9e8139d587339172162208d14c0e7ee3f4c0896bd191059beb1311a2ec62c7ff

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/10/2026, 23:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-30_7eea79b85f888026e59d67232a7f6d41_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 16.2MB
Sample261030-3rdcgsts2n
SHA256 9e8139d587339172162208d14c0e7ee3f4c0896bd191059beb1311a2ec62c7ff
MD5 7eea79b85f888026e59d67232a7f6d41
SHA1 cbacf49a1514b316493eb5fbb700683be5a11494
SHA512 48fb77ea4e94c5c305414b2008e7d0f16a620a5939be195fbf9a3045c4f2b0f1f773d68af81a7e123efd92a2f1821a3802145113bb76209eb0dc7a1038e69eb5
SSDEEP 196608:FZcqE3MZiGsvC1qTIVT9npnGAI0YxPl8nTI:r+cq0VT9nRVYrK
TLSH
T155078C43E87919DAC0A99172CAB786637B743C895B3163C36B90B6342F77BD0AD79700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Uses browser remote debugging 2 TTPs 8 IoCs

Can be used to control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
2392	chrome.exe
4220	chrome.exe
5692	chrome.exe
4556	msedge.exe
3480	msedge.exe
444	msedge.exe
3388	chrome.exe
572	chrome.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
7	ipinfo.io
8	ipinfo.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-10-30_7eea79b85f888026e59d67232a7f6d41_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-10-30_7eea79b85f888026e59d67232a7f6d41_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-30_7eea79b85f888026e59d67232a7f6d41_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-30_7eea79b85f888026e59d67232a7f6d41_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3392	chrome.exe
4712	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2412	wmic.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Kills process with taskkill 4 IoCs

