018e1b6272ef517e287b0923bc1cc5a7473436c3d7acd326a0e024d5bb34d7d0

Analysis

max time kernel
150s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/10/2026, 16:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-21_97ab0fe4fbf4b832c9af04e90db7e485_amadey_coinminer_darkgate_elex_glassworm_remcos_rhadaman.exe
Size 10.5MB
Sample261022-ttpzmaf13k
SHA256 018e1b6272ef517e287b0923bc1cc5a7473436c3d7acd326a0e024d5bb34d7d0
MD5 97ab0fe4fbf4b832c9af04e90db7e485
SHA1 3029a437423851e3994961898f1fa18eebf7790a
SHA512 06f627d0b24c002c583a5cceeaa96fa62cc5e01096228bd479a5d7f8c495ae910557ccefc431afbfc39c21f2c1b1f8aecab231c98dc8ed987b1120ae3a92b4ba
SSDEEP 196608:Bd0Mpunpm9LJ5PyPN7N/e/BCYEUnoPlPYfTy1AXw6LeyYHg:B+Quns9LJ5PIN7N/EM2otPYfTy1P6eyt
TLSH
T1B2B6AE0377E64125F5F306745A7D45295E3ABD211B38C0DFA2C92A4E4BF2EE2A931723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence

Malware Config

Signatures

Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Custom signature

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024617-7.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Executes dropped EXE 6 IoCs

