neshta | f5e8e4d7da2bb77752e5a2b0fc4d94c64f2bf49d02a4c87b55d5dd3437fb09a0

Analysis

max time kernel
150s
max time network
120s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 16:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
Size 3.1MB
Sample261104-t68mhaea24
SHA256 f5e8e4d7da2bb77752e5a2b0fc4d94c64f2bf49d02a4c87b55d5dd3437fb09a0
MD5 763fc149e7b2df6d6ff2b8c60ab2512f
SHA1 fc75c39836fb42a5dcc6b8fd4b12438dc8413d57
SHA512 8814254c6f4c97181e74bbd670ed73f84cd8ea089a58190fe18b07bb507278655bab3f670559eef19c66327342d0c80e122d4c4de702f274f168a8c214911ac2
SSDEEP 49152:jaOncWMx307IrFUkLAf4aeD3GLlGdiQJEHWwo9+SJhsLcdIHGsi:2OnU7ofeDb17bqHE
TLSH
T1B7E56A03F29A41E8D06ED1798B169222EAB1BC854B35B3DF0B9077151E7AFE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery neshta persistence privilege_escalation spyware stealer

Malware Config

Signatures

Family: Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta

Detect Neshta payload 49 IoCs

resource	yara_rule
behavioral2/files/0x000700000001890c-98.dat	family_neshta
behavioral2/files/0x000100000001b718-435.dat	family_neshta
behavioral2/files/0x000d00000001c54f-448.dat	family_neshta
behavioral2/files/0x0005000000018a39-455.dat	family_neshta
behavioral2/files/0x0007000000018923-468.dat	family_neshta
behavioral2/files/0x00050000000189ff-467.dat	family_neshta
behavioral2/files/0x0002000000019bcb-477.dat	family_neshta
behavioral2/files/0x0001000000006549-493.dat	family_neshta
behavioral2/files/0x000100000001b7fa-492.dat	family_neshta
behavioral2/memory/2836-494-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/files/0x000100000001b7f9-491.dat	family_neshta
behavioral2/files/0x000100000001b795-489.dat	family_neshta
behavioral2/files/0x000100000001b790-488.dat	family_neshta
behavioral2/files/0x000100000001b78a-486.dat	family_neshta
behavioral2/files/0x000100000001b788-485.dat	family_neshta
behavioral2/files/0x000100000001b7cd-484.dat	family_neshta
behavioral2/files/0x000100000001b714-483.dat	family_neshta
behavioral2/files/0x000100000001b713-482.dat	family_neshta
behavioral2/files/0x000100000001b705-481.dat	family_neshta
behavioral2/files/0x000100000001b703-480.dat	family_neshta
behavioral2/files/0x000100000001ba31-479.dat	family_neshta
behavioral2/files/0x0002000000019bca-476.dat	family_neshta
behavioral2/files/0x0002000000019bc9-475.dat	family_neshta
behavioral2/files/0x000100000001ae3b-474.dat	family_neshta
behavioral2/files/0x0002000000019c1e-473.dat	family_neshta
behavioral2/files/0x0003000000018a03-472.dat	family_neshta
behavioral2/files/0x000900000001892d-471.dat	family_neshta
behavioral2/files/0x000700000001892b-470.dat	family_neshta
behavioral2/files/0x0002000000018985-466.dat	family_neshta
behavioral2/files/0x0005000000018a3e-465.dat	family_neshta
behavioral2/files/0x000200000001899d-464.dat	family_neshta
behavioral2/files/0x0005000000018a2c-463.dat	family_neshta
behavioral2/memory/2036-506-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/files/0x000200000001898a-462.dat	family_neshta
behavioral2/files/0x000200000001891b-461.dat	family_neshta
behavioral2/files/0x0005000000018a2b-460.dat	family_neshta
behavioral2/files/0x0007000000018908-459.dat	family_neshta
behavioral2/files/0x0007000000018914-458.dat	family_neshta
behavioral2/files/0x0008000000018974-456.dat	family_neshta
behavioral2/memory/6080-603-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/2036-730-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/6080-907-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/2036-908-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/5116-1080-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/1532-1087-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/6080-1137-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/2036-1138-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/2036-1164-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/6080-1163-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 2 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 6080 created 784	6080	identity_helper.exe	79
PID 5116 created 784	5116	identity_helper.exe	79

Executes dropped EXE 10 IoCs

pid	Process
952	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
5608	identity_helper.exe
6080	identity_helper.exe
2836	svchost.com
2460	IDENTI~1.EXE
4316	identity_helper.exe
5116	identity_helper.exe
1532	svchost.com
3940	IDENTI~1.EXE
3812	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\cookie_exporter.exe	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MI391D~1.EXE	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MICROS~2.EXE	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	identity_helper.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\BHO\ie_to_edge_stub.exe	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedge_proxy.exe	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MID1AD~1.EXE	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	identity_helper.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	identity_helper.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\identity_helper.exe	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\Google\GOOGLE~1\141073~1.0\DISABL~1.EXE	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\cookie_exporter.exe	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MICROS~1.EXE	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MICROS~4.EXE	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevation_service.exe	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\pwahelper.exe	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	identity_helper.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\MpCmdRun.exe	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	identity_helper.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\MICROS~1.EXE	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	identity_helper.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	identity_helper.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\BHO\ie_to_edge_stub.exe	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\pwahelper.exe	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MICROS~3.EXE	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{5625B~1\WINDOW~1.EXE	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge_pwa_launcher.exe	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MI9C33~1.EXE	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MIA062~1.EXE	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\heavy_ad_intervention_opt_out.db	msedge.exe
File created	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\EdgeCoupons\coupons_data.db\LOG	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOCK	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\shared_proto_db\LOCK	msedge.exe
File created	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Local Storage\leveldb\LOG	msedge.exe
File created	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\README	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Sync Data\Logs\sync_diagnostic.log	msedge.exe
File created	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\DawnWebGPUCache\data_2	msedge.exe
File opened for modification	C:\Windows\svchost.com	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\load_statistics.db-wal	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\LOCK	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\InterestGroups-journal	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\GPUCache\index	msedge.exe
File created	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Shared Dictionary\cache\index-dir\temp-index	msedge.exe
File created	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Cache\Cache_Data\data_1	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\BrowsingTopicsSiteData	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Preferences	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Code Cache\js	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnGraphiteCache\data_3	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir952_168945383\GrShaderCache\data_3	msedge.exe
File created	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Code Cache\js\8bb1867be67136eb_0	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Shared Dictionary\cache\index-dir\the-real-index	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir952_168945383\component_crx_cache\metadata.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Feature Engagement Tracker\AvailabilityDB\LOCK	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir952_168945383\ShaderCache\data_0	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Code Cache\js\index	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir952_168945383\first_party_sets.db	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Network\Sdch Dictionaries	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir952_168945383\ShaderCache\data_0	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Extension Rules\LOCK	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOCK	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\CURRENT	msedge.exe
File created	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\28b38680-4540-415c-a6ce-92dca4077ba9.tmp	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Code Cache\js\b21fb45197b9c728_0	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\DawnWebGPUCache\data_3	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\SharedStorage	msedge.exe
File created	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3	msedge.exe
File created	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Code Cache\js\2cca9bc741a6516d_0	msedge.exe
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Nurturing\campaign_history	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Code Cache\js\2cca9bc741a6516d_0	msedge.exe
File created	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\shared_proto_db\metadata\LOG	msedge.exe
File created	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Network\0e9d3c47-8fab-4a74-86db-e12f5bdee17c.tmp	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Sync Data\LevelDB\LOCK	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\discounts_db\LOCK	msedge.exe
File created	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Shared Dictionary\cache\index	msedge.exe
File created	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Code Cache\js\e94999eac39dfd99_0	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Shared Dictionary\db	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\AdPlatform\auto_show_data.db\MANIFEST-000001	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\DIPS-wal	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Web Data	msedge.exe
File created	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Network\93b8b58c-60df-48fb-8213-0f5995870b90.tmp	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnGraphiteCache\data_2	msedge.exe
File created	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Shared Dictionary\cache\index-dir\temp-index	msedge.exe
File created	C:\Windows\SystemTemp\scoped_dir952_168945383\Last Browser	msedge.exe
File created	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Feature Engagement Tracker\AvailabilityDB\LOG	msedge.exe
File created	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Code Cache\js\b21fb45197b9c728_0	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Segmentation Platform\SignalDB\LOCK	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Sync Data\LevelDB\LOG.old	msedge.exe
File created	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Network\e056ff4f-c5dc-4944-874f-19d73cd83e35.tmp	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\commerce_subscription_db\LOCK	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Favicons-journal	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\MANIFEST-000001	msedge.exe
File opened for modification	C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Cache\Cache_Data\data_1	msedge.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	identity_helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	identity_helper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.com

