa099
MD5 32ec351dc42dc7509a5b9c618aace241
SHA1 08098e09bb6cbc17c853800aa123ffda0feeb23d
SHA512 d9b5650f841885cabd199d1567a64f7e2d75cf65c47f4e7937b6df697c92cfe8c782d313e162cf2ee4514dac077d593372a4f45dfb1c233248ae6c6b5a3b9259
TLSH
T1F851AFF783E4856E890196F0A618AE2FDF2D0615432C7C5989D4EE27D3E3471E14159F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6ab72302ad47517ad6c0f2d1ee80e1fd25d9ae14749e3463aec82b11bc78c503
MD5 41c1ab0ca29f4416bb37a0e2a0090884
SHA1 b16d791591feea8cad11b6d61eae3f1aea56d146
SHA512 23246f6007f4cfbfba2a0bdeb378878111ccb922bdc2da6863c33bd91f0b786a4718284267407edb2ec2664db13c522b188d9bbb0ee1355e140c5464f6f7fb42
SSDEEP 192:sxZeRUjy/f3scGaQZLj58ozodp6yHW6+WNHhmfYfUpwSMxIg50t5J:sxZeiy/f3scfOP+b1HbsfgSkytj
TLSH
T1D342F915AE28697B8CC7E219FB55BF53E3F9503390910E48AAFC8A2C15E76DD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 1c646cb3aacbfa343a4ea2b6572a775d722e49ac4b1b8f00a1b15d0cacce0475
MD5 3a02628a3a29da647bf2a28b360ac84f
SHA1 8138d9fee7eb53ea304f9780c8cb3a12e01adff3
SHA512 3f69671126d3f95134e2a6e4b194862763ac4b263a7cf6f27b0a1d45345e8e3078a4566295548e96f7965490285ef852aafcf644464ce15788734ebbbed7fef1
SSDEEP 192:sxZeRUjy/f3sSGaQZLju8ozodp61HW6+WNH/8/YobwSMxIgjt5J:sxZeiy/f3sSfOP1bOHb0/KSkjtj
TLSH
T17442E805AD28A97B8CC7E219FB55BF52E3F9503390D11E48AAFC8A1C15EB6DD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 acb7f3d250690bfb3817cec60685c526e251cb22dc8e32a85169afc37c402038
MD5 54faccf7bc85153131f13a6b1aa669a7
SHA1 96e57c9d9dcf097687725410bbff0e4f101547a9
SHA512 92e3292d52d8547b5c87e2e59e65ab7cf238223e353634a3c1dae7e7bd3deb21ca547fa4135a3593f8bef6f4ba3e422e7b47034d07de13a0f2237a89bba3316e
SSDEEP 192:sxZeRUjy/f3scwQZLj58ozodp6yHW6+WNHhmfYfUmwSMxIg5Q4trJ:sxZeiy/f3scwOP+b1HbsfhSkxt9
TLSH
T19B520A45AE28697B8CC7E219FB55BF53E3F9503390810E48AAFC8A2C14E76DD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 d5767d079919928f98db7a2a300b70de892475837dfe6c4999f1eced79bb4ba9
MD5 9ab582e5d01109658fd2c065e759f85d
SHA1 a986b69cd2ca84c8947546cd32ef24dd5b0cd41c
SHA512 0d34dc1844d3770265aa2abba97285a5cab7324c1c1d7ce0bde7fd9d2dee98baa4098df97a6b23dbdba16fe9713a513a6037c34e56b2b1465a1874aac734b024
SSDEEP 768:Px6r8sW7pLuLbG+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVz1qpLlvVajYroR:Px6r8s2EbG+WviyUKu1ja+1qpLd4jjog
TLSH
T1A5E2F97B780CCE7E4FC05A9DDD1A7F8B6DA802CB9698C94087FA945C02C67EA51170DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 5a0dd799fdb3279d5d4ee46e4436eabc24f9ac87a0e863c9dee1092254580ccb
MD5 1574978e2e4774ff15e38bac9f155919
SHA1 bf599496ebde831a79c9d11838853d4a180c7ad8