pid	Process
2304	2026-10-21_97ab0fe4fbf4b832c9af04e90db7e485_amadey_coinminer_darkgate_elex_glassworm_remcos_rhadaman.exe
4660	icsys.icn.exe
1092	explorer.exe
1896	spoolsv.exe
5648	svchost.exe
1464	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_97976988\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_228442341\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\service_worker_bin_prod.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\_locales\iw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\_locales\uz\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_228442341\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\offscreendocument.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\_locales\or\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\_locales\sr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\_locales\de\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_896316004\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_97976988\crl-set	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_3772_808295689\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_111_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\_locales\as\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\_locales\pa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\_locales\sl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\_locales\ml\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_228442341\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_896316004\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\128.png	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\_locales\fa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_896316004\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3772_1048131191\_locales\bn\messages.json	msedge.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	2026-10-21_97ab0fe4fbf4b832c9af04e90db7e485_amadey_coinminer_darkgate_elex_glassworm_remcos_rhadaman.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-21_97ab0fe4fbf4b832c9af04e90db7e485_amadey_coinminer_darkgate_elex_glassworm_remcos_rhadaman.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-21_97ab0fe4fbf4b832c9af04e90db7e485_amadey_coinminer_darkgate_elex_glassworm_remcos_rhadaman.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-21_97ab0fe4fbf4b832c9af04e90db7e485_amadey_coinminer_darkgate_elex_glassworm_remcos_rhadaman.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-21_97ab0fe4fbf4b832c9af04e90db7e485_amadey_coinminer_darkgate_elex_glassworm_remcos_rhadaman.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3176	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{054132A0-ABAC-4667-B94B-CC6A93EBC563}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5740	2026-10-21_97ab0fe4fbf4b832c9af04e90db7e485_amadey_coinminer_darkgate_elex_glassworm_remcos_rhadaman.exe
5740	2026-10-21_97ab0fe4fbf4b832c9af04e90db7e485_amadey_coinminer_darkgate_elex_glassworm_remcos_rhadaman.exe
5740	2026-10-21_97ab0fe4fbf4b832c9af04e90db7e485_amadey_coinminer_darkgate_elex_glassworm_remcos_rhadaman.exe
5740	2026-10-21_97ab0fe4fbf4b832c9af04e90db7e485_amadey_coinminer_darkgate_elex_glassworm_remcos_rhadaman.exe
5740	2026-10-21_97ab0fe4fbf4b832c9af04e90db7e485_amadey_coinminer_darkgate_elex_glassworm_remcos_rhadaman.exe
5740	2026-10-21_97ab0fe4fbf4b832c9af04e90db7e485_amadey_coinminer_darkgate_elex_glassworm_remcos_rhadaman.exe
5740	2026-10-21_97ab0fe4fbf4b832c9af04e90db7e485_amadey_coinminer_darkgate_elex_glassworm_remcos_rhadaman.exe
5740	2026-10-21_97ab0fe4fbf4b832c9af04e90db7e485_amadey_coinminer_darkgate_elex_glassworm_remcos_rhadaman.exe
5740	2026-10-21_97ab0fe4fbf4b832c9af04e90db7e485_amadey_coinminer_darkgate_elex_glassworm_remcos_rhadaman.exe
5740	2026-10-21_97ab0fe4fbf4b832c9af04e90db7e485_amadey_coinminer_darkgate_elex_glassworm_remcos_rhadaman.exe
5740	2026-10-21_97ab0fe4fbf4b832c9af04e90db7e485_amadey_coinminer_darkgate_elex_glassworm_remcos_rhadaman.exe
5740	2026-10-21_97ab0fe4fbf4b832c9af04e90db7e485_amadey_coinminer_darkgate_elex_glassworm_remcos_rhadaman.exe
5740	2026-10-21_97ab0fe4fbf4b832c9af04e90db7e485_amadey_coinminer_darkgate_elex_glassworm_remcos_rhadaman.exe
5740	2026-10-21_97ab0fe4fbf4b832c9af04e90db7e485_amadey_coinminer_darkgate_elex_glassworm_remcos_rhadaman.exe
5740	2026-10-21_97ab0fe4fbf4b832c9af04e90db7e485_amadey_coinminer_darkgate_elex_glassworm_remcos_rhadaman.exe
5740	2026-10-21_97ab0fe4fbf4b832c9af04e90db7e485_amadey_coinminer_darkgate_elex_glassworm_remcos_rhadaman.exe
5740	2026-10-21_97ab0fe4fbf4b832c9af04e90db7e485_amadey_coinminer_darkgate_elex_glassworm_remcos_rhadaman.exe
5740	2026-10-21_97ab0fe4fbf4b832c9af04e90db7e485_amadey_coinminer_darkgate_elex_glassworm_remcos_rhadaman.exe
5740	2026-10-21_97ab0fe4fbf4b832c9af04e90db7e485_amadey_coinminer_darkgate_elex_glassworm_remcos_rhadaman.exe
5740	2026-10-21_97ab0fe4fbf4b832c9af04e90db7e485_amadey_coinminer_darkgate_elex_glassworm_remcos_rhadaman.exe
5740	2026-10-21_97ab0fe4fbf4b832c9af04e90db7e485_amadey_coinminer_darkgate_elex_glassworm_remcos_rhadaman.exe
5740	2026-10-21_97ab0fe4fbf4b832c9af04e90db7e485_amadey_coinminer_darkgate_elex_glassworm_remcos_rhadaman.exe
5740	2026-10-21_97ab0fe4fbf4b832c9af04e90db7e485_amadey_coinminer_darkgate_elex_glassworm_remcos_rhadaman.exe
5740	2026-10-21_97ab0fe4fbf4b832c9af04e90db7e485_amadey_coinminer_darkgate_elex_glassworm_remcos_rhadaman.exe
5740	2026-10-21_97ab0fe4fbf4b832c9af04e90db7e485_amadey_coinminer_darkgate_elex_glassworm_remcos_rhadaman.exe
5740	2026-10-21_97ab0fe4fbf4b832c9af04e90db7e485_amadey_coinminer_darkgate_elex_glassworm_remcos_rhadaman.exe
5740	2026-10-21_97ab0fe4fbf4b832c9af04e90db7e485_amadey_coinminer_darkgate_elex_glassworm_remcos_rhadaman.exe
5740	2026-10-21_97ab0fe4fbf4b832c9af04e90db7e485_amadey_coinminer_darkgate_elex_glassworm_remcos_rhadaman.exe
5740	2026-10-21_97ab0fe4fbf4b832c9af04e90db7e485_amadey_coinminer_darkgate_elex_glassworm_remcos_rhadaman.exe
5740	2026-10-21_97ab0fe4fbf4b832c9af04e90db7e485_amadey_coinminer_darkgate_elex_glassworm_remcos_rhadaman.exe
5740	2026-10-21_97ab0fe4fbf4b832c9af04e90db7e485_amadey_coinminer_darkgate_elex_glassworm_remcos_rhadaman.exe
5740	2026-10-21_97ab0fe4fbf4b832c9af04e90db7e485_amadey_coinminer_darkgate_elex_glassworm_remcos_rhadaman.exe
2304	2026-10-21_97ab0fe4fbf4b832c9af04e90db7e485_amadey_coinminer_darkgate_elex_glassworm_remcos_rhadaman.exe
2304	2026-10-21_97ab0fe4fbf4b832c9af04e90db7e485_amadey_coinminer_darkgate_elex_glassworm_remcos_rhadaman.exe
4660	icsys.icn.exe
4660	icsys.icn.exe
4660	icsys.icn.exe
4660	icsys.icn.exe
4660	icsys.icn.exe
4660	icsys.icn.exe
4660	icsys.icn.exe
4660	icsys.icn.exe
4660	icsys.icn.exe
4660	icsys.icn.exe
4660	icsys.icn.exe
4660	icsys.icn.exe
4660	icsys.icn.exe
4660	icsys.icn.exe
4660	icsys.icn.exe
4660	icsys.icn.exe
4660	icsys.icn.exe
4660	icsys.icn.exe
4660	icsys.icn.exe
4660	icsys.icn.exe
4660	icsys.icn.exe
4660	icsys.icn.exe
4660	icsys.icn.exe
4660	icsys.icn.exe
4660	icsys.icn.exe
4660	icsys.icn.exe
4660	icsys.icn.exe
4660	icsys.icn.exe
4660	icsys.icn.exe
4660	icsys.icn.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1092	explorer.exe
5648	svchost.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3772	msedge.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
5740	2026-10-21_97ab0fe4fbf4b832c9af04e90db7e485_amadey_coinminer_darkgate_elex_glassworm_remcos_rhadaman.exe
5740	2026-10-21_97ab0fe4fbf4b832c9af04e90db7e485_amadey_coinminer_darkgate_elex_glassworm_remcos_rhadaman.exe
4660	icsys.icn.exe
4660	icsys.icn.exe
1092	explorer.exe
1092	explorer.exe
1896	spoolsv.exe
1896	spoolsv.exe
5648	svchost.exe
5648	svchost.exe
1464	spoolsv.exe
1464	spoolsv.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 5740 wrote to memory of 2304	5740	2026-10-21_97ab0fe4fbf4b832c9af04e90db7e485_amadey_coinminer_darkgate_elex_glassworm_remcos_rhadaman.exe	85
PID 5740 wrote to memory of 4660	5740	2026-10-21_97ab0fe4fbf4b832c9af04e90db7e485_amadey_coinminer_darkgate_elex_glassworm_remcos_rhadaman.exe	86
PID 4660 wrote to memory of 1092	4660	icsys.icn.exe	87
PID 1092 wrote to memory of 1896	1092	explorer.exe	88
PID 1896 wrote to memory of 5648	1896	spoolsv.exe	89
PID 5648 wrote to memory of 1464	5648	svchost.exe	90
PID 2304 wrote to memory of 3772	2304	2026-10-21_97ab0fe4fbf4b832c9af04e90db7e485_amadey_coinminer_darkgate_elex_glassworm_remcos_rhadaman.exe	102
PID 3772 wrote to memory of 448	3772	msedge.exe	103
PID 3772 wrote to memory of 3176	3772	msedge.exe	105
PID 3772 wrote to memory of 4316	3772	msedge.exe	106
PID 3772 wrote to memory of 4316	3772	msedge.exe	106
PID 3772 wrote to memory of 4316	3772	msedge.exe	106
PID 3772 wrote to memory of 1624	3772	msedge.exe	107
PID 3772 wrote to memory of 1624	3772	msedge.exe	107
PID 3772 wrote to memory of 4084	3772	msedge.exe	108
PID 3772 wrote to memory of 5280	3772	msedge.exe	109
PID 3772 wrote to memory of 4084	3772	msedge.exe	108
PID 3772 wrote to memory of 4084	3772	msedge.exe	108
PID 3772 wrote to memory of 5280	3772	msedge.exe	109
PID 3772 wrote to memory of 5280	3772	msedge.exe	109
PID 3772 wrote to memory of 4416	3772	msedge.exe	113
PID 3772 wrote to memory of 4416	3772	msedge.exe	113
PID 3772 wrote to memory of 4416	3772	msedge.exe	113
PID 3772 wrote to memory of 1164	3772	msedge.exe	114
PID 3772 wrote to memory of 1164	3772	msedge.exe	114
PID 3772 wrote to memory of 3012	3772	msedge.exe	115
PID 3772 wrote to memory of 3012	3772	msedge.exe	115
PID 3772 wrote to memory of 5764	3772	msedge.exe	117
PID 3772 wrote to memory of 2428	3772	msedge.exe	123
PID 3772 wrote to memory of 1160	3772	msedge.exe	124
PID 3772 wrote to memory of 3280	3772	msedge.exe	125
PID 3772 wrote to memory of 3764	3772	msedge.exe	126
PID 3772 wrote to memory of 3764	3772	msedge.exe	126
PID 3772 wrote to memory of 3564	3772	msedge.exe	127
PID 3772 wrote to memory of 3564	3772	msedge.exe	127
PID 3772 wrote to memory of 5836	3772	msedge.exe	128
PID 3772 wrote to memory of 5836	3772	msedge.exe	128
PID 3772 wrote to memory of 5804	3772	msedge.exe	129
PID 3772 wrote to memory of 5804	3772	msedge.exe	129
PID 3772 wrote to memory of 2756	3772	msedge.exe	132
PID 3772 wrote to memory of 2756	3772	msedge.exe	132
PID 3772 wrote to memory of 3728	3772	msedge.exe	133
PID 3772 wrote to memory of 3728	3772	msedge.exe	133
PID 3772 wrote to memory of 620	3772	msedge.exe	134
PID 3772 wrote to memory of 620	3772	msedge.exe	134
PID 3772 wrote to memory of 3508	3772	msedge.exe	135