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4484	msedge.exe
2152	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1704430598-3087477806-3297458608-1000\{35F87493-4B16-4852-B0A5-B37E251FBD81}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings	identity_helper.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1704430598-3087477806-3297458608-1000\{1CEA41D3-EFAD-4669-BDB2-EFE59907F2AB}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
1352	msedge.exe
5384	msedge.exe
5384	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1352	msedge.exe
5384	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 952	2036	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe	89
PID 952 wrote to memory of 1352	952	2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe	90
PID 1352 wrote to memory of 4244	1352	msedge.exe	91
PID 1352 wrote to memory of 3380	1352	msedge.exe	92
PID 1352 wrote to memory of 2152	1352	msedge.exe	93
PID 1352 wrote to memory of 3380	1352	msedge.exe	92
PID 1352 wrote to memory of 3380	1352	msedge.exe	92
PID 1352 wrote to memory of 3368	1352	msedge.exe	94
PID 1352 wrote to memory of 3368	1352	msedge.exe	94
PID 1352 wrote to memory of 4220	1352	msedge.exe	95
PID 1352 wrote to memory of 4220	1352	msedge.exe	95
PID 1352 wrote to memory of 4220	1352	msedge.exe	95
PID 1352 wrote to memory of 1688	1352	msedge.exe	96
PID 1352 wrote to memory of 1688	1352	msedge.exe	96
PID 1352 wrote to memory of 1688	1352	msedge.exe	96
PID 1352 wrote to memory of 4776	1352	msedge.exe	97
PID 1352 wrote to memory of 5324	1352	msedge.exe	98
PID 1352 wrote to memory of 808	1352	msedge.exe	99
PID 1352 wrote to memory of 3456	1352	msedge.exe	100
PID 1352 wrote to memory of 1820	1352	msedge.exe	101
PID 1352 wrote to memory of 616	1352	msedge.exe	102
PID 1352 wrote to memory of 5484	1352	msedge.exe	103
PID 1352 wrote to memory of 4776	1352	msedge.exe	97
PID 1352 wrote to memory of 2848	1352	msedge.exe	104
PID 1352 wrote to memory of 4428	1352	msedge.exe	105
PID 1352 wrote to memory of 4776	1352	msedge.exe	97
PID 1352 wrote to memory of 5324	1352	msedge.exe	98
PID 1352 wrote to memory of 2772	1352	msedge.exe	106
PID 1352 wrote to memory of 5324	1352	msedge.exe	98
PID 1352 wrote to memory of 808	1352	msedge.exe	99
PID 1352 wrote to memory of 808	1352	msedge.exe	99
PID 1352 wrote to memory of 3456	1352	msedge.exe	100
PID 1352 wrote to memory of 3456	1352	msedge.exe	100
PID 1352 wrote to memory of 1820	1352	msedge.exe	101
PID 1352 wrote to memory of 1820	1352	msedge.exe	101
PID 1352 wrote to memory of 616	1352	msedge.exe	102
PID 1352 wrote to memory of 616	1352	msedge.exe	102
PID 1352 wrote to memory of 5484	1352	msedge.exe	103
PID 1352 wrote to memory of 5484	1352	msedge.exe	103
PID 1352 wrote to memory of 2848	1352	msedge.exe	104
PID 1352 wrote to memory of 2848	1352	msedge.exe	104
PID 1352 wrote to memory of 4428	1352	msedge.exe	105
PID 1352 wrote to memory of 4428	1352	msedge.exe	105
PID 1352 wrote to memory of 2772	1352	msedge.exe	106
PID 1352 wrote to memory of 2772	1352	msedge.exe	106
PID 1352 wrote to memory of 2756	1352	msedge.exe	107
PID 1352 wrote to memory of 2756	1352	msedge.exe	107
PID 1352 wrote to memory of 4104	1352	msedge.exe	108
PID 1352 wrote to memory of 4104	1352	msedge.exe	108
PID 1352 wrote to memory of 1788	1352	msedge.exe	109
PID 1352 wrote to memory of 1788	1352	msedge.exe	109
PID 1352 wrote to memory of 3140	1352	msedge.exe	110
PID 1352 wrote to memory of 3140	1352	msedge.exe	110
PID 1352 wrote to memory of 6080	1352	msedge.exe	112
PID 6080 wrote to memory of 2836	6080	identity_helper.exe	113
PID 2836 wrote to memory of 2460	2836	svchost.com	114
PID 1352 wrote to memory of 2736	1352	msedge.exe	115
PID 1352 wrote to memory of 2736	1352	msedge.exe	115
PID 1352 wrote to memory of 4724	1352	msedge.exe	116
PID 1352 wrote to memory of 4724	1352	msedge.exe	116
PID 1352 wrote to memory of 3392	1352	msedge.exe	118
PID 1352 wrote to memory of 3392	1352	msedge.exe	118
PID 1352 wrote to memory of 1320	1352	msedge.exe	119
PID 1352 wrote to memory of 1320	1352	msedge.exe	119

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:784
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\IDENTI~1.EXE" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir952_168945383" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2236,i,16757678381321094293,16180566885451937969,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:14
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Users\Admin\AppData\Local\Temp\3582-490\IDENTI~1.EXE
    C:\Users\Admin\AppData\Local\Temp\3582-490\IDENTI~1.EXE --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir952_168945383" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2236,i,16757678381321094293,16180566885451937969,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:14
    3⤵
    - Executes dropped EXE
    PID:2460
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\IDENTI~1.EXE" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir952_168945383" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2192,i,16048028960891885711,1303063584166911265,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:14
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1532
- - C:\Users\Admin\AppData\Local\Temp\3582-490\IDENTI~1.EXE
    C:\Users\Admin\AppData\Local\Temp\3582-490\IDENTI~1.EXE --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir952_168945383" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2192,i,16048028960891885711,1303063584166911265,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:14
    3⤵
    - Executes dropped EXE
    PID:3940