defense_evasion

pid	Process
1088	taskkill.exe
5448	taskkill.exe
3508	taskkill.exe
1324	taskkill.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	2026-10-30_7eea79b85f888026e59d67232a7f6d41_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3388	chrome.exe
3388	chrome.exe
3388	chrome.exe
3388	chrome.exe
384	chrome.exe
384	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3388	chrome.exe
3388	chrome.exe
3388	chrome.exe
3388	chrome.exe
4556	msedge.exe
4556	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1504	wmic.exe
Token: SeSecurityPrivilege	1504	wmic.exe
Token: SeTakeOwnershipPrivilege	1504	wmic.exe
Token: SeLoadDriverPrivilege	1504	wmic.exe
Token: SeSystemProfilePrivilege	1504	wmic.exe
Token: SeSystemtimePrivilege	1504	wmic.exe
Token: SeProfSingleProcessPrivilege	1504	wmic.exe
Token: SeIncBasePriorityPrivilege	1504	wmic.exe
Token: SeCreatePagefilePrivilege	1504	wmic.exe
Token: SeBackupPrivilege	1504	wmic.exe
Token: SeRestorePrivilege	1504	wmic.exe
Token: SeShutdownPrivilege	1504	wmic.exe
Token: SeDebugPrivilege	1504	wmic.exe
Token: SeSystemEnvironmentPrivilege	1504	wmic.exe
Token: SeRemoteShutdownPrivilege	1504	wmic.exe
Token: SeUndockPrivilege	1504	wmic.exe
Token: SeManageVolumePrivilege	1504	wmic.exe
Token: 33	1504	wmic.exe
Token: 34	1504	wmic.exe
Token: 35	1504	wmic.exe
Token: 36	1504	wmic.exe
Token: SeIncreaseQuotaPrivilege	1504	wmic.exe
Token: SeSecurityPrivilege	1504	wmic.exe
Token: SeTakeOwnershipPrivilege	1504	wmic.exe
Token: SeLoadDriverPrivilege	1504	wmic.exe
Token: SeSystemProfilePrivilege	1504	wmic.exe
Token: SeSystemtimePrivilege	1504	wmic.exe
Token: SeProfSingleProcessPrivilege	1504	wmic.exe
Token: SeIncBasePriorityPrivilege	1504	wmic.exe
Token: SeCreatePagefilePrivilege	1504	wmic.exe
Token: SeBackupPrivilege	1504	wmic.exe
Token: SeRestorePrivilege	1504	wmic.exe
Token: SeShutdownPrivilege	1504	wmic.exe
Token: SeDebugPrivilege	1504	wmic.exe
Token: SeSystemEnvironmentPrivilege	1504	wmic.exe
Token: SeRemoteShutdownPrivilege	1504	wmic.exe
Token: SeUndockPrivilege	1504	wmic.exe
Token: SeManageVolumePrivilege	1504	wmic.exe
Token: 33	1504	wmic.exe
Token: 34	1504	wmic.exe
Token: 35	1504	wmic.exe
Token: 36	1504	wmic.exe
Token: SeIncreaseQuotaPrivilege	2412	wmic.exe
Token: SeSecurityPrivilege	2412	wmic.exe
Token: SeTakeOwnershipPrivilege	2412	wmic.exe
Token: SeLoadDriverPrivilege	2412	wmic.exe
Token: SeSystemProfilePrivilege	2412	wmic.exe
Token: SeSystemtimePrivilege	2412	wmic.exe
Token: SeProfSingleProcessPrivilege	2412	wmic.exe
Token: SeIncBasePriorityPrivilege	2412	wmic.exe
Token: SeCreatePagefilePrivilege	2412	wmic.exe
Token: SeBackupPrivilege	2412	wmic.exe
Token: SeRestorePrivilege	2412	wmic.exe
Token: SeShutdownPrivilege	2412	wmic.exe
Token: SeDebugPrivilege	2412	wmic.exe
Token: SeSystemEnvironmentPrivilege	2412	wmic.exe
Token: SeRemoteShutdownPrivilege	2412	wmic.exe
Token: SeUndockPrivilege	2412	wmic.exe
Token: SeManageVolumePrivilege	2412	wmic.exe
Token: 33	2412	wmic.exe
Token: 34	2412	wmic.exe
Token: 35	2412	wmic.exe
Token: 36	2412	wmic.exe
Token: SeIncreaseQuotaPrivilege	2412	wmic.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3388	chrome.exe
4556	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 1504	4144	2026-10-30_7eea79b85f888026e59d67232a7f6d41_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	87
PID 4144 wrote to memory of 2412	4144	2026-10-30_7eea79b85f888026e59d67232a7f6d41_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	89
PID 4144 wrote to memory of 5200	4144	2026-10-30_7eea79b85f888026e59d67232a7f6d41_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	90
PID 4144 wrote to memory of 5564	4144	2026-10-30_7eea79b85f888026e59d67232a7f6d41_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	91
PID 4144 wrote to memory of 1088	4144	2026-10-30_7eea79b85f888026e59d67232a7f6d41_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	92
PID 4144 wrote to memory of 1812	4144	2026-10-30_7eea79b85f888026e59d67232a7f6d41_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	93
PID 4144 wrote to memory of 1812	4144	2026-10-30_7eea79b85f888026e59d67232a7f6d41_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	93
PID 4144 wrote to memory of 1812	4144	2026-10-30_7eea79b85f888026e59d67232a7f6d41_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	93
PID 4144 wrote to memory of 1812	4144	2026-10-30_7eea79b85f888026e59d67232a7f6d41_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	93
PID 4144 wrote to memory of 1812	4144	2026-10-30_7eea79b85f888026e59d67232a7f6d41_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	93
PID 4144 wrote to memory of 1812	4144	2026-10-30_7eea79b85f888026e59d67232a7f6d41_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	93
PID 4144 wrote to memory of 1812	4144	2026-10-30_7eea79b85f888026e59d67232a7f6d41_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	93
PID 4144 wrote to memory of 1812	4144	2026-10-30_7eea79b85f888026e59d67232a7f6d41_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	93
PID 4144 wrote to memory of 1812	4144	2026-10-30_7eea79b85f888026e59d67232a7f6d41_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	93
PID 4144 wrote to memory of 1812	4144	2026-10-30_7eea79b85f888026e59d67232a7f6d41_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	93
PID 4144 wrote to memory of 1812	4144	2026-10-30_7eea79b85f888026e59d67232a7f6d41_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	93
PID 4144 wrote to memory of 5584	4144	2026-10-30_7eea79b85f888026e59d67232a7f6d41_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	96
PID 4144 wrote to memory of 5584	4144	2026-10-30_7eea79b85f888026e59d67232a7f6d41_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	96
PID 4144 wrote to memory of 5584	4144	2026-10-30_7eea79b85f888026e59d67232a7f6d41_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	96
PID 4144 wrote to memory of 5584	4144	2026-10-30_7eea79b85f888026e59d67232a7f6d41_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	96
PID 4144 wrote to memory of 5584	4144	2026-10-30_7eea79b85f888026e59d67232a7f6d41_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	96
PID 4144 wrote to memory of 5584	4144	2026-10-30_7eea79b85f888026e59d67232a7f6d41_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	96
PID 4144 wrote to memory of 5584	4144	2026-10-30_7eea79b85f888026e59d67232a7f6d41_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	96
PID 4144 wrote to memory of 5584	4144	2026-10-30_7eea79b85f888026e59d67232a7f6d41_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	96
PID 4144 wrote to memory of 5584	4144	2026-10-30_7eea79b85f888026e59d67232a7f6d41_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	96
PID 4144 wrote to memory of 5584	4144	2026-10-30_7eea79b85f888026e59d67232a7f6d41_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	96
PID 4144 wrote to memory of 5584	4144	2026-10-30_7eea79b85f888026e59d67232a7f6d41_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	96
PID 4144 wrote to memory of 5448	4144	2026-10-30_7eea79b85f888026e59d67232a7f6d41_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	99
PID 4144 wrote to memory of 3388	4144	2026-10-30_7eea79b85f888026e59d67232a7f6d41_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	100
PID 3388 wrote to memory of 2304	3388	chrome.exe	101
PID 3388 wrote to memory of 4684	3388	chrome.exe	102
PID 3388 wrote to memory of 4684	3388	chrome.exe	102
PID 3388 wrote to memory of 3392	3388	chrome.exe	103
PID 3388 wrote to memory of 4208	3388	chrome.exe	104
PID 3388 wrote to memory of 4208	3388	chrome.exe	104
PID 3388 wrote to memory of 2392	3388	chrome.exe	106
PID 3388 wrote to memory of 2392	3388	chrome.exe	106
PID 3388 wrote to memory of 572	3388	chrome.exe	107
PID 3388 wrote to memory of 572	3388	chrome.exe	107
PID 3388 wrote to memory of 4220	3388	chrome.exe	108
PID 3388 wrote to memory of 4220	3388	chrome.exe	108
PID 3388 wrote to memory of 5692	3388	chrome.exe	109
PID 3388 wrote to memory of 5692	3388	chrome.exe	109
PID 3388 wrote to memory of 5612	3388	chrome.exe	113
PID 4144 wrote to memory of 3508	4144	2026-10-30_7eea79b85f888026e59d67232a7f6d41_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	116
PID 4144 wrote to memory of 4556	4144	2026-10-30_7eea79b85f888026e59d67232a7f6d41_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	117
PID 4556 wrote to memory of 3788	4556	msedge.exe	118
PID 4556 wrote to memory of 4392	4556	msedge.exe	119
PID 4556 wrote to memory of 4712	4556	msedge.exe	120
PID 4556 wrote to memory of 4392	4556	msedge.exe	119
PID 4556 wrote to memory of 4392	4556	msedge.exe	119
PID 4556 wrote to memory of 2460	4556	msedge.exe	122
PID 4556 wrote to memory of 2460	4556	msedge.exe	122
PID 4556 wrote to memory of 444	4556	msedge.exe	123
PID 4556 wrote to memory of 444	4556	msedge.exe	123
PID 4556 wrote to memory of 444	4556	msedge.exe	123
PID 4556 wrote to memory of 3480	4556	msedge.exe	124
PID 4556 wrote to memory of 3480	4556	msedge.exe	124
PID 4556 wrote to memory of 3480	4556	msedge.exe	124
PID 4556 wrote to memory of 2132	4556	msedge.exe	130
PID 4556 wrote to memory of 2132	4556	msedge.exe	130
PID 4556 wrote to memory of 5584	4556	msedge.exe	131
PID 4556 wrote to memory of 5584	4556	msedge.exe	131
PID 4556 wrote to memory of 1072	4556	msedge.exe	134