C:\Users\Admin\AppData\Local\Temp\2026-10-21_97ab0fe4fbf4b832c9af04e90db7e485_amadey_coinminer_darkgate_elex_glassworm_remcos_rhadaman.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-21_97ab0fe4fbf4b832c9af04e90db7e485_amadey_coinminer_darkgate_elex_glassworm_remcos_rhadaman.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5740
- \??\c:\users\admin\appdata\local\temp\2026-10-21_97ab0fe4fbf4b832c9af04e90db7e485_amadey_coinminer_darkgate_elex_glassworm_remcos_rhadaman.exe
  c:\users\admin\appdata\local\temp\2026-10-21_97ab0fe4fbf4b832c9af04e90db7e485_amadey_coinminer_darkgate_elex_glassworm_remcos_rhadaman.exe
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.surfright.nl/downloads/#x64
    3⤵
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d4,0x7ff8ade7c188,0x7ff8ade7c194,0x7ff8ade7c1a0
      4⤵
      PID:448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2008,i,5575251300822538974,2407880257746609756,524288 --field-trial-handle=2352,i,16897408031405192994,15560629334120661449,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:3
      4⤵
      System Time Discovery
      PID:3176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1916,i,4188397568753287907,17382933832554504713,262144 --field-trial-handle=2352,i,16897408031405192994,15560629334120661449,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
      4⤵
      PID:4316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2336,i,10841533564547317574,6392926387527093458,524288 --field-trial-handle=2352,i,16897408031405192994,15560629334120661449,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:8
      4⤵
      PID:1624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3392,i,4029144112940727062,4804971347559454925,2097152 --field-trial-handle=2352,i,16897408031405192994,15560629334120661449,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
      4⤵
      PID:4084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3404,i,17706121618876576782,8671162230854565902,2097152 --field-trial-handle=2352,i,16897408031405192994,15560629334120661449,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
      4⤵
      PID:5280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4860,i,9379427363912508564,9343264625243862667,2097152 --field-trial-handle=2352,i,16897408031405192994,15560629334120661449,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:1
      4⤵
      PID:4416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,3807969678798130913,14595387531799193673,524288 --field-trial-handle=2352,i,16897408031405192994,15560629334120661449,262144 --variations-seed-version --mojo-platform-channel-handle=3876 /prefetch:8
      4⤵
      PID:1164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,2605375765554835797,2076497492190825901,524288 --field-trial-handle=2352,i,16897408031405192994,15560629334120661449,262144 --variations-seed-version --mojo-platform-channel-handle=3920 /prefetch:8
      4⤵
      PID:3012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,12537374556227148386,17499289689112619603,524288 --field-trial-handle=2352,i,16897408031405192994,15560629334120661449,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:8
      4⤵
      PID:5320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,12537374556227148386,17499289689112619603,524288 --field-trial-handle=2352,i,16897408031405192994,15560629334120661449,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:8
      4⤵
      PID:5764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,14252658162170764893,15438772836979196639,524288 --field-trial-handle=2352,i,16897408031405192994,15560629334120661449,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:8
      4⤵
      PID:2428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5596,i,7640835009140130444,1309970286236283014,524288 --field-trial-handle=2352,i,16897408031405192994,15560629334120661449,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:8
      4⤵
      PID:1160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,2263088103795388504,7477707501530066905,524288 --field-trial-handle=2352,i,16897408031405192994,15560629334120661449,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
      4⤵
      PID:3280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,17808717088786191297,4017490802926353703,524288 --field-trial-handle=2352,i,16897408031405192994,15560629334120661449,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
      4⤵
      PID:3764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,10068539860357881835,408287641663198282,524288 --field-trial-handle=2352,i,16897408031405192994,15560629334120661449,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
      4⤵
      PID:3564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2700,i,3135215091050500362,5677132494431398091,524288 --field-trial-handle=2352,i,16897408031405192994,15560629334120661449,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:8
      4⤵
      PID:5836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,17425652934453564983,1773022032810050502,524288 --field-trial-handle=2352,i,16897408031405192994,15560629334120661449,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
      4⤵
      PID:5804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,9086070275532412916,13381461738518864242,524288 --field-trial-handle=2352,i,16897408031405192994,15560629334120661449,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:8
      4⤵
      PID:2756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=892,i,16506115144830033391,7393548725991909053,524288 --field-trial-handle=2352,i,16897408031405192994,15560629334120661449,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:8
      4⤵
      PID:3728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,2741073385436908795,7422503902915265184,524288 --field-trial-handle=2352,i,16897408031405192994,15560629334120661449,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:8
      4⤵
      PID:620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6272,i,15556536141200952218,17490912653749773632,262144 --field-trial-handle=2352,i,16897408031405192994,15560629334120661449,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:8
      4⤵
      PID:3508
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4660
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Modifies visibility of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1092
  - - \??\c:\windows\resources\spoolsv.exe
      c:\windows\resources\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1896
    - - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        5⤵
        Modifies visibility of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5648
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1464