C:\Users\Admin\AppData\Local\Temp\2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe"
1⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Users\Admin\AppData\Local\Temp\3582-490\2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless=new --user-data-dir="C:\Windows\SystemTemp\scoped_dir952_168945383" --microsoft-ext-app-env=PEH --disable-prerender-ntp about:blank
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Windows\SystemTemp\scoped_dir952_168945383 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\scoped_dir952_168945383\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x2c8,0x7ffe2f70c188,0x7ffe2f70c194,0x7ffe2f70c1a0
      4⤵
      PID:4244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir952_168945383" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --field-trial-handle=2236,i,16757678381321094293,16180566885451937969,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
      4⤵
      PID:3380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir952_168945383" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2236,i,16757678381321094293,16180566885451937969,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:11
      4⤵
      Drops file in Windows directory
      System Time Discovery
      PID:2152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir952_168945383" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2236,i,16757678381321094293,16180566885451937969,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3152 /prefetch:13
      4⤵
      PID:3368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir952_168945383" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2236,i,16757678381321094293,16180566885451937969,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
      4⤵
      PID:4220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir952_168945383" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2236,i,16757678381321094293,16180566885451937969,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
      4⤵
      PID:1688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir952_168945383" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2236,i,16757678381321094293,16180566885451937969,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
      4⤵
      PID:4776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir952_168945383" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2236,i,16757678381321094293,16180566885451937969,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:9
      4⤵
      PID:5324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir952_168945383" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=2236,i,16757678381321094293,16180566885451937969,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:1
      4⤵
      PID:808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir952_168945383" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=2236,i,16757678381321094293,16180566885451937969,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:9
      4⤵
      PID:3456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir952_168945383" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=2236,i,16757678381321094293,16180566885451937969,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:1
      4⤵
      PID:1820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir952_168945383" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=2236,i,16757678381321094293,16180566885451937969,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:1
      4⤵
      PID:616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir952_168945383" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=2236,i,16757678381321094293,16180566885451937969,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:9
      4⤵
      PID:5484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir952_168945383" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=2236,i,16757678381321094293,16180566885451937969,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:9
      4⤵
      PID:2848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir952_168945383" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=2236,i,16757678381321094293,16180566885451937969,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:1
      4⤵
      PID:4428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir952_168945383" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=2236,i,16757678381321094293,16180566885451937969,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:9
      4⤵
      PID:2772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir952_168945383" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2236,i,16757678381321094293,16180566885451937969,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:14
      4⤵
      PID:2756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir952_168945383" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2236,i,16757678381321094293,16180566885451937969,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:14
      4⤵
      PID:4104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir952_168945383" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2236,i,16757678381321094293,16180566885451937969,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:14
      4⤵
      PID:1788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir952_168945383" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2236,i,16757678381321094293,16180566885451937969,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:14
      4⤵
      PID:3140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir952_168945383" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2236,i,16757678381321094293,16180566885451937969,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:14
      4⤵
      Executes dropped EXE
      PID:5608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir952_168945383" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2236,i,16757678381321094293,16180566885451937969,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:14
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:6080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir952_168945383" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2236,i,16757678381321094293,16180566885451937969,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=7472 /prefetch:14
      4⤵
      PID:2736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir952_168945383" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2236,i,16757678381321094293,16180566885451937969,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=7596 /prefetch:14
      4⤵
      PID:4724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir952_168945383" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2236,i,16757678381321094293,16180566885451937969,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:14
      4⤵
      PID:3392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir952_168945383" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2236,i,16757678381321094293,16180566885451937969,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=7304 /prefetch:14
      4⤵
      PID:1320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir952_168945383" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2236,i,16757678381321094293,16180566885451937969,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:14
      4⤵
      PID:3776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless=new --user-data-dir="C:\Windows\SystemTemp\scoped_dir952_168945383" --microsoft-ext-app-env=PEH --disable-prerender-ntp about:blank
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:5384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Windows\SystemTemp\scoped_dir952_168945383 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\scoped_dir952_168945383\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x324,0x7ffe2f70c188,0x7ffe2f70c194,0x7ffe2f70c1a0
      4⤵
      PID:5676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir952_168945383" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --field-trial-handle=2192,i,16048028960891885711,1303063584166911265,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
      4⤵
      PID:4116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir952_168945383" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2192,i,16048028960891885711,1303063584166911265,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:11
      4⤵
      Drops file in Windows directory
      System Time Discovery
      PID:4484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir952_168945383" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2192,i,16048028960891885711,1303063584166911265,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:13
      4⤵
      PID:5264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir952_168945383" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2192,i,16048028960891885711,1303063584166911265,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
      4⤵
      PID:6040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir952_168945383" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2192,i,16048028960891885711,1303063584166911265,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
      4⤵
      PID:4664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir952_168945383" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2192,i,16048028960891885711,1303063584166911265,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
      4⤵
      PID:4860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir952_168945383" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2192,i,16048028960891885711,1303063584166911265,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:14
      4⤵
      PID:1912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir952_168945383" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2192,i,16048028960891885711,1303063584166911265,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:14
      4⤵
      Executes dropped EXE
      PID:4316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Windows\SystemTemp\scoped_dir952_168945383" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2192,i,16048028960891885711,1303063584166911265,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:14
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:5116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1636

C:\Users\Admin\AppData\Local\Temp\3582-490\2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
1⤵
- Executes dropped EXE
PID:3812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ACROBR~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE
Size 328KB
SHA256 888a1dd0033e5d758a4e731e3e55357de866e80d03b1b194375f714e1fd4351d
MD5 39c8a4c2c3984b64b701b85cb724533b
SHA1 c911f4c4070dfe9a35d9adcb7de6e6fb1482ce00
SHA512 f42ca2962fe60cff1a13dea8b81ff0647b317c785ee4f5159c38487c34d33aecba8478757047d31ab2ee893fbdcb91a21655353456ba6a018fc71b2278db4db2
SSDEEP 6144:k9x6edjvw6L6jAVnhH1Am2ZBU4M528hW8Bi7Q5VYN9:Y6exwI1oB8RZ4Q5VYH
TLSH
T1DC645B017F908EB6F5A2807F5D7A631D5A6ABA221B10E2C373703B5DCD321C59A3E356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ACROTE~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
Size 86KB
SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
MD5 3b73078a714bf61d1c19ebc3afc0e454
SHA1 9abeabd74613a2f533e2244c9ee6f967188e4e7e
SHA512 75959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4
SSDEEP 1536:JxqjQ+P04wsmJCNgh/sE/EkHd0Ci2zkQASqk+H6L2C:sr85CysEM6GC+QA8+HlC
TLSH
T17493AE13FAF18872D1621BF89C29E359C93F7A306E3056A7A3E40D5D5D747C26C2924B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ADOBEC~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE
Size 5.7MB
SHA256 1b5c715d71384f043843ea1785a6873a9f39d2daae112ccdeffcd88b10a3a403
MD5 09acdc5bbec5a47e8ae47f4a348541e2
SHA1 658f64967b2a9372c1c0bdd59c6fb2a18301d891
SHA512 3867bf98e1a0e253114a98b78b047b0d8282b5abf4aaf836f31cc0e26224e2a1b802c65df9d90dc7696a6dbcb9a8e4b900f1d1299e1b11e36f095ebaf8a2e5b8
SSDEEP 49152:DmlI9H9rY654KYroYJqkhWFUBlNwnFq3kXRsPI6BRY20YZAliDgFL2YmXZjU2P38:oiH9MfT3NwMkKhBRr0yAk6qkKvq
TLSH
T1F3567C22B902C139E15102B159ECBFE9C49D99348FB105DFBAC41F6E9A613E33931E67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ADelRCP.exe

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe
Size 175KB
SHA256 3f00404dd591c2856e6f71bd78423ed47199902e0b85f228e6c4de72c59ddffe
MD5 576410de51e63c3b5442540c8fdacbee
SHA1 8de673b679e0fee6e460cbf4f21ab728e41e0973
SHA512 f7761f3878775b30cc3d756fa122e74548dfc0a27e38fa4109e34a59a009df333d074bf14a227549ae347605f271be47984c55148685faac479aeb481f7191db
SSDEEP 3072:sr85CnHb5CZCq5DACsVlNl7HIJ1PcJ7LxnkdA53Pa4sjSTX4:k9n4N5QVrZZ7Lxkmsjj
TLSH
T119045C22BBC09075E69317723EFC79E44BF6BC319AA410ABF318495B197E350963931B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RdrCEF.exe

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe
Size 9.4MB
SHA256 31da9632f5d25806b77b617d48da52a14afc574bbe1653120f97705284ea566c
MD5 322302633e36360a24252f6291cdfc91
SHA1 238ed62353776c646957efefc0174c545c2afa3d
SHA512 5a1f7c44ce7f5036bffc18ebac39e2bf70e6f35fa252617d665b26448f4c4473adfa115467b7e2d9b7068823e448f74410cdcdfef1ac1c09021e051921787373
SSDEEP 98304:FrbT5JhEP+SuC0qyLfPeLDo/uLGM7gbl91hxkPZTA:lXnfW/JLGMcblLheTA
TLSH
T186A6AF1D7BE21036CD732176AF4FA104E739D007A215C6977ADC83981FB1AA152B6FE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcroRd32.exe