C:\Users\Admin\AppData\Local\Temp\2026-10-30_7eea79b85f888026e59d67232a7f6d41_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-30_7eea79b85f888026e59d67232a7f6d41_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Modifies trusted root certificate store through registry
- Reads the TCP/IP host and domain name from the registry
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Windows\System32\Wbem\wmic.exe
  wmic cpu get name
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  PID:1504
- C:\Windows\System32\Wbem\wmic.exe
  wmic path win32_VideoController get name
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Detects videocard installed
  - Suspicious use of AdjustPrivilegeToken
  PID:2412
- C:\Windows\System32\Wbem\wmic.exe
  wmic computersystem get TotalPhysicalMemory
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:5200
- C:\Windows\System32\Wbem\wmic.exe
  wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:5564
- C:\Windows\system32\taskkill.exe
  taskkill /f /im firefox.exe
  2⤵
  - Kills process with taskkill
  PID:1088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-startup-window
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  PID:5584
- C:\Windows\system32\taskkill.exe
  taskkill /f /im chrome.exe
  2⤵
  - Kills process with taskkill
  PID:5448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --headless --remote-allow-origins=* "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data"
  2⤵
  - Uses browser remote debugging
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3388
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffea9bc728,0x7fffea9bc734,0x7fffea9bc740
    3⤵
    PID:2304
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1872,i,12692099136378897839,9473537917064989279,262144 --disable-features=PaintHolding --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1864 /prefetch:2
    3⤵
    PID:4684
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1872,i,12692099136378897839,9473537917064989279,262144 --disable-features=PaintHolding --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2172 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3392
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1872,i,12692099136378897839,9473537917064989279,262144 --disable-features=PaintHolding --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2476 /prefetch:8
    3⤵
    PID:4208
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1872,i,12692099136378897839,9473537917064989279,262144 --disable-features=PaintHolding --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3164 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2392
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1872,i,12692099136378897839,9473537917064989279,262144 --disable-features=PaintHolding --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3192 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:572
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1872,i,12692099136378897839,9473537917064989279,262144 --disable-features=PaintHolding --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4180 /prefetch:2
    3⤵
    - Uses browser remote debugging
    PID:4220
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1872,i,12692099136378897839,9473537917064989279,262144 --disable-features=PaintHolding --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4532 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:5692
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1872,i,12692099136378897839,9473537917064989279,262144 --disable-features=PaintHolding --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5304 /prefetch:8
    3⤵
    PID:5612
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1872,i,12692099136378897839,9473537917064989279,262144 --disable-features=PaintHolding --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5824 /prefetch:8
    3⤵
    PID:5884
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1872,i,12692099136378897839,9473537917064989279,262144 --disable-features=PaintHolding --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5792 /prefetch:8
    3⤵
    PID:4736
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1872,i,12692099136378897839,9473537917064989279,262144 --disable-features=PaintHolding --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5828 /prefetch:8
    3⤵
    PID:5924
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1872,i,12692099136378897839,9473537917064989279,262144 --disable-features=PaintHolding --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5508 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:384
- C:\Windows\system32\taskkill.exe
  taskkill /f /im msedge.exe
  2⤵
  - Kills process with taskkill
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --headless --remote-allow-origins=* "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data"
  2⤵
  - Uses browser remote debugging
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x230,0x234,0x238,0x208,0x25c,0x7fffd62cc188,0x7fffd62cc194,0x7fffd62cc1a0
    3⤵
    PID:3788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --field-trial-handle=2192,i,3443320890565041979,9132747054541803072,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
    3⤵
    PID:4392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2192,i,3443320890565041979,9132747054541803072,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2192,i,3443320890565041979,9132747054541803072,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:8
    3⤵
    PID:2460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2192,i,3443320890565041979,9132747054541803072,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2192,i,3443320890565041979,9132747054541803072,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:3480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2192,i,3443320890565041979,9132747054541803072,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:8
    3⤵
    PID:2132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2192,i,3443320890565041979,9132747054541803072,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:8
    3⤵
    PID:5584
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2192,i,3443320890565041979,9132747054541803072,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
    3⤵
    PID:5464
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2192,i,3443320890565041979,9132747054541803072,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
    3⤵
    PID:1072
- C:\Windows\system32\taskkill.exe
  taskkill /f /im msedge.exe
  2⤵
  - Kills process with taskkill
  PID:1324