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

deny_domains.list

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3772_228442341\deny_domains.list
Size 12B
SHA256 f51a7acfffec56d6751561966d947d3fd199b74528c07dabdcf5fcb33d5b2e85
MD5 085a334bdb7c8e27b7d925a596bfc19a
SHA1 1e4ad53dc335af5c6a8da2e4b4a175f37fafe2f2
SHA512 c883cb43c97a136825c6fd143f539210c234c66f9b76dfd8431f6ff014094e20b9410d7462aadee2344df8ca158def6b9a807e7cadbdfa947f6f8592e7283e34
MD5 SHA1 SHA512

Submit Download

deny_etld1_domains.list

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3772_228442341\deny_etld1_domains.list
Size 7KB
SHA256 58e5e10f9162d0d0f74816f31dac4900370c2694ad888eb591f22c20b37f9d7a
MD5 36fb073dade50ae77240d380b0702b83
SHA1 df510f600ff6e92f6a3f454084299755a34e9aca
SHA512 f855b4db01caaa05d582ec2b91aca8d9fceae212ce15b2d9b149cfc26612a07c6ecabaf7d2d85806715472c47a2fca01e806fe57ec1532ed56202d975879bda9
SSDEEP 192:p3PsmEnN5ppcqQowyXB7NmSw2uGxldQyr2mD+GPG5J:GHbcNowyXubCDj+kGn
TLSH
T1EAE1AF6C59E1722C629CA8052AC68B8064E50F39BEBF517039FE8F991653C661FE2803
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

deny_full_domains.list

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3772_228442341\deny_full_domains.list
Size 12KB
SHA256 19e871f69e774c847717469957dd18f342712e702d2c54c5efb8542907bcbabd
MD5 85a2a44606d0d937cb7c3cb97549d1dc
SHA1 27081c556bfa37eef2ac2b0bfafecf90dfa8662d
SHA512 3f564a6b0b71ff54e3cf0e7addd91fb63a2e0d477cacaf73409fcd4c29cfa2076e76d0ca0e330c4fd0fba6cdaec8f118401bb2ce0f83af9e334cd603adb61d24
SSDEEP 192:3zjGRPX/DE6OGcrMHNK17dYuybxV3SOZTAnbtIBzkJkW9ELtW74zPJ1vRbmZM0ED:PAPYmhKh8RvOkWYtW74zBI1F71WqEgOR
TLSH
T16D42D04EF5E8A884C70E0AE50B8C759EDE0A514087A22BD53FB57B5F6988CB9FB11601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3772_896316004\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3772_896316004\_metadata\verified_contents.json
Size 1KB
SHA256 c9e76a313bb06d9d761611d7cb8c2ab8de59eb9959b77458138630dacebaeb0e
MD5 243afa1f565d5789d05d9762162cfa32
SHA1 7c7b6757be9b6ae391a59b940ddfb646cf6ce732
SHA512 671b53dd21e4566df6fb4ef811fb95382447f57a82d497de029ce1528aaaa47f26277615f6ca91ffe4834598b2a0b5b78ec2f2dabed2ef704581cbb990ad67a2
TLSH
T11F3119B8380E324F90A7E30425BB9D33534570BE13E0A517B1C26A4E5598A40B2732FA
MD5 SHA1 SHA512 TLSH

Submit Download

crl-set

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3772_97976988\crl-set
Size 13KB
SHA256 b85327be29f5d0a5be4a47da5bf5062f5115bda5e9827db40ac4776d829ccd18
MD5 5111ab39b220749a299b5bb7cd25c730
SHA1 970c9013ee629ded1b5d2a058cd147950c3544ab
SHA512 37caae776f5d9365367e12a6ca13e07761f09b3cf6d1f9ea9523af89e6f2579afdd148d3942822358a49ac597a544c30bdf070aee051d69d8a0adab6f6af708a
SSDEEP 384:oeYPnEDMU2kk0yu7uCnglcJUoCzL4pv2W9cBTgE:ojPEoMk67R1UoCwV2W0cE
TLSH
T16152AF4FDDC4A62AF03911AE982262A412794A8552554B731B6C3A64BCFB28D4E38C3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