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
Size 2.4MB
SHA256 8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6
MD5 8ffc3bdf4a1903d9e28b99d1643fc9c7
SHA1 919ba8594db0ae245a8abd80f9f3698826fc6fe5
SHA512 0b94ead97374d74eaee87e7614ddd3911d2cf66d4c49abbfd06b02c03e5dd56fd00993b4947e8a4bcd9d891fa39cab18cc6b61efc7d0812e91eb3aea9cd1a427
SSDEEP 49152:oTfiUEWo6zuEz439z99akTBc4O8b8ITDnlT4NvJX:oTfiG/nzU90T
TLSH
T179C59226A2C8C0EBE5642170CC59BBF900546D78DBA2CDD7BD447E16BA307D29533A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WCCHRO~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE
Size 183KB
SHA256 ecd5e94da88c653e4c34b6ab325e0aca8824247b290336f75c410caa16381bc5
MD5 9dfcdd1ab508b26917bb2461488d8605
SHA1 4ba6342bcf4942ade05fb12db83da89dc8c56a21
SHA512 1afc1b95f160333f1ff2fa14b3f22a28ae33850699c6b5498915a8b6bec1cfc40f33cb69583240aa9206bc2ea7ab14e05e071275b836502a92aa8c529fc1b137
SSDEEP 3072:sr85Cl8pIsfHwCbf9MFdRvyAgnz8n/dfQ7PjFKq23T/h:k9KbfHwCbyFdAafCPc53T/h
TLSH
T177046B51F7C7C9B2E09206704C2AAF6541B9FE381F7105EBF3E87A1E5A713C2182566B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eula.exe

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe
Size 131KB
SHA256 5c3ef3ec7594c040146e908014791dd15201ba58b4d70032770bb661b6a0e394
MD5 5791075058b526842f4601c46abd59f5
SHA1 b2748f7542e2eebcd0353c3720d92bbffad8678f
SHA512 83e303971ed64019fde9e4ba6f6e889f8fb105088490dfa7dcf579a12baff20ef491f563d132d60c7b24a4fd3cac29bd9dc974571cd162000fae8fba4e0e54fb
SSDEEP 3072:sr85Ciq9YnyoRmLisiselSsONt3F7oQGO7M1bp:k9kgLHvld2
TLSH
T19CD37C13BBE0C872D66207785D25F36696AFF6305E74CB677B880B0E9DB46824D0C64A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FULLTR~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE
Size 254KB
SHA256 16d65f2463658a72dba205dcaa18bc3d0bab4453e726233d68bc176e69db0950
MD5 4ddc609ae13a777493f3eeda70a81d40
SHA1 8957c390f9b2c136d37190e32bccae3ae671c80a
SHA512 9d7f90d1529cab20078c2690bf7bffab5a451a41d8993781effe807e619da0e7292f991da2f0c5c131b111d028b3e6084e5648c90816e74dfb664e7f78181bc5
SSDEEP 3072:sr85CYl4dsOc6v2vTzwU+Pho86meq+FaSoB2+vSHr8qcVz5fzsC:k9r3PiY+Fa7BdvG1cT7
TLSH
T128446B307B86C53BE66301718CF8EBBF942EBA150F6851D7B3984B5E5EA05D32E31846
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOGTRA~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE
Size 386KB
SHA256 473eb551101caeaf2d18f811342e21de323c8dd19ed21011997716871defe997
MD5 8c753d6448183dea5269445738486e01
SHA1 ebbbdc0022ca7487cd6294714cd3fbcb70923af9
SHA512 4f6fddefc42455540448eac0b693a4847e21b68467486376a4186776bfe137337733d3075b7b87ed7dac532478dc9afc63883607ec8205df3f155fee64c7a9be
SSDEEP 6144:k9W3n0dK2NP0RHx8D98WTBPW8fF8oABm1nKZ0RsrI:WKhHSDeWTRW8fdebmqI
TLSH
T16A84AE11FB86C172D96602728DAAA35CC4BDB5714F314BD3E3DC6F0D9E601D2A932B86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

READER~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE
Size 92KB
SHA256 2f947e3ca624ce7373080b4a3934e21644fb070a53feeaae442b15b849c2954f
MD5 176436d406fd1aabebae353963b3ebcf
SHA1 9ffdfdb8cc832a0c6501c4c0e85b23a0f7eff57a
SHA512 a2d1a714e0c1e5463260c64048ba8fd5064cfa06d4a43d02fc04a30748102ff5ba86d20a08e611e200dc778e2b7b3ae808da48132a05a61aa09ac424a182a06a
SSDEEP 1536:JxqjQ+P04wsmJC66w8MghW4wNlu9HQIXsW/44:sr85C66w8oFlKwW//
TLSH
T1E1936C13BB928E33D4204AB91C6997B8D4BEF5306F1556E367650A4E8DBC3C22C3925F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WOW_HE~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE
Size 147KB
SHA256 750824b5f75c91a6c2eeb8c5e60ae28d7a81e323d3762c8652255bfea5cba0bb
MD5 3b35b268659965ab93b6ee42f8193395
SHA1 8faefc346e99c9b2488f2414234c9e4740b96d88
SHA512 035259a7598584ddb770db3da4e066b64dc65638501cdd8ff9f8e2646f23b76e3dfffa1fb5ed57c9bd15bb4efa3f7dd33fdc2e769e5cc195c25de0e340eb89ab
SSDEEP 3072:sr85Ce6l8TRpR+EMucyaGoS43IIJNdS3UA:k9e6l8aGo/3VL4kA
TLSH
T15EE38C57B7E134F8E1768A78CC615608EB32B8352A319BAF03A4065A5F273C05E3DF25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arh.exe

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe
Size 125KB
SHA256 fe44ca8d5050932851aa54c23133277e66db939501af58e5aeb7b67ec1dde7b5
MD5 cce8964848413b49f18a44da9cb0a79b
SHA1 0b7452100d400acebb1c1887542f322a92cbd7ae
SHA512 bf8fc270229d46a083ced30da6637f3ca510b0ce44624a9b21ec6aacac81666dffd41855053a936aa9e8ea6e745a09b820b506ec7bf1173b6f1837828a35103d
SSDEEP 1536:JxqjQ+P04wsmJCWM2D57Kykf8d/R8Tyr5J5is7MDjrXDyO4zkm8dbHVLokF8iJTp:sr85CCQw/STyr5Jks7MvrMzkm8PL3Eo
TLSH
T127C3AE22F6A1C432D4920D788919C3B18E3F7D3169A99957F7E80B5E9E607C0EA1D31F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32BITM~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE
Size 142KB
SHA256 3e9da97a7106122245e77f13f3f3cc96c055d732ab841eb848d03ac25401c1bc
MD5 92dc0a5b61c98ac6ca3c9e09711e0a5d
SHA1 f809f50cfdfbc469561bced921d0bad343a0d7b4
SHA512 d9eefb19f82e0786d9be0dbe5e339d25473fb3a09682f40c6d190d4c320cca5556abb72b5d97c6b0da4f8faefdc6d39ac9d0415fdf94ebcc90ecdf2e513c6a31
SSDEEP 1536:JxqjQ+P04wsmJC9S7UmwuBLAefbVH8x+FOI31EmkIY2d5J6WUghEuireklhKsikg:sr85Cs7HN9fN8sFOE1Z5Y2966ilU9xL
TLSH
T1F2E38D21F5C188B2E67205B54D2AA79E942CF6340F3194E3B3E84F2D9D342C39F765A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