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2500

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3864

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3372

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:436

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5592

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1f078fb7-ea1e-4057-b1b3-c4b68ca3fc6e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\1f078fb7-ea1e-4057-b1b3-c4b68ca3fc6e.tmp
Size 269KB
SHA256 bdf1baa35d7331e6ea2f855d555208fa2af2c1f49424210091d9e0ca9645b7de
MD5 de91db7658eac3e7fff511eac30a20e4
SHA1 65e53acd5af53a9ccd3cc72abd58e9edcf3dd549
SHA512 7c08fb61327ffc07c1a8a99965b3ac89c0b7a3a7b9f55806665593f170306c7569c54f6e25d89010fb65e7527b1ce8af6abf0368bf027ca9765e70085148b042
SSDEEP 6144:YNDF7Q4IpKC6FXXiIpDqYGp880+hFD+7t56OD9ZfSApprh:mxQJp36B9ODp6yFSXD9ZfS4z
TLSH
T1AD4423319D549DBBCBF90A40B1EFA340CD3995FAD49D79984C463F86D0ADC8A8362933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

56b7b890-8383-4235-9eec-47347fa0e00e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\56b7b890-8383-4235-9eec-47347fa0e00e.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

59acd45f-990d-46e9-b754-1aefd0b5bf1a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\59acd45f-990d-46e9-b754-1aefd0b5bf1a.tmp
Size 414B
SHA256 3add74ffe66a3e6f82f1faf72546ef164b0a5ed99da5c956cda516bb543643cf
MD5 a84ce213a46a53c4823aecee018b6562
SHA1 3638f5c6d5b9406b9474b196be6dff6152da1904
SHA512 9b3f543439e57bb0963a1e56000e9077eb018ac5927aa91b166aa26f9b113a10de57965957c0a8656c96b173e91d3bd5c531d78009a8b030dcb4c04aa3826b50
TLSH
T19EE02BB6C821FC3718FD5B2E54554B87E64A13573680854B7A3D424D8F74A3602C981C
MD5 SHA1 SHA512 TLSH

Submit Download

8d31aa92-4431-4e5d-9463-3dc6cee2e6a8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8d31aa92-4431-4e5d-9463-3dc6cee2e6a8.tmp
Size 13KB
SHA256 35bcf1f00a621e5aac764b880501e01ee9f75ee7e52e1b89a69364a8928b51b8
MD5 0b79612076351349ea8901c3159bed9a
SHA1 55c9178dddbf988e30b852971199358e790c84e3
SHA512 78c2a1a4d1414c1b8c787bac0dc198f989c21a06117eccfa29c958e6fe041025682685c39010cc95d414ebff6648b9645d8aff70d24d2cfd9c7bddd2ea257e76
SSDEEP 192:jR3BJXbSojbv7GpUPRpOC96Hsb+WNnud0iOudkwodrYVyIsnAUgraJ:jR3BJXDjCwXlsww0ZudFe
TLSH
T10952B42AB910693B9CDBD32AFD527B57D3F5102520942E84E6FC893C14E76CD222B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c8d84742-8882-457c-a445-8266022334cf.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\c8d84742-8882-457c-a445-8266022334cf.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

db2e252b-be5f-4fa6-85d6-54f90bbd6a7f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\db2e252b-be5f-4fa6-85d6-54f90bbd6a7f.tmp
Size 3KB
SHA256 fc0d3d604640a20b4bfb520087cf27a4e0f6aaf2021c2cb591a32cee63e79599
MD5 013b85f985d1147705a224c51aa2fb9a
SHA1 b46f8d2cbf3e5159aab7e5a35dccb272fdbda677
SHA512 113e3ba7b3e5d8afd963ceb5739e0c8b9f0e777723bb67a05aee383ac89208217127510dd49a8b35d5a7ff31875e82a22563ae71ccdcbe8c6a4ca4bd9c12e1c4
TLSH
T16561ADF7C3E4897D891156F4AB256E1FCE6D1A28422C3D53C8D4AE4B53F29B2D21078E
MD5 SHA1 SHA512 TLSH