69eccb50-9e48-48ef-b8bb-61e76899d3cc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\69eccb50-9e48-48ef-b8bb-61e76899d3cc.tmp
Size 26KB
SHA256 a27d8a14ce2381d6edbf4f6ee647558d1966d720ecee25da02be0570550683a3
MD5 3d07ff8628b116fa92c1468d33d0c7c1
SHA1 971022fa565818a3270d725694b526114150f774
SHA512 2bcb7bd7abe55c181f1597e53f56ef30c89a9359e086b131a33c676738c82c6f6222a3a2ad1bb847400d421f401a022de0ed0c7587644cee70f805d0dd389840
SSDEEP 768:+eFd139wgjG2ZBCcX8KQl/n1iGvys94yL4:R133fM1D6cFc
TLSH
T1D4C25B32E899DEABEDEB5B95B30E3643EEE01263C98C4AD4D9D90D5C00C719D274BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

85d5d033-8caf-47d9-a96f-0539e07d6d64.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\85d5d033-8caf-47d9-a96f-0539e07d6d64.tmp
Size 31KB
SHA256 2787b3e55d6feb569774d6217e8416d419c6938d364311bf2bf7fd866c40340f
MD5 a9a9eede220e69b6806da2773af6b464
SHA1 c7e8b4b411baa949a841f2c27ee7448c58da91c9
SHA512 bfb376acf426bb2e05b49a8674e4af6fff6ade355402ef4edee6dd2aa4ce4aefa9ca526e6df140e214cf894e07dd7be7129e40502a8759d12e97035d24c05e51
SSDEEP 768:+mFd739wgjGYZBCcX8KQl/n6mGvys94yL4:97335M6f6cFc
TLSH
T181E2A2F198D799B7D9AE4B97633D2D4299BCD153B8884A94F7C40C1CCC821BFD34A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

91be6544-d5f8-4eab-8cb9-15cbf895a386.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\91be6544-d5f8-4eab-8cb9-15cbf895a386.tmp
Size 26KB
SHA256 3383cca675e24105d9c1117f1fe010a054f909a3fa953c84d16cbe8ed6830323
MD5 db73b2fe91c43012c84004a38821da66
SHA1 a0ad2d804777ffd8e36ef16bd3d8bc615f985400
SHA512 1d64e74b142ea64a62c72696a3f6d381e2557f4bf0f2bb450de364972c2a306aee59a8ffce66dea86e764806df93c3c049a9817c32799e5b73fad5c579e91d5e
SSDEEP 384:ngziFiZcI63sN08TUNTUlIm2aKMCDqAw2fLBCc8ibqRKQl/sqctLiGsa+VYsTgLa:geFQ63NwgcY2gBCcX8KQl/nmiGhgNr
TLSH
T1CBC25B32E898DDABECEB4BD5B74A3613DEF011A3998C9AD4D9D80D1C00C719D174BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\6498.2026.10.20\manifest.json
Size 118B
SHA256 cc33e26f3b2efe862336389207db045cc7a916940213b9d33d845c82c12c8712
MD5 acb0c12cc7e5345764763e37bcebbec8
SHA1 4147b2615955c51a6054c807c2397e4d7d10ee03
SHA512 6777da8af66a77c28049eaf1b49ba7cdfaa08a8f381c27dad4af0e980e8d5a7ea0df0c3f1fd0cbc0cbe93a83a07d130ae24dc4057471de830fac60036b1c2f3a
TLSH
T10EB09222DC80D832697693A84E2246D0F238234B2568AA493630048C0B2E2F182A2721
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

05906daf-93e9-4350-a67a-dc57792bf3d3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\05906daf-93e9-4350-a67a-dc57792bf3d3.tmp
Size 32KB
SHA256 2de6945903a63f76423ce58c8f591c515e7010d5e7f40edcf2904f7cf7327f9b
MD5 228274938497b8e32d551131d02b040c
SHA1 c724750e70179f3df3b12066fc6001f0a4c4b561
SHA512 34a36c741b01bcba9e5469e448abede10f09ec6e1e547c06baa401e7bf1fd5d9515d870d7f1fd278b26fcf21d5b3fe2a70720b349672ed083d7c5b2f81124cbf
SSDEEP 768:Px6r8sW7pLuLbG+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVP1qpLlvVajYroD:Px6r8s2EbG+WviyUKu1jau1qpLd4jjoK
TLSH
T10DE2F97B780CCE7E4FC04A9DDD1A7F8B6DA802CB9698C95087FA945C02C67EA51170DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7b4bf6a7-5be3-40d4-9c7b-23d56d34c646.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7b4bf6a7-5be3-40d4-9c7b-23d56d34c646.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 c3eb8783f5764a72096ad2567385ed0409c3a35b2b293f3f3696aabc4b013f9f
MD5 f9223ab98e52dccab98955134a34d6fa
SHA1 5a2b1b3ec052b4e4b756e4099c1b04f9b002761d
SHA512 9f381b4c23c85b883c19296b1eaa05b5a0677bb22b09cb0c6aec548b2c551b08998561b08387661773b15d375c77567cfe4d47d67892e8dd1922640eba80e8ba
TLSH
T1EEE026E806CAC23EA34D759B417C670DC381A61FDAC069AE6B08C9847207850BA927E6
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 9b96f0dd05eae94c3049b603822b8764915dfea639e09c6e2a4b59c7f38cd8c3
MD5 43922559339e05d8d674adaa7f0dabe5
SHA1 29247aac1425c03bbf55be20f93962e3eb1c6891
SHA512 e63c9e941dfbadefbfde5d07b41bbd2891043c2086e8c54d19e1b0e037d7bb6d3b59d88a09cb5f01d1e21059b507b27bf41714472213bef5af90467a3054814c
TLSH
T152E02B6AC851EC3B08FD1B7854944646E70023276B50A94B3B3D81088FF1537818BD6C
MD5 SHA1 SHA512 TLSH