64BITM~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE
Size 278KB
SHA256 22a585c183e27b3c732028ff193733c2f9d03700a0e95e65c556b0592c43d880
MD5 12c29dd57aa69f45ddd2e47620e0a8d9
SHA1 ba297aa3fe237ca916257bc46370b360a2db2223
SHA512 255176cd1a88dfa2af3838769cc20dc7ad9d969344801f07b9ebb372c12cee3f47f2dba3559f391deab10650875cad245d9724acfa23a42b336bfa96559a5488
SSDEEP 6144:k9P1UKupTu8ffMb0/GxsZfcJtqQ1UBZ6g:jK+HMYcytZh
TLSH
T105546C1A77D84CF5E467C23DCD528642E2B278551B34D7CB6760022AAF637E0AE3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ADOBEA~1.EXE

Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE
Size 454KB
SHA256 bb07d817b8b1b6b4c25e62b6120e51dec10118557d7b6b696ad084a5ba5bfdeb
MD5 bcd0f32f28d3c2ba8f53d1052d05252d
SHA1 c29b4591df930dabc1a4bd0fa2c0ad91500eafb2
SHA512 79f407735853f82f46870c52058ceee4d91857a89db14868ee1169abd5c0fd2e3fa1ed230ab90b5f479a9581b88998643d69b0df498defea29e73b0d487f3b10
SSDEEP 6144:k9sQsSVWSLjX2PxPNMRyfn7LzPdKblt0K+HAfh0v8axsbQuXYvr6yIll6Jf:+VWnxlMSn7nFKbltn+Ch/m6Xl6l
TLSH
T1E1A47C1077D0C036F1B329768A7FE728546DB9715F6881CFE3881A6E4E706E0AA3571B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.exe

Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe
Size 1.2MB
SHA256 b1ec065f71cc40f400e006586d370997102860504fd643b235e8ed9f5607262a
MD5 d47ed8961782d9e27f359447fa86c266
SHA1 d37d3f962c8d302b18ec468b4abe94f792f72a3b
SHA512 3e33f2cdf35024868b183449019de9278035e7966b342ba320a6c601b5629792cbb98a19850d4ca80b906c85d10e8503b0193794d1f1efa849fa33d26cff0669
SSDEEP 12288:M0ZRHkXVfeeO4LMneqyQsWSjGQCfLBlS7guN1AnQ6i12NI+03Sgouvb:M0ZRHkFfenxyQZXS7gZnQh2NIDSgouvb
TLSH
T19D45E50267F94129F1F37B71EEB993645A77BC61AE39C50E5284025E0DB4A90EE31B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaureg.exe

Path C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe
Size 555KB
SHA256 c5a99f42100834599e4995d0a178b32b772a6e774a4050a6bb00438af0a6a1f3
MD5 ce82862ca68d666d7aa47acc514c3e3d
SHA1 f458c7f43372dbcdac8257b1639e0fe51f592e28
SHA512 bca7afd6589c3215c92fdaca552ad3380f53d3db8c4b69329a1fa81528dd952a14bf012321de92ad1d20e5c1888eab3dd512b1ac80a406baccc37ee6ff4a90dc
SSDEEP 12288:PKv89GDYikjjqggz7/PtFxRNWBYrpkQJ7u:PKqjjg/PzNWyr9J7u
TLSH
T1A5C4BF2079A0C032D17311344D6AE794A63EF6700E7249E777D46FBD7E346C1EB28AA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOIN~1.EXE

Path C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE
Size 121KB
SHA256 405b8bd647fa703e233b8b609a18999abe465a8458168f1daf23197bd2ea36aa
MD5 cbd96ba6abe7564cb5980502eec0b5f6
SHA1 74e1fe1429cec3e91f55364e5cb8385a64bb0006
SHA512 a551001853f6b93dfbc6cf6a681820af31330a19d5411076ff3dbce90937b3d92173085a15f29ebf56f2ef12a4e86860ac6723ebc89c98ea31ea7a6c7e3d7cdc
SSDEEP 3072:sr85CqPo10JOSdhuPlur1Vg9uCRFRzsxeZ:k9qg1MOc4iVmRFJs0Z
TLSH
T114C37C22F9E0C032D4A219B88DACD261593E7A721B3589C337A41BDDDDB03C1AE79357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe
Size 325KB
SHA256 5e2e22ead49ce9cc11141dbeebbe5b93a530c966695d8efc2083f00e6be53423
MD5 9a8d683f9f884ddd9160a5912ca06995
SHA1 98dc8682a0c44727ee039298665f5d95b057c854
SHA512 6aecf8c5cb5796d6879f8643e20c653f58bad70820896b0019c39623604d5b3c8a4420562ab051c6685edce60aa068d9c2dbb4413a7b16c6d01a9ac10dc22c12
SSDEEP 6144:k9/jbN5zFEjGkqkAJHyEzYV/PvyeWPZw22b:GjzzFEoS2cPvyeiZwbb
TLSH
T19D649EA5B3901CF4EC63453ECC258916D6B27C2A0B70C65F13A8366A5F733911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe
Size 325KB
SHA256 e2262c798729169f697e6c30e5211cde604fd8b14769311ff4ea81abba8c2781
MD5 892cf4fc5398e07bf652c50ef2aa3b88
SHA1 c399e55756b23938057a0ecae597bd9dbe481866
SHA512 f16a9e4b1150098c5936ec6107c36d47246dafd5a43e9f4ad9a31ecab69cc789c768691fa23a1440fae7f6e93e8e62566b5c86f7ed6bb4cfe26368149ea8c167
SSDEEP 6144:k9/eWYoTOLHIsPPzAdnz0YutYPDvh2AHdwSc:GeWYoaLHF3z0z04PDvh2Cd9c
TLSH
T15A649EA5B3901CF4EC67853ECC258916D6B27C2A0B70C65F13B8366A5F333911D2DB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe
Size 505KB
SHA256 da73b6e071788372702104b9c72b6697e84e7c75e248e964996700b77c6b6f1c
MD5 452c3ce70edba3c6e358fad9fb47eb4c
SHA1 d24ea3b642f385a666159ef4c39714bec2b08636
SHA512 fe8a0b9b1386d6931dc7b646d0dd99c3d1b44bd40698b33077e7eeba877b53e5cb39ff2aa0f6919ccab62953a674577bc1b2516d9cadc0c051009b2083a08085
SSDEEP 6144:k9/4aKTRnXtTkCgwCzUg/HpjN4IBwu7QTLbpqmHdIvWTiYB2n5:GHWRdTfgwCHKy7GLbbdIvWTi4e5
TLSH
T178B43990F3E414F4F0B79A3589764511DAB67C6A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DISABL~1.EXE