Submit Download

f6ef6048-8325-4cf7-8b31-9bef6a9b0e7c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\f6ef6048-8325-4cf7-8b31-9bef6a9b0e7c.tmp
Size 2KB
SHA256 2ec65a8e54440f7c19471f3a5988a3bd1fd6a37fb396196b5564eb89a998b025
MD5 03f6b8945d42e57e71e50f5807218d0c
SHA1 4dd1f00298d03024ed8a8087f19d98d0e2258384
SHA512 595fc87a663dc67705e0cda5a3f5350b15823a01b98b11dbc89a4ad9e3f1ae168053a0d0e7039a68c8363f10eb11f54dd3a71fec4412b64c38232f538d8c5756
TLSH
T15E51CBF7D7E48A7D850156F4EB206E2FCE6D0A24021C3D62C8D4AE4B53F29B2D21078E
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 74d96ad138fc175bb8092340db4e7a706548263726617c6430c5cfb50d31ca36
MD5 3b4d0088a7c4ff9af07280dab53174ec
SHA1 2c1eb64c861619c4c35e4d415787a7b0f2a9cbfd
SHA512 8dcb9f3a575e8b713ee354fd82e7a110b78cbdb7af63f1de17c54c73abcc9c37eba02dd8f4fda490738211a484c9c7de1067e7928416eb2951d5f534099e4f86
TLSH
T1CBB0120580426301C00103F0116090A43760DF79D312138561E00E158C31250411710C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 331592a89d764d6a3b2a038568dda7e09ce475d51bb51235e1aa6cb93c0e15d2
MD5 d2e60496b2034792158a53a4af28b4c6
SHA1 f3d93b56a9c9feddac74d4c787d734e6da2f1b1e
SHA512 9ac0aa49693a4201548ab74007a91ca5d43d52f94edfa178c4afc5709ef70b2587b02c138ccd3579ba697c079b5a2f34ae49b9eb7729cfb8ec8539bd32b0dea9
TLSH
T101B02200C0023202C2A303B038E0C3C83220CF20C203B30B82E02A3AEC38220082C020
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 7bfada5ba6d2780a98e3f17dfadd525205113d2bec584494e1861cd65150bc5a
MD5 d8722d98f878a58f314110684287e0a7
SHA1 3d85c72e65d324a66db6287420386ef39c1c687c
SHA512 f0efa5d189cf1a173e1cedc2c82408b34b8309e77f1b609342498e6bf59469ae9f0db2c77545f942d355273c327f6decf59a06d46e1e8c71c3180c9a9e1798c1
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OcmVumM/nYd:1nbZeMrv/hGtcvnYd
TLSH
T17BD3974B3A747002EDE69A722CF050BB5D3C716D8F55A1D428B620698EF1963B23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d1271e21-fb80-4e75-9423-905bc265c4f3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d1271e21-fb80-4e75-9423-905bc265c4f3.tmp
Size 17KB
SHA256 2402969cd2ec72ea72b513389c43205a9ee2bceca1c456ef576613e3544e19a0
MD5 ef2f6beced6ed991eb5f4b124485b70c
SHA1 13ae98461b417e18835295fc68f98db326a5bad0
SHA512 5adbe06b2aba408c8975b2dfc7f1c8c160dc3367ebb5f8a049421cc510b871c0310b3c4cd24506c3615f6972ff559c98cb7cd22bc47816248c6501f19779082b
SSDEEP 384:tyjCjRyjH7KxkXqKf/pUZNCgVLH2Hfgslqq7pLuLceSzyjDXODRyjr+ErU3J6HG2:Ie0r7KxkXqKf/pUZNCgVLH2HfgsMq7pw
TLSH
T1A0720A77BC0C9A7B0F94C68CD8167E4FEDB5024B65D9886443FA983503D5BDA110A1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fd8aa99f-635a-40d3-acc3-76dc907d07c6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fd8aa99f-635a-40d3-acc3-76dc907d07c6.tmp
Size 12KB
SHA256 35897695f14f76bdef05d9654d3f74c3e9f0ffaad6c3e6ee7b8b1f6be4f5ffd6
MD5 594bc5a5f148cf372fb8bf5154882857
SHA1 5776a46d99b53226d7c8d4dcfbd9a9dd46c65de8
SHA512 a90fbf95991fff681018e65dde86cf27305aa437488ce78547a62b6b2b00bebea01f12f10e33acfa0e3c19c7d9898eb329136be24e9e7c6d7c57bd3d0a190828
SSDEEP 192:jR3BJX+Sojbv7GpAPRp2C96Hsb+WNnud0lOudkwodrKVyIsnAUgtaJ:jR3BJXkjCUXtsww08ud98
TLSH
T1A442A32ABE10693B5CDBD32AED527B57D7F5102520942E84EAFC893C14E76CD222B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af6aa1b7-0a1d-42d1-bc1d-91780817b6f1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\af6aa1b7-0a1d-42d1-bc1d-91780817b6f1.tmp
Size 130KB
SHA256 1ce985aeb6e9324a5ebcb9be15f8c20c7952317f7e5ad49d5b752e8781cfa074
MD5 debbae8973c0eea428572130024fbf1a
SHA1 0c5dccd1437fe07b9d9ce4d63cfdda37b34c429f
SHA512 09c65409b4254a161695f3d8098a106af83f180d4aac7e0cc4bad892159dcda6497983959d0db58fb439b0f92aea4b3232e4577775f166fa1b8857b7a5adc275
SSDEEP 3072:UL+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gB:UL+hFD+7t56OD9ZfSApprB
TLSH
T154D31232AA91D8BBC9BC6141B157A300DD76ACED45DE3A09444A5F8EE09F94C07B3A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bf3a8e4e-5a12-48b4-9712-e638e354de59.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\bf3a8e4e-5a12-48b4-9712-e638e354de59.tmp
Size 270KB
SHA256 b0da6830d9a00e55d1838d45e292a04c62e2b4c37d649495bf8e52230291d680
MD5 208c21c86d04fa54dedcae9143dad4a8
SHA1 4ba1aba06283c549e17960ca8c1b1973b1336cda
SHA512 8ff59fe464cb19755ee3f2c941d1f19bdc65566558a3b629e9d6cbb46f1928dbc39eb59a8fdc4802cc59a4b2ed1b403b8babf58ce0513945c20f1325d3527c6e
SSDEEP 6144:pNDF7Q4IpKC6FXXiIpDqYGp880+hFD+7t56OD9ZfSApprh:XxQJp36B9ODp6yFSXD9ZfS4z
TLSH
T17A4423319D549DBBCBF90A40B1EFA340CD3995FAD49D79984C463F86D0ADC8A8362933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e7a6f93e-b067-48bd-ba93-a136d90a3acd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e7a6f93e-b067-48bd-ba93-a136d90a3acd.tmp
Size 270KB
SHA256 77a9a02e9927fc8499c67ba6e82616a1cf9370eb11860d2693d079ee0971c918
MD5 52a2d702e45f746ea5e8be3602c080b9
SHA1 cacdb23b5e6cc29c66dad228f20d9f18f7000d79
SHA512 4f3e19fcd1f10c56b6e65b3d39b418dcae05d2f1f532b4164091edee79292ad66c6cc4b0d4a153acc3204296bd2b149c1e000a3e33d3486c2084f08751a21444
SSDEEP 6144:pbDF7Q4IpKC6FXXiIpDqYGp880+hFD+7t56OD9ZfSApprh:pxQJp36B9ODp6yFSXD9ZfS4z
TLSH
T14C4422319960DCBBCAF90A40B19BA300CD7996FBD49DB95C4C453F86D1ADCCA8762933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