Submit Download

4c3ab5a3-b678-4845-b5cb-4cf7b47dd2b0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\4c3ab5a3-b678-4845-b5cb-4cf7b47dd2b0.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

28aec35a-90b4-4c78-8007-8fe34ddecfb5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\28aec35a-90b4-4c78-8007-8fe34ddecfb5.tmp
Size 2KB
SHA256 e443371571eed56961461da445b313962cad87cef7d40627f00f76035b52cab5
MD5 47f9a0050cc9971395b134b83df30d06
SHA1 3b12f1e0c8b50e655ac04aa9a74541d9463cc482
SHA512 423ff42bf26e4bff44a134c6ea4c4de651985bc5d17d04bc2d88ff66476fbbe2807ac7c353af97e348c9be8f5d3d507a86bb73fb900f0b01bb5acf5fcfc26631
TLSH
T1C741BEF783F8856E8A1196F0AA18AE2BCE1D0914432C7D9AC4E4AF2B93E3471E14155F
MD5 SHA1 SHA512 TLSH

Submit Download

37b140a8-aec8-4fa9-9188-a19ac5cb0268.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\37b140a8-aec8-4fa9-9188-a19ac5cb0268.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

5186a5e9-bc17-466e-bdfd-19413b3fd850.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5186a5e9-bc17-466e-bdfd-19413b3fd850.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 1c66d05377e70e0416c823fed330619845ce1e6aa067a48bac5c6e04d6336022
MD5 c3ce9b4d0bb5ea642483c100b03a7576
SHA1 1e7911cac3f942d03fb54dd7fd46e5378ff3b675
SHA512 ba754267f865a8142dd598489ebee8ba1699288083a2f555407e998e36ea685962a936126b8b659f0fb64f2ae758c8a95ecd01834add13f9cad3ba42507a71bc
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdgf:ST/2dXOJhJlpfnpp3tNXVrN3gT1w
TLSH
T149B21F1571BB421039FE394892B59B6E068271733119E66B7FBD00B68E2BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adce4a06-a3df-4c94-a9c6-589711f36de2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\adce4a06-a3df-4c94-a9c6-589711f36de2.tmp
Size 12KB
SHA256 71cdfe16d225720b4795f24780ac4bc56163450367c753f7cc00aa8e50496040
MD5 63e8074349cc16b552751ca5297ac6b8
SHA1 9d785bb3d3bc90ee22dad4fc90b5662c5b2e0840
SHA512 7c572df8c5b353549309378813f331816f0cb08abc1f6cbb8a5ce0cd7cac7bed615e2ffc10632ed70d5442246d3fdee3b811ca055afe6ede64625618ad737589
SSDEEP 192:sxZlFRAiUZ/fcs1aQZLjx8dqzodpA5HW6+WNAwO/YoNaTSFbIgjtWJ:sxZ7z2/fcsoOPW7kHbG/8Sxjti
TLSH
T1DE42D955AD28A93BCCCBD619FB15BF52E3F95033A4810E44AAFC8A1C14E76DD224781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d843197f-9f27-45d7-851d-db49175a08bd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d843197f-9f27-45d7-851d-db49175a08bd.tmp
Size 12KB
SHA256 18c71cf17b32e4589acb2805c66c52bfd2f27ea1ea5c1b9b80c64a815ea63985
MD5 9b678b1fa9c1bcfa4f8cca3ab478baa4
SHA1 921163db2f03b344dfc495c1b646d4d34029a009
SHA512 e68902a703d95262ebb5b6d644910439a4c467e353300d922d1b260353b076a02c4c1f2c77cea643e88a32013d3ad19e60e86a2fb8857a52ad96ed4a67e7cb31
SSDEEP 192:sxZlFRAiUZ/fcsGQZLjx8dqzodpA5HW6+WNAwO/Yo1aTSFbIg5zTNt/J:sxZ7z2/fcsGOPW7kHbG/0SxBNtB
TLSH
T19B42DA55AD28A93BCCCBD619BB157F53E3F95033A4850E44AAFC8A1C14E76DD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fea498f6-b4b6-4368-9de6-5dc4badde9a1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fea498f6-b4b6-4368-9de6-5dc4badde9a1.tmp
Size 12KB
SHA256 a4f77bb9a91c4d504fd23fdac07170ae59e2e155a3bf1d7e31d5a48e5148fd10
MD5 50327c2a8336240e95a1dc18680b3bcd
SHA1 9a209e691690251b88a23c57a991f8dcd897aad4
SHA512 a87206618d58352259a89e328a23fd462898dfaae868a6e73b9be3c033a5158d2e20e851c1c11098ca62183fd01219291128cffacac00807c959c6e8af256e04
SSDEEP 192:sxZlFRAiUZ/fcsgaQZLjx8dqzodpA5HW6+WNAwO/YoNaTSFbIg5BtWJ:sxZ7z2/fcsZOPW7kHbG/8Sxbti
TLSH
T1B342D955AD28A93BCCCBD619FB15BF52E3F95033A4810E44AAFC8A1C14E76DD224781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.10.12.1\keys.json
Size 3KB
SHA256 b0724d5592e6441a840c6622d7ad51caad2564a3746e563ce1f1bbde30944b2b
MD5 a86e3ddeb60db5984686f5bd89a95646
SHA1 e5f417a8f70c34b293ee20bb9f54a423a07982ec
SHA512 f3df95b51940a12ffd2d58648c302fbd649dc3097e0961a86da65e324690488d1b3d80c6267a6a0685f220a89c279ba54cb56fc02f19860e99ffcd6448cf0db5
TLSH
T19971D6BF14A40082CF3BD16A8F0735A78FB23C0623C67AC3965FE94A04425AC276F475
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.10.12.1\manifest.json
Size 80B
SHA256 abe933f0db95b1a75786da21de82feb5270ffa7ae072270923da2437710d93ba
MD5 3790d9257ba14f8be2ba08acf259a57f
SHA1 c54ab2e79d0ac9dc27425c7450e01ad593f02d60
SHA512 9568fef732369f06aafd8270638a38531a26f6f40a1c7c65fb7254eed36807789756e1c6efabaec86017b3decead2773de9ef5814650dbb334e6000ebd44a467
TLSH
T1A8A012605811E13310C403700260438243E01C112015240405461140218823713A3129
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Web Notifications Deny List\2.0.0.156\manifest.json
Size 177B
SHA256 edf9270ca881fcc464ffe8fb8a9271f8eebe0323ab5ada99fc293c3eed3ed023
MD5 95d3a514154076a76491f0b2d357beea
SHA1 276bd6423bb21e49bbd04efbd90e83b5e9c53a9e
SHA512 61eb275c5019bf8fdb2727ea7b32eaa6a44152a5aa9258d72f864440767765889758387776b9a8974dc78747f61a3642ccafad8990b1398b86ae067fbccd830b
TLSH
T165C012DFDC509DB115EB4322196D43C4D733DF4B1546450935F766082E25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