Path C:\PROGRA~2\Google\Update\DISABL~1.EXE
Size 5.7MB
SHA256 3acf99624820fd862ac30780021108f0ff2df60db3df351cd17400404f279d3c
MD5 e63e539e0f0393fdea9da0d6ee80ac45
SHA1 027c8609ca7bb42b61256abb3269e1babce0141b
SHA512 f4d0458b8bfe5a66254cb85b8ba3859c9d6a937e6d14f8e15b95b7e131aaeff8a1be39f0eee3939e305901797d98dd2c5aac1837873a49f786cfcac0c9b1e6d6
SSDEEP 98304:Fog5HQ+hDHQTW6Af4fF7KkOuYO6IgF+IAMk/JexMXP8iuHG9XXYXQz7w7:Fog1P9fIlOuz6IgF+I3m2MXP6HG8QzU
TLSH
T133567C23A4E08034E5F732756D2CA73959327BA29F3145CB86946C946FB83D3293936F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\BHO\ie_to_edge_stub.exe
Size 553KB
SHA256 7b2d809ff4b2691c04855f4bb3d89b88fa4d1d65c8c35d3941a26f015947cde9
MD5 0dfe9b91beadab9c6884972da71f2dca
SHA1 97566314b3243d07713082b08b587e29921b3f4b
SHA512 9e6678f6db3a189d374ca4e1d1e207c6ff2f912012b450b7e2dc8f94800cf48d58df0618528b6c17094ff4bab0646f6bcabad8a5dc1b9b5d49ff51ddaf9ff765
SSDEEP 6144:k9d10k9mqI9PZJroJIxXY720DRaOOcno2m9XlqkuMnHvEU:C0k9mnRT0JIxQ4ObTMPj
TLSH
T12FC48C41B7E445F8E06AC5388E478242EA7278960F64E6DF02E4927D2F3B6E55F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_stub.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\BHO\ie_to_edge_stub.exe
Size 562KB
SHA256 533d6da98378d3b1bb120b192bc5bd20bbeed6e123fe9fc6c15a4a3504932c71
MD5 dc797b816795fbca95de068b5fe4d089
SHA1 f5ed348926dd8c5b235dcac434bf3d7fba6b32fc
SHA512 e44d5b42d408ba7ad2c8c4b6f7af9f27650ab540afb68bc79f8bce4ad0b2843c67ab050b9d9568e9006756862199a90c6bf28483f889bf09257ed28af665147c
SSDEEP 6144:k9bLO76tlVr1Il5HlrJHU7kfLeeHVlK8SQBJ9LBKJwgdAmKa5rl6C:0S86nHrUA9HVlK8SQBJ9t4f15rR
TLSH
T161C48E41F3E847F8E07AC534CE528646EA7278960B61A6DF03A0527A2F376E55F3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\INSTAL~1\setup.exe
Size 7.1MB
SHA256 70c13c14a682d65fd82ec72f578e160617f8b7c164414bcce613a9b9ebd0c878
MD5 f80dd7e28ac5795b9cff0de19ea24bd3
SHA1 eb68d7d26bd4f849cefe6638bf4a3b73e3ce7a20
SHA512 af6ebd45c716d5c50395705dfa80c94c17fda338db24046051e82515b742cdc4f0503d2726278ba40a3b77e9b358f2b74704c851f28a8539dd77bee34b0e4fd4
SSDEEP 98304:V6CZetahq+WZxcpwCsJB2++fGOOxRj2vJzRN+T6frL:gCZetaEMGIG5xVqzRdDL
TLSH
T1A8766C47E3E600A8E46ED970CF2A9521DA353C8E47B492EF169476E41A32FD47B38F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cookie_exporter.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\cookie_exporter.exe
Size 155KB
SHA256 30d26d2f766f716cd6b21cdc15065ee4191760ef0d37de51f67dead898fb8e7c
MD5 ea213110894b1ad78e8e13686ff682c4
SHA1 49ea3bc31236ae9a32c600f7bb5cd66c49dafbdc
SHA512 77ec20210cffff94cf85ea1efb0551bc38000928b2af5f125b0597a281a3489f44d55b97dbbffba4f25e7f996a1d23d8734644f1cbd81ff3f8da42db6c9e64d9
SSDEEP 3072:sr85Co/5vndNI3Kk4+NLlzt4++++YdbeBGnRppeQBMWRywl9:k9ohvndNIaINY++++YtBnRpAFWcwl9
TLSH
T1B3F37B57B2E870F9E1324A78C8118605EB37B8711B21AFEF07A4065A1F277D19E3DB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevated_tracing_service.exe
Size 3.8MB
SHA256 c13ce5f473ff68ffdea61e8a4800008f527054f4561f2bf7853f6769d0c02dc5
MD5 b1de16babff63db612506d5dfcdd28f2
SHA1 4615a0df5812fc95be0f836b9d29a454da5bc67a
SHA512 5b3694c0a5f69d7ac74efe66a5b61f0b85cc73127a7805c0e93b8a368e0ee03eb72920d12988731cd9e43d7166e2cbe743deeeff02dc51a18301c14cfd394579
SSDEEP 49152:g6gu3VyrBme/hqvxbmhLbKqm006NPpIupEoEVu+e6NqcXToRzvUqIzYHBigdQBW:N3mMsYvRmCCENUhIUBbF
TLSH
T1A8063903F29900E8E05DD578CB568122EAB2BC854B35B2DF0750B7562E7BEE4AB3D750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevation_service.exe
Size 2.2MB
SHA256 8c53985c403e44c0c899c2d1f2a0b8afb1f17fb928ff866271de7952c9ff7c66
MD5 0db104178cbb26201b06ca53a8c18e39
SHA1 36cd76eb3cf04bd3cdf0fc3be4ec84fc52663040
SHA512 7c7871ad15851162facfb71f854f72869c833a68ed26c331d21c7900ac4fd87a5dcd9fc7ea2f494155b51d9b2f7c40a29dcd0cf06215ed7255c376106120dfe2
SSDEEP 49152:pb+632BuPkFKRrdE6oh2stBhuXjfS4LWxn9:/3q6DjBK
TLSH
T1A4B56B03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge.exe
Size 4.0MB
SHA256 18f4157c2dabb39cf84662e17c471f69f679840a70be3a4685e0c4ed8ccc207a
MD5 48d1aea6577f190f1e31b4ce9c2c3a83
SHA1 7bc44982c5a6bf7506d6f2dc4b2630caf0b263ce
SHA512 be71c8f0481b619aceb33b32a9222b0b6909fd07866f01374fc92fa08632ff01b7708166239c284bd1429a6b44f3edc351db346d877f174a369be9edb61dbbd5
SSDEEP 49152:GudQuVyBvNszCnSgVdQM3/+TjER7zExldDwUIDtaZHWRdpev2y/BaK:iijnUdYd+RaAK
TLSH
T121164903B29940D8D059C074CE5AD232EB617C8947F162EF3690B7EA2A73AD47B3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge_pwa_launcher.exe
Size 1.8MB
SHA256 2c31887681976e9691cfed32b98a9f81898beaaee9ea3f7a90fe695b84190511
MD5 650cdf4a369b08768ceaa48a2cfd7fdb
SHA1 d105394f9f806863e3d4a8611c76f291e13fe588
SHA512 4679c6a80bedb2de0d405037277b3c32cf04223e048ca90b79d3d709face5240cc8ad97d9bebd5f53617ce06b551421569a9e5434e68b4d6a5b7b8284155c1b6
SSDEEP 24576:Z5kAGu6McqpA7D9ruO3O7Q7OBLLMdus7CtW7KSdHBxmRkkkkkkklQXBysWAk:ZZGu6qG13O7Q7gLYduZrSdHBAVfk
TLSH
T142957C03F6DA80E5E05DC2B8CB768B35EA717C554F20A6DF0680BA652E77AD04B3D394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedgewebview2.exe
Size 3.4MB
SHA256 c0566225b047e50773acde8ada568ef7612809e74f2cc200504e60cf7a917c68
MD5 12403afd3d0b104f1d0f6cf034ed01f7
SHA1 08a9a2c1962f9f522c841dad14a55400a2b9e25b
SHA512 29a14f52b706b966361d9875ef3904560b41924fa959ce90985dd5e694d2ca9d0181509309bcb512563479fd5b5286cbef216e3ed5ed90cc170105f6dd13ec1c
SSDEEP 49152:DuZgk07G0auOj85q7aGScYbb6YErz7z4AkOuaRoBISCaQZCLlrrW:lo/Yhy8OnZ9
TLSH
T16CF54903A29900D8D059D074CF4A9223EBA27C8D47F566EF3690B6D52A77EE47B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_click_helper.exe

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\notification_click_helper.exe
Size 1.6MB
SHA256 0faa9f1f62a95136d454efa51e6f8e8ff06a08d344fd26dc2216de09f6fbee4e
MD5 3b9687342c1ebc56dfa598bf9f0f8358
SHA1 794bcee37bfdcd2e8df01f9773c277629c5891b0
SHA512 addf3d1844271b0e54e8c665df1f85f521f0f14bd66bbf8fdd00eeee46315c294830d6d95e441cddbe6843b230064759e0d12e70b32690a431afdd45ee3aefbf
SSDEEP 24576:pnh1d46If99L9KA4uaiXJVB6HveuTJb9HxeQuJXlPnyF4mfHU9YawsNk:34hoNiZVB6PeuT5lxeHX04mfHIk
TLSH
T145856903F2D841E8D06DD2B8CB568122EAB27C450B34A6DF0791B65A1F7BEE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSEDGE~1.EXE