11c6b9af-176e-4f70-9e27-ccdd6b9089bb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\11c6b9af-176e-4f70-9e27-ccdd6b9089bb.tmp
Size 25KB
SHA256 a39c60198325384e4d6d4f7fb77a36979bab856b160200708e20ea08e9a3ca9a
MD5 ca8dc29fa88d155df778b594f4bc8d8a
SHA1 f3a35f087a7c46eb1d82348e8b3751156a4ef5ee
SHA512 e833e1fa24ff972781a10a49e272f979a67111770a06b5964ab8bad17b8b38f1c17e533bf1597cbffc6a1aaa03c595d32df31e6efe48a5dd4b58475173983feb
SSDEEP 384:n/iFiZcI63sNE8TUNTUlIm2aKMid4w2f0BCcD/1XSU3FK7O6R2FeoivgL/7IzIou:KFQ63VwgcCZBCy/1iyFK7TRXYx
TLSH
T10AC25B36ECA4D9ABEDFB8FDAA74A7A03DEE0016395DC85C0D9D81D1D009759D030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8838137e-367d-40d8-a2f9-d3f1152e7b65.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8838137e-367d-40d8-a2f9-d3f1152e7b65.tmp
Size 26KB
SHA256 9677b7b43ac3c12ba29902c90d793058e4e31a61205acb7096eb0dee44674254
MD5 0abbba5d83289b4ae632b93f6c8e293b
SHA1 1b78d5ed1cb62c1ca86aa5f89ff2dc1dd8fd8fd6
SHA512 fd57723181b6fd62274c8f73b2fe6c1c287a632debc1fc557a7775a39743bb255c59a362d241ff71e06623d9c180b99365cf1263d3edc7037bb489a706dc855e
SSDEEP 384:nWiFiZcI63sN78TUNTUlIm2aKMCH4w2f0BCcD/1XSU1ufiy7O6R2FeoivgL/7Izs:9FQ63ewgcuZBCy/1isSiy7TRXYx
TLSH
T1C1C25B72ECA5CDA7EDEB8BD9A74A3643DEE001A388CC8AC4D5D85D1C00976DD170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2f67a665126f0d437497b394b50cc87ce72773b6abd85385bb78adf0ad326302
MD5 a98f4348736e1c7c5e70799864c15774
SHA1 fa2e3725e970aab935f77d155b649177f50be7d6
SHA512 c1dd68c743d45af6f713c7d8fade4a675abe4d224e86b956c5aaf959ccda0a92b9824b0e784a0ee9992843bfc2a7a73f85267479d6e5ffa0aa5827760492419d
TLSH
T19ED02B20B6A87654E006343C0114428C31CE5570140BB400809413A40FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