SHA512 cec8f1b274c65075a4b2291a8857e8fa092585e9c10bd82540336afc89a52de0fd1aaf0ee5568cd3f7ea319270b4315bd2cc2b28fc0d26e9d3b6d7b8f7ada6ab
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdgS:ST/2dXOJhJlpfnpp3tNXVrN3CB//
TLSH
T167B2351571BB421039FE391892B6972E064271B33119E66B7FBD04B68E2BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.25\data.txt
Size 152KB
SHA256 4e932235a6fefae59866c98f69253bf2d3d0e7e2a2a9ae546685bc4646f9a297
MD5 b5394eb229ba53caf4fc321b5087e299
SHA1 b84ae45b51a9d200639a10ea487b1ba9b94ed3eb
SHA512 6e6f890c6fc57d470e2bedaf5b022d13e54762c8d424a4a43493b7eb68f2d22be2a1641f5ffa25a1756fef938841ec50c908e97161da28158a2c7e3b258b39d0
SSDEEP 3072:wPAgDcCHaLHl65aynyosxb3+BLvf55rOiWF4Vkia/UFwK:cX1aI5aZoKzMDXrOiW1igUB
TLSH
T1AAE3F240C9D0AFDDCEA8161C90BE0F1963E1CA8EC13A958ADB23FD4B6FD3A045A175D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 bb29027b70a5ca033934a6aa3d6acf4589f2145dc305388b90153edd5a4734c0
MD5 01d3bae187695fd8771df3ff07c822af
SHA1 aba4c55985b2b515f9235062000f07b1e6ac6e56
SHA512 9dbefec0b162dd0146eb185b6cc33fb103eed394d717c9c17decd3f5f57f3956ca2224c90df745f46064bbb1aad273c81c089d1bcc13a705fb6b8463b59f08f1
SSDEEP 384:nKiFiZcI63sNs8TUNTUlIm2aKMit4w2fLBCv4ikA6d/XHsa+VYMdgL/7IzGoR:BFQ63Bwgc0oBCv4w6BXHhgKa
TLSH
T18EC24A32EC98D9ABE8FA4FD6AB4A7703DEF41163959C5AD4DAD81C1D00971DD030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 ee4e2ed7cc58bad4877ae4fd270ea4babc9f4c481aabd9c8f69f1d07efded057
MD5 a7dc478991cac52c016ae8410e703ec9
SHA1 f00840e3aa598c04130871c96fc11ae1d01f7660
SHA512 61bac3f51a8c99d224a0af055661c60221191d33dbac0f3809438cad946fff70183b328105d15c220521885a10940c580903baff773b0bce09bdbc41c050dfc4
SSDEEP 384:n2iFiZcIqA3sNp8TUNTUlI4OaKMJNg2w2fLBCv4ikA6dvu3sgtgOIwZOyiEfgL/6:dFQj3wwgmJgWBCv4w6lisgXsA5z
TLSH
T14CE280F198D799B6D8EE1B87A77D6E029EBCD053B4984984B7D41C1DCC821BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 026190be5aca8006056ab424194309eaa6e2e5482de9207f380763d0735cc1a2
MD5 f806115aeca8bf1a57296a4a6fa49911
SHA1 bbcc772c8a80277d949334322d24cb5eca7adb5a
SHA512 2bcd275ba290548b456d32991ec19fd9d99c76fd65cf4978ceb56d842de6be15f1008753d6e99fa4a199ae4fc07429796ab5295240b4746db494633734283531
SSDEEP 384:nSiFiZcIS3sNp8TUNTUlI4OaKMybfw2fLBCv4ikA6dvu2kgtgOIwZOyiEfgL/7I5:ZFQS3wwgmoFBCv4w6lRkgXsA5z
TLSH
T1CDC24A32ECA8DABBECEB5F89A74A7603DEF01163959C8AD4D9D95C1D009319D030BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 1845d733d5e12f8bb98c948634041d22ca7df33f84bbece4a2ded3bee2316bca
MD5 0ea550bcd1fb2504eef23466f4d67340
SHA1 221d9b7870c5ef8b1c98b733c441c6ba58d92d72
SHA512 63d6ea8381285d8323fa82d63e9757b0c5d3e840bbdc939dc7419cb466100e07fa3cfb56b8092095e21e1e566f0f8fe9a0f1c3811e079634d2a9047d07a43fde