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE
Size 1.5MB
SHA256 b4bdab2b2c7731923854f254ba1494c25a11331293c0ee4939afd10ba1e2b575
MD5 8042d50db625ec28b95ecd7911222ac0
SHA1 a485755c8216c717a446bce8f2a7644328c59d1c
SHA512 8a0e4a53bb43933937d588fe6bf4754245136995d2603c4e3fcb8dd66cc8714b80255a52e75a31aac09223ed7b2f8d49594c20288aa2beeb802136f0f5f9b799
SSDEEP 24576:ryoteh6euUHmEhK7eTuNdfxINakEtv9kWG2L1oaedpEukUoygGmq/SJ:rfehjvHHKTdfxINPEt99G2Bo7EukU16
TLSH
T14C657B03F2D801E8D069D1B8C7568536E9B2BC450B24AAEF0B90B6591F7BFE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PWAHEL~1.EXE

Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE
Size 1.4MB
SHA256 df233ebee614cd9117f7e467f16f4c2225aadbc59213a5695913a4a87f792d6a
MD5 67a7c8fa88aa1c40a5715ad4e0f8c4f0
SHA1 3d61b3c5b653549b835cbb5cae396e0e7b435b4e
SHA512 fbce329738386cc1670b58ea7c58d67cef047977d831af84e50cb811dd6cffdda5552156a0e1756d60fde2c67f3cd672bc4b6e12e2728eec70d4288e49f5efbb
SSDEEP 24576:WZGY26UEU3RyRPW+uSmS86IU8Gc7QGsVa4i6h27d3WlE:1Y2fF8FhmS86IUJWQn+6h27d/
TLSH
T152657C03F29940E8D059D1B8CB56853AEAB27C450B34A6EF0B90B7552F7BEE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
Size 1.4MB
SHA256 cd0adfcf43373e05fcf8836cc998cb17e3aaade9f8b190e28ce4331bd026f23c
MD5 aeb91dca670fae787b272163af7828ca
SHA1 a40927cc53e24d516f86042279684973fc85b77a
SHA512 f7a6aac88fcc029cd551cb4f336fb860d06b4f0094fea7a38a70aa8f25aa1f17300fda60a989ae89e558be15dc4e31dd74365e53ed44d3a3a41126e191297833
SSDEEP 24576:YmjDvw6qZ04SuTjPn68TQuD3g9gZLfChjyosZ9HT1zYeHNrk9NrfZ3:BDvwZ2XuTjPb33g9gZLfCdW9HTlXrk9T
TLSH
T113657B03F29900E9D059D1B8C7568536EAB2BC450B34A6EF0B90B7552E3BFE46B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

00c2126a-d85d-4bb1-a326-b900c3361e40.tmp

Path C:\Users\Admin\AppData\Local\Temp\00c2126a-d85d-4bb1-a326-b900c3361e40.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe

Path C:\Users\Admin\AppData\Local\Temp\3582-490\2026-11-03_763fc149e7b2df6d6ff2b8c60ab2512f_cobalt-strike_elex_icedid_neshta_njrat_ransomhub.exe
Size 3.0MB
SHA256 e4e52e72a5b56558b1cf1e259cbc9def1615f374f9bc51b9d9e99b8589b969bc
MD5 d647273f07713f05886a62c0aa6a43fa
SHA1 0e3711be31f6180e2f0fe7e6da04f9108b50cab7
SHA512 206055f99a51e6c9a14ed5a84eb8dfbb5e4404709f7136adc14dfe9637194a8d551c7252700b983fd06ad61f2cf8c98d76770b6c812db57c3987ed64e3e1b7bf
SSDEEP 49152:RskaOncWMx307IrFUkLAf4aeD3GLlGdiQJEHWwo9+SJhsLcdIH:MOnU7ofeDb17bqH
TLSH
T118E56A13F29A01E8D06ED1798B169222EAB1BC854B35B3DF0B9077151E7AFE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Users\Admin\AppData\Local\Temp\3582-490\identity_helper.exe
Size 1.4MB
SHA256 4cd3e95e38df0cfb094ceedc26a43312d71f71e1361b3f8498f4996fdef2c73a
MD5 e9eff67e5bcb8b27e3109516d470fc56
SHA1 56a3e9b944260a05f25eacf55ac49af1aadf55b3
SHA512 85832d93f4354a63e39428f7cd80413aa5b094fbb933f84a2f5bcbe8e971b6fe9b38aab0013860d4fc061a769e5c29ff7fb4b488446b7a7984afddc8affa624a
SSDEEP 24576:JmjDvw6qZ04SuTjPn68TQuD3g9gZLfChjyosZ9HT1zYeHNrk9NrfZB:KDvwZ2XuTjPb33g9gZLfCdW9HTlXrk9l
TLSH
T126656B03F29900E9D059D1B8C7568536EAB2BC450B34A6EF0B90B6552F3BFE46B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

578c0f6b-def6-4118-be39-e86cb6e55475.tmp

Path C:\Users\Admin\AppData\Local\Temp\578c0f6b-def6-4118-be39-e86cb6e55475.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

59a3f938-148c-40fa-9671-eb0c686e29c9.tmp

Path C:\Users\Admin\AppData\Local\Temp\59a3f938-148c-40fa-9671-eb0c686e29c9.tmp
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1352_2112600719\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1352_297926475\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6H4INYFBW23365OLCNY2.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6H4INYFBW23365OLCNY2.temp
Size 4KB
SHA256 acd54fa9ddfad1b24da22c19460d535389f4b9b1cf9ed3a59ae373c259b370b4
MD5 57f30287f2e41c51e9d4c1c1de890909
SHA1 45c1e48aa97394e703fa963bca511dd2b21ebf65
SHA512 15ddd1ed4f68edac7d9a5f0b24c7d143aace72713e80be0570e271c495c3efbcb09924a0461e3f66b123db2564b6ed4c3bcb01dbab1e42426886fd3326c13774
SSDEEP 48:P1D0dOLYc1Dk4jJ9z537dLXuH2pZ8D0dOLYc1Dk4jJ9z43QgdLXuHd2N:PNRjJ53xuWnoRjJ43QIu+
TLSH
T16D91DD112BE61A66F3F3AE72947277016A37F9894A084A4E508901480C73B14D6AFFE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

078ce355-8f97-42a7-bd46-f91f5c710f39.tmp

Path C:\Windows\SystemTemp\scoped_dir952_168945383\078ce355-8f97-42a7-bd46-f91f5c710f39.tmp
Size 23KB
SHA256 f9b518b7b94176f9b0e1486e91aff2861df21ff92a42b4526362d1cc061c898d
MD5 f7e115b1e2ab54aaefe7925c6593f21c
SHA1 f9dee03410aba471d4620ac69e50e1d856e6e8e0
SHA512 7587044bf4c7a62ffd9f8959f425c9927623afe1f8e39d2fd8eec7f51b25a6d8ba2a0ae34b96c4ce9522261c711075ce2b11e31dbdd0c4de11e8e1f1bb901472
SSDEEP 384:n3m+aQikB+z/xvxjg/qhE5j38NDHFrEyRPkv1fcit02uEZgGC8Ll1IzgCM3i:3x/UxvxjgC+5j3iVB7it02u+g0CM3i
TLSH
T1D7B28D7598A4AD73DDF6DB84775EA787FFF4106380C51DA889E81E0D0A8739D130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3a784e62-3ee7-431c-931a-e1ff8d38fb23.tmp