f_00006b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006b
Size 102KB
SHA256 68507cd63ba31b475df24e72126efa6f876ed08070edf9bc061370fa6d6236a1
MD5 9508051a8da5e63b0edf77fed708dbe7
SHA1 10b32bfae836baa1864152846e198fdd31e55001
SHA512 b8401dcb41ef9b0f70d9d00342349dfbe6a2218c5cc88335abac5a62360d0f0d44fa2381d82042dd0718036312903e605429ca8b57012aa74a04b02ee724f5a6
SSDEEP 3072:AC7MlsaVxw3ki4EEx1cWGSiAvi1ItUkzYdJ+oTK:j4Wa8Uzhx1/PiAvi1ouW
TLSH
T1CAA312330FAE5186C5E66D5C5F47ACBAA0C23C35254A655E2818CE39BE56728EF41C33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006c
Size 247KB
SHA256 35689610585971c6dfa0e85c55c2f5990055d14a466625ac2d0cb8057bc76853
MD5 809167d1be2d4f53764dc8c1b8c08d5b
SHA1 42e53604abc87882668733d9a38d99ef7294dc3c
SHA512 0bae6297f53ab27e17d8c5b8b4a605ea90617389e68d00434e6065c2f959bc4b8c87494561b07c9615c1f15a7c5c359fe9ae8198cfbe2f4b27ed1045dbf40d3a
SSDEEP 6144:stmrqoawyP0QQnhounIQlCIClcZ7O7R05dx00TP:awLaX8EVrlc1WRs
TLSH
T1A24422588F3C277B2063A1CCD3E265051CBF5EF6E6E1950E70AB0BA4A274DDFE516482
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006e
Size 31KB
SHA256 a258dcaa34219a6253250fd12bd905eb92d8faf13288b909af829d53945a8e86
MD5 c229b974a1531c851b4bb7c133930dc0
SHA1 7fb9eed0376d3812c03174d5fe740dea3e1f5249
SHA512 ea267a9005fedbbf2ef9d4137f580451ea13449ef6bd84f5685194d2cc054d7c256758d3cf3ba868ba0ec77197509ca32931af4fbd82bbd38b2249c54ee22cf6
SSDEEP 768:yMpfRDTUuuCnzekb80O5Q1ul718L1fBzrPFCW4l0sXtDkk:yMpfR+Cnzek80O5T7I1fBn9Cbl04Ck
TLSH
T163E2F26A379BF03082C70CA379D7A5C2B11174B8DCFDD176581C599D24E86B3971AE0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000070

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000070
Size 20KB
SHA256 3aacbcd81ad6ae1761ea657e53aa6ac03e279cb47cfc2fbd6524bde7cce68b17
MD5 2af2be0651a488d15f87aadbee775f4b
SHA1 6da37d1d9fd929a8c79ce771dc565d2f554e9d9d
SHA512 d532f7200f9655de22309bff4d2676a1c72c7d04ef5e50e66c4c9de71f4ff835bb8ff82066014fcdb21d88ce04a43f96e7e4260fd651f47736cb7e365ad25651
SSDEEP 384:R+ouqO6S2dxUPYYchyHCYfJFLI4+i+Qzrao5atCv5+JQ9TU2M:RtuedxXDfIFLI4xlz2catCvMJQy2M
TLSH
T14A92D06ECFAED5241F5B1ADD5ECC2AD9066AE5DD6CBE53C7AB723270D9C0D408809230
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000071