SSDEEP 384:nsiFiZcIS3sNp8TUNTUlI4OaKMJUg2w2fLBCv4ikA6dvu2kgtgOIwZOyiEfgL/7W:XFQS3wwgmggWBCv4w6lRkgXsA5z
TLSH
T10FC24A32ECA8DABBECEB5F89A74A7603DEF01163959C8AD4D9D95C1D009319D030BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.9.30.1\typosquatting_list.pb
Size 1.4MB
SHA256 5435d91bee48abb353a7d203b4b7eecac6d2901a96fd0c934fcc8ecf173e5563
MD5 5bff34d92fc5a86bef266b458a6efc08
SHA1 95e2c2b9d976cb7855d6f7092ecb0cb241617182
SHA512 02625a49261c12154ebe377df81d4457ba449801273dcb27d742dfea86329b1da7088484467ff9ab6dae4e649783201a58efb9fbad630c0e29d1191b2ccec20d
SSDEEP 6144:NwUhpkDDI4SQRKjrKu5ujaJ+jb+1zIs4nKvL0+7rbKQPCL/LsBjeLXgJ1NCry25u:NtpiDI4daZHlIXKNYYZfdhvn8RZJcv+Y
TLSH
T1B365B5B9DFC00194DBB8112D20BE71D8181412A540E9DFEAFE7C855F2BC6AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 eca2084175ab635d925577691d9ad246a22dec9834466eb384e6a4c6292df7b6
MD5 f6a9eddf2a3b404cb9de79efea17c3cf
SHA1 7983da215bc23a42f24a4926efd76bec6783c55a
SHA512 e59bf041b47554f6e25eb6ee0776825ae9e88de12bf2b56a4b8bef6b5cdc1682f4b4d8581ffb5d922d15a4bc1263bb29c1be5df700afd0f04528230317b61eab
TLSH
T100510DE05C3C5AD1D4BD0E7EB09B39EC95E89621B8A434796858E9988A7A61D3084C3F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 2bd6089a369908eb7219d1a2fd83f33d2f0acccaa41e3b8b51a6c970cebaf107
MD5 25554b539b48fa9745a888068fbb1b8e
SHA1 f988dacf1d3cf5045bf0e8b0d40953dbfe51269b
SHA512 835a063675d209867c7b728d34e933eab36bc0edbb9384a0df85bd6109c1f12b712f9eaa08180049398c4a383114199ab654b477c8cf3e24cfec311e167317d7
TLSH
T1AE510ED05C385AD1D5BD0E7EB09B39EC91ECD721B8A434792C58E9985A7A61D308083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 6406ef8579ee45ec3e15db4712b2798b55228d5642b270c7364107fb466b678b
MD5 680b5906b1dc40f5b7414cebbad44a6a
SHA1 a5f722b7b3202db3a70eb7cb98d32079a559da92
SHA512 a5ffb3b116f94c638f9f7ade2e8af91913da664b7633d50bce0a9a8aa7dce921ea33043c1c77af8882220f8859d8a758e7f551f5ea544b03490a0ab100ef0b7e
TLSH
T1EA512DE04C3C5AD1D4BD0E7EB49B35EC95EC9621B8A434392858E9988A3AA1D3084C3F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4de6a3ca904a041a5f1e016faf7357f20611e4b8de8990847d5e45cf781ab63e
MD5 85d1360a98fda678f676a1ac9f0f5151
SHA1 a48d4adf7d42ff523bdf0a79fe3d6ccf9320a529
SHA512 f27744a6769ff72688af4bbc530bd166ca4f3a31ae2730ba5c936a5f68ef4c541c47ebfbd4666f18cc23cf607e0587da744a8835e654b9d64047b862f1541877
TLSH
T13E414D58B5F91109F3B36E0AABF7A86D887B7C772E46D45D10120E4F0A23A40C971737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3448-241-0x000002A4589F0000-0x000002A4599F0000-memory.dmp

Download