c1090471-e416-48b6-946f-898a4e8f831b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c1090471-e416-48b6-946f-898a4e8f831b.tmp
Size 25KB
SHA256 4d0764d0fabc8bba9799a0d5c55756694aadab5f1f9592d271b67ee4bd487a84
MD5 2306778b769977adf1ff30fc8576b66a
SHA1 d51e3d2d62990f39a21ec277a9c59c5310c2883f
SHA512 2b49e6bf0d37ce0ac2665770ae215cac539c626155027297cff0e2f68437e493b49cf6b0561145f0b66192726dc470306d878b40fbd3a9bbac0c86712b5a93f9
SSDEEP 384:n8iFiZcI63sNk8TUNTUlIm2aKMiQ4w2fLBCc8ibqRKQl/XFEsa+VYsTgL/7Iz3o4:nFQ635wgcVoBCcX8KQl/XFEhgNr
TLSH
T189C24A32EC98DAABE8FB4FD6A74A7613DEF00263959C96D4CAD81D1C10D719D1307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0cb6b57b-2563-478c-b1a9-ffcc234719e5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\0cb6b57b-2563-478c-b1a9-ffcc234719e5.tmp
Size 2KB
SHA256 5952982a8efe7dbe2e79a7bab9936874087d18400fa29d9c58ae4e008b68aabb
MD5 418b05271a24648e2ef3afa036685651
SHA1 e3ff351b9a8284d38d3d9eaaa67867cfccb63b21
SHA512 6921da1130855150d54a5f10f2ce38474dbd469bcc5a38a187302bf113e4be5cc47fd272f971b6e2e9863fb1e1aa91390c693fcbe1e046846d1d9e7409bd1688
TLSH
T10C51FEE0583C5AD1D4BD0E7EE49B39EC90EC8621B494387E7858ED985A7A61D7084C3F
MD5 SHA1 SHA512 TLSH

Submit Download

d2fe5005-d68d-4cc4-813a-3109c25e6980.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\d2fe5005-d68d-4cc4-813a-3109c25e6980.tmp
Size 2KB
SHA256 049cc2086d71a769fa8e1652c186a2c80a003322e28f1c6a9c7ea22e766c536e
MD5 8ada3dab4b3f8e87f0bee989195854c8
SHA1 9b71eb29ada6fa46991550bde601466480ae578d
SHA512 99f0993595a8afe8f16ce2ec84fcfea44f57ef6f5813be92899a9030005f6031d5e23cc2ae6e154883588a4357bd51e9a56cc779f349a263fbeb93a471696682
TLSH
T1FA512FE04C3C6AD1D1FD0E7EB09B39EC90E88661B490383E7858E9984A7E61D708483F
MD5 SHA1 SHA512 TLSH

Submit Download

f5a6b81f-062d-462c-8aee-d988114c35b7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\f5a6b81f-062d-462c-8aee-d988114c35b7.tmp
Size 2KB
SHA256 300a365f8a3216feb41574f17cbe53ed6cc6fec36e536687a20a0eb48e0916a7
MD5 31c3419806b41a8160fd0af8990c0f57
SHA1 6783095dc5fbf6e2551aa45da97b111978552387
SHA512 93eb7b7cfd7afb7e2f8258378bb390bcf96601c6c2c6efe38a3d70a185f628ea3c7f0a1a9afc42a2eaf44677e429870888a7054b8c8b196df834d8f93ad6e64e
TLSH
T167511ED04C3C5AD1D5BD0E7EB49B39EC90E8D661B490383A7858E9984A7E61D7184C3F
MD5 SHA1 SHA512 TLSH

Submit Download

d5bd8960-11d8-4ad9-8657-259ffc4c5ef6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d5bd8960-11d8-4ad9-8657-259ffc4c5ef6.tmp
Size 26KB
SHA256 9811cdc0e94a4093d01e6edc6a60ba87492cbe557585509d00f15fde14a71a96
MD5 322bc559a198d6dc1240c2f9a0facec2
SHA1 40e8973d89dc0504c2c1341821ae1edb57baa5e2
SHA512 cacc423f4bea0c72aeae2c8a393b4aa846a4c979305e14c9f65b1cc4d7c6da85a0281ea517491296dde4718473b991261ecf72d636db08f8512b5c460f6610b2
SSDEEP 768:BeFd139wgjG2ZBCcX8KQl/n1iGvys94yL4:+133fM1D6cFc
TLSH
T11DC25B32E899DEABEDEB5B95B30E3643EEE01263C98C4AD4D9D90D5C00C719D274BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