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000071
Size 36KB
SHA256 d881a7861279ea1fcdf0b4030c1714c7ed4c2e1560990051bae800df70fbcb1b
MD5 ee35337a988f3d4ded861c1bfd1687de
SHA1 55496798b91d93c2ac45a55dc7c194056ce76b0a
SHA512 c2f60f6bc419ea5e13b33d0d7250de4379dca4d4c04684bb5480573fb936e6cbd956097d7ca53bb1bf79c9768a700f697651c36c6f950012680adfe9954fbe52
SSDEEP 768:SMGRvHUpv2pHlsrbt2EtaB5AddPks6en+5GfL:SMavH82pi2fAPkdWzfL
TLSH
T192F2E143563A60B7EB127A7F0F673D534498A1F9CC2B35426E3B660E879633CCE60158
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007e
Size 39KB
SHA256 9bac2d0c95117c1e92351897b0548cc184941c6b9edffce4510542d443e87ebe
MD5 1b209d91d43bfd6f0ecfa323b8e60d94
SHA1 b655acfb6b7cf3be4c131db396b37d85b6753170
SHA512 c986f8a844e6b60db3a8f124799c19b9e5c76362066742ccd8710da4ac6ba6dfe445b0e092524f165f5bdeca75e725a3564868d3f95ee03b2e63178963e5838f
SSDEEP 768:hUiw8NR6+YM+0eMTIXRPbDujqLq+i/UzvnIK0BjBP7KfgQn5hZ3ek4Uz:qV8NR6BMVes8RWj9xgvnIQ56k4Uz
TLSH
T13003F1F1AEA68E0A043A97239C6E20D46EF2FDC5E05FBA2F57895CD1098F3D0524D132
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 3KB
SHA256 cfc99ffebae8038ae7c69c5f3c9dcf3b60f2452a7421c90dc9fdc1c15e104690
MD5 24819a02f9b69766f1b7e5187c9f40ce
SHA1 4f6b26b3e644ae18c16bac4f8c1a92ce0e4e8439
SHA512 c7d07681c0fdc9c2bf356c0079bfb195e2de5acb1170c5a3641cdc00f5d9147133aa24b2c58072220fae2ea6b822c20ac82f138d02be8e036944eafdbfdfbe5d
TLSH
T11A51FEF7281CD035C78240F90456FDAEDA23296C9ECCFFCDD26E668B2A651643A26041
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 490B
SHA256 67c9eea36f5aa7637f0b0a578d0d11a97eb11fa9e98f9c1ccd680cad8409c30f
MD5 75d796f3ca5081ddd7d8db6068fb9938
SHA1 6cbe9360c5140a153568240b092bc9acc2fed663
SHA512 7a4e5de45fb4aebe41316584708130e45956c070647546844f507968dbe247f0ed1d5f016109ce59e1b3fc96ef9bcdc0a5c8a3fc921e827c38b1c045e913c281
TLSH
T15AF05C763EFB2C14F99F93E2653010A844457C3DCA08FD5F616ABAD723B62262484CB2
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 eb4a1d978d72af325abf774548117af2f7b1b74081a1f49385933beadefeb68e
MD5 acfd16eecdeb6b4c1e7359953391b8cf
SHA1 8e848b0bfc88bbed6d80a236c9d1249307b1fd37
SHA512 e4c59cef2fc9e7688d04fb4e5c3f1464013bc5174af6a69242f131c4282f8edc299fc6826fe4161e410bc6d9a18a54318c49165062a5dc5c74a14cde67b456ec
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdgg:ST/2dXOJhJlpfnpp3tNXVrN3g3XB
TLSH
T1FCB22F1571BB021039FE391892B68B2E168271733119E66B7FBD04B68E67F085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 d29cdfe4cc25bf58babe4f383614c968e10e7dfa36ed973ecf323c68c3c13131
MD5 502523b7f29b76fc80c5c23ede0875dd
SHA1 106a9a580f5da751000df7bd2cf73743b2f639ea
SHA512 84eed4e0dd1c958f6f0b5c8e0430c2580577413fd0816bdd3cddbcdb74011cc5a12060cf61cd14fe1bc82cb91c28a05163c69bb4d2ffca37ec802405ab82d774
SSDEEP 192:P+xWvo1fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mxLfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1FB24730A7B747001EDE6D9725CB080771E3CB16DCF22A6915DB254698EB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 31ceefd8afba7ad9527a3a24f6bd790b6282ce2ae081b9e2c915a2d1468209a6
MD5 a835f3f4f9c979c5a02f0d4db45b7e6f
SHA1 c8b6848425036559fdd19ceaafeb623669ce1ea8
SHA512 ef7fc2bb793dc0bd3b358a00b9391bbc409b1896fc6d7815101e34fa7fa4a1a0feeb42801de22a2f94e72fe6c21fd6270c4b66cf2416b94f51871a5944c1e9f0
TLSH
T157412868BEF91108F3B76E169BF2B86D487BB9772E56C49D00110D4E0A63B40C9A2737
MD5 SHA1 SHA512 TLSH

Submit Download

logindata-copy.sqlite

Path C:\Users\Admin\AppData\Roaming\logindata-copy.sqlite
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logindata-copy.sqlite

Path C:\Users\Admin\AppData\Roaming\logindata-copy.sqlite
Size 56KB
SHA256 a36a4989ed48954499586d6551e61d6bccfc7bee269b4eab0bb836e394c24c7c
MD5 f92de240ae86100670164298edba43f2
SHA1 5d9ede7e7743e75344ee7f996456693f82896e5d
SHA512 2e6b9cbd04baf609d91a0583d742b19c5dc6dd7b334349fac1a71563c140075408fe881388e1fff72f5c1c0124d0603d54d35f5039c544ee9c1350b4e1684c21
SSDEEP 96:/kS/KLPeymOoizhGNOnfmG38tmvJHbn8MouB6w9fUPnP:B4oizhGNOnDV77Iw9fK
TLSH
T15E43651F1B682802C8698632BCB194F36F7CA13E8F639E922CB044359D75852B12D5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download