80c9a2c0-c613-4607-bb05-7da4e43b13d8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\80c9a2c0-c613-4607-bb05-7da4e43b13d8.tmp
Size 132B
SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
MD5 8126a600a3d95922fb651e3a6f104f68
SHA1 e386add1c2c1d9ca74461e5ce0d1b271d689160f
SHA512 5a0e81111f0d9a0f7943b99f7bad8162de0d3f99fffa9d8f8ab466fa9c7c4249808bedfa6e4d26426bc2d1a422e2155900ba71adc222617a5f0880dc60b89a93
TLSH
T122C02B8F542E47CBBAA5152D42D40B3B4690CD60F199E6B449FA5640006435CC608C47
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 22db37ec142c590c1fa1fa0b131694d2fd1f378adb8c862e6d2753c21022a301
MD5 97dd3b67bfdc7a3386f62e85f3a6e0ca
SHA1 d0ff0671842801a0c6971ccc1c32d36b4515a8f4
SHA512 73d5c4e66c13ccc3e90e3250fb83ef47ec8d1c1ecbedc05ac1a5193ccd82791782424eebefb4ef93c310a001eed91cd5dd8dbf061bf5dc3afa4e47c9d2942d82
TLSH
T1A541186CB6F91148B3B76E16ABF6A9AD487B79372F06D49D10010E4F0A22A40C971737
MD5 SHA1 SHA512 TLSH

Submit Download

2026-10-21_97ab0fe4fbf4b832c9af04e90db7e485_amadey_coinminer_darkgate_elex_glassworm_remcos_rhadaman.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-10-21_97ab0fe4fbf4b832c9af04e90db7e485_amadey_coinminer_darkgate_elex_glassworm_remcos_rhadaman.exe
Size 10.3MB
SHA256 2b1cd1a535ded55f42b75dc8d44cf08ce33b01d8ef0891b4ffa5bff2578a36e6
MD5 e3f209290dced3fd1feab49208f1fc7d
SHA1 bd3c455906815bb9e51b6c7121af64166545dacc
SHA512 ddff481f7cfc5fa985b99d82b4a274eba52d52471707149eab540332396e2f972eb36023df155a77fddd0ac47d92108221f2bcb33dbabb34cbf8a4d556bcbe26
SSDEEP 196608:qd0Mpunpm9LJ5PyPN7N/e/BCYEUnoPlPYfTy1AXw6LeyYHS:q+Quns9LJ5PIN7N/EM2otPYfTy1P6eyZ
TLSH
T1F3B6AE1373E64125F5F316745A7D45294E3ABD211B38C0DFA2C92A4E4BF2EE2A931723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

275994d7-303b-484b-98ec-b5ecbf24691b.tmp

Path C:\Users\Admin\AppData\Local\Temp\275994d7-303b-484b-98ec-b5ecbf24691b.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3772_189272074\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

explorer.exe

Path C:\Windows\Resources\Themes\explorer.exe
Size 135KB
SHA256 c4d895c08aad420f0897392898f76a66bb18865b8e1652b314269a0984227ca5
MD5 1764b992378211bdd0072dded9b8d24a
SHA1 4dada5ca78f63507b9998e7ef480213d3df2dd67
SHA512 f50addf2fcd9c537f49a64b6e0711f30d0b4355807b4800843f0c5844a9ac1e4507b42137aa1c06dead107ac0066eef08fd3ec3233822fd06edf49d7bd8288f1
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbV0hYe:UVqoCl/YgjxEufVU0TbTyDDalhe
TLSH
T199D31913FE10517ED82289F068A5E62DBA625E7A1FE0ED07326ABF44767110772F121F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icsys.icn.exe

Path C:\Windows\Resources\Themes\icsys.icn.exe
Size 135KB
SHA256 ed82a153b7da4f75af925b669253c32bff8e4a7d3b432a04babf64b5b58f16fa
MD5 18b70be0e940d9af5e188111eb35fc34
SHA1 4b18b3601895dacfcf12ecc1b2715be2c69182b1
SHA512 f9135c14cbae67eb2bd94af29c22229bc27071b64430901f1a960f7beda70653395f454970e2c4abf462e5f35662ab1270ed72105ce03ca520ab98f5d68aaf42
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbV0hYM:UVqoCl/YgjxEufVU0TbTyDDalhM
TLSH
T155D31813BE24486EDC12CAF118A6DBADFA511F362FA0AD077256BB02367194375F121F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spoolsv.exe

Path C:\Windows\Resources\spoolsv.exe
Size 135KB
SHA256 c6471257d1904076697f6af3010cbf3f503339cb1024e329cc9450915b004d73
MD5 1cb7eba16a5d99866432c687d25bd95a
SHA1 960bd3dc73c5e467fa0978ff1f481bc88b0e452c
SHA512 a01d48778cf5bac1b40284b52f6d68f83dfbb072a686e217d83e26b3beab8cceac8b9a6e218e4f092d5f4a31244650b862f38b597bbd7fdd5b8998a09dbde745
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbV0hY/:UVqoCl/YgjxEufVU0TbTyDDalh/
TLSH
T126D30923AE00146BD561CEF12CA9EB6DB7166E351BD0BD4B729ABB403171647B2F031B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Windows\Resources\svchost.exe
Size 135KB
SHA256 7f30e39085b6cf9ee01c98153faa308bd80dab11bfbe10e4b104add3721e9d3e
MD5 8473b8614df97c681af040e94ccdd843
SHA1 1c0c166d58126d09a47eb8f99a290b7904145f9c
SHA512 6f63685bb7d055538d5765f834d4b3596384100043f0054a5e20bc983690391191a7c6ef4e017ed841752634d3205a1e3dd4cd027a4ecbe706c3f9e28e4f4f6f
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbV0hYi:UVqoCl/YgjxEufVU0TbTyDDalhi
TLSH
T113D30B23AE14101FD921C9F528AAEB6BB6224E371BA1DD4B7363BB1536B510371F421F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1092-484-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1464-45-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1896-46-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4660-47-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4660-13-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5648-485-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5740-0-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5740-48-0x0000000000400000-0x000000000041F000-memory.dmp

Download