Path C:\Windows\SystemTemp\scoped_dir952_168945383\3a784e62-3ee7-431c-931a-e1ff8d38fb23.tmp
Size 38KB
SHA256 d2ecb0127b878ef227432ef61f54d53faee8f6ee954d136d9a9b9cdb411320e9
MD5 7055f1153d70a2bd2c6fa66590f8a4a8
SHA1 171d9461b5071a5acbd98f2c522d44d65b63fadb
SHA512 009cb54df011c451bd4a71bf887c4e3c5b433f3d6bde90e82b00c35fb0fe1beec62fec2dc10624be522080fb5c5251af594f613cf49016def85f0a2f5b318cf1
SSDEEP 768:vu/UxvxjgC+5j3vVQ8GieOROjFnUPO4Qp7cPAiSm2eo4w4cciGrTFI2ucAgCCM3u:vjZj3+5j3vGNNjFwQpYoimeoR4ccFF/1
TLSH
T1F203BEB598A8BE73DDF39B817A5DA387EFF011A394C11DA4CAE91E0D464739D030B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Windows\SystemTemp\scoped_dir952_168945383\Crashpad\settings.dat
Size 280B
SHA256 45b1a0ae61831ae49688d13710c72f51a5f2cf0e0d57ff061444a36b1799e744
MD5 6397f8fdd6801be0243efd46ebf38b8b
SHA1 f57b2a08c2c481b2e0c53ad3f5aa879671c5f376
SHA512 77e7328d22cd27ea75c0a51940d12f454b6db314dc46b9e25680a0932e5ce47eb95621bd952de8ce194e19573d45776f960bdebf360c0b5e16943f3ac24961af
TLSH
T189D0803136267DAED53E513505509E500644AB73D2575D5156070C1D4D6014358F1EE8
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Windows\SystemTemp\scoped_dir952_168945383\Crashpad\settings.dat
Size 280B
SHA256 39fe3f9e7cb2f5cda9bb4da514e4a702fc480260920405c77a003a9d96104884
MD5 9a17b4b2506d4443ef29c5526e9b3e19
SHA1 d78adde58d3547dbc4b386691ff8fcf380748d2a
SHA512 e51dbf46b12369ce1e5c3c40968717d53991ece51b1f56b83c8ab9b892690128accccd1b27abe618a52b69eac7909f8cc9bceb5f0ca0aa485a26f126e7320016
TLSH
T1CBD024313D04D503D05054313030744053403434100FFC4C4400541C4DFC04C44D73F0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Windows\SystemTemp\scoped_dir952_168945383\Crashpad\settings.dat
Size 280B
SHA256 05141bc150948d37db528f34a3f8871c2e7c6003ce0a81ec0b185fa2d88f9dd9
MD5 639f16bcea819e264d6b9f43929a5c4f
SHA1 eaaad1bf45d307fe1ab48fa06643807d03841f1f
SHA512 025e8b3298a5b1fd8eecb4144c6b5904ff80e4b6846c8790f4df38fea101d1a9ad78b5ad7f10a6ffaf89802df6b7985f1563f5e7907a95eaa9be960ea7e37df0
TLSH
T187D02B393F14CA02D850143162309E10A3805539204E6404C8016818EEA40844C475F8
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Windows\SystemTemp\scoped_dir952_168945383\Crashpad\settings.dat
Size 280B
SHA256 a9bfa8bfb5d0a88a0ba50f3083f0b2b33e3ea06a7156a8444da0d04681c8b170
MD5 8fcc42dbdcf367f6ec182bc7db1906d2
SHA1 6ee6f4806d932745b0cb65b1531e63d3592fe61a
SHA512 2dd3d797e7b1ab7ff82b6789d73fe95d55cafeb2cef42cb0e0d6bb34fd88dac2795fe3458f2c81e1b0c36cdc95a0ead84fa55bbf646ac8abc207dade5ba9fa1c
TLSH
T138D02B183755BE18CA5F24705200DF405180CF33644A041088031D14AA400820C11DFC
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Windows\SystemTemp\scoped_dir952_168945383\Crashpad\settings.dat
Size 280B
SHA256 c5933e654693e988567b697a806ad60102e7d7e4a6c71e6cd207c813266fa36e
MD5 e9d67752e0136a614ca6c0d22dcf28f8
SHA1 9313d1e91edd82254d3c2696e9e50700f1e21e8c
SHA512 278ecbc5957a89538b4e543f841c64cc90329a5dcf04a955595d264c0ef4db4d35a9dd595680e19c50608884c7584d2a21058a947314eb5bb28b086152534f1d
TLSH
T1C2D022303302BC2EC82B20300802EFA00200EA33A08B8CA002030C2C0E8020228B0AE8
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Windows\SystemTemp\scoped_dir952_168945383\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

3ecff715-35ac-4385-967c-1382f9f5168b.tmp

Path C:\Windows\SystemTemp\scoped_dir952_168945383\Default\3ecff715-35ac-4385-967c-1382f9f5168b.tmp
Size 10KB
SHA256 7602e563c6cfd022f86c4b2c179e0c7ab7bc8613f7cd9581f3752d8af4b9e88a
MD5 fa3410107ecd1981ff6f977a620f5cd3
SHA1 eae39e7008d83e528dc914f34b398a212cd65090
SHA512 bef30779c04af7bf6844fc197ad59ec1718889df3180b3e75f1663758dc1b8446b4a7e018b612256d39c0488e411d3b34fe16f317d80f29d33d8daf0228ae119
SSDEEP 192:sxRgiRYS9/f7sQ9O4s/V4IupY/gb+WNVdloDMIg574J:sxRFX9/f7sQ844VwY/cV3Zc
TLSH
T19422C7166E78A9779CCBE319BB557F53E6F95032A0C10E58ABFC821C04EA6DD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

80a79f4d-5d41-4be3-8332-c6d0e3bd38e1.tmp

Path C:\Windows\SystemTemp\scoped_dir952_168945383\Default\80a79f4d-5d41-4be3-8332-c6d0e3bd38e1.tmp
Size 29KB
SHA256 7e0618edf753c2982fbd37a4fc21dd3f4e2550e7c9872fdd11d9ef9e7b1c882c
MD5 9ae40bf04db3d8f9a9a77004def97769
SHA1 0fea60f08a663b4e4e74852a304282646a2a29b9
SHA512 e9ddb5921d216966d0a93bab492e775bd106ea0982ad37b2d0daf39c83f8c711cc6adfe355a9491023cd6579d80ecf1708dceb9ff4f6589df9ce413fce510180
SSDEEP 768:r1cfgj7pLuLj4MWDc0fAu8F1+UoAYDCx9Tuqh0VfUC9xbog/OVAmds2jjrozi:r1cfgVEj4MWDc0fAuu1jajmdFjQzi
TLSH
T152D2C97B644CCA7F4F804ADDDC19BA9EADA801CB9598C98047FE885C03C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9815ffe8-f5cd-402b-a98c-6435fb6e7b63.tmp

Path C:\Windows\SystemTemp\scoped_dir952_168945383\Default\9815ffe8-f5cd-402b-a98c-6435fb6e7b63.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Code Cache\js\index-dir\temp-index
Size 384B
SHA256 cd2407db24a9741265a25b727358f5d2dd655af187b71c2732022a56fd3ba0a2
MD5 2adc768c66f68721989c164c24e52ad5
SHA1 68dadbdcbccd4b5d488bcabfbe3066ae461128ec
SHA512 28632480346915ce5d86e979fe9cb96b73e22cf4af63f40c49e7cdd9481fb7b090176be775d0f39afda1ca77318828a60c4a0548454106f37d05121ce0e5828a
TLSH
T1E9E0524060CD3C8CCF2200B7082ACCD8267AC6B0919533EBF264AF8B88231FE668104A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 c22dd02b81d5ee90ceefa38273a151553479b99afcba3a56411e012a96742177
MD5 7c18c291d8c55d76b196fa7ec63c4bd2
SHA1 fe90b06aa3909877395bd8d9268ad25cf0fc93f3
SHA512 75ee064d4951612a955676b9143b2ac7bf1c9caec10925295f612e9e6ebc3d7de016f4e45e9fd30e8674b90a0f3296ed221ad8bf9f9831bafae84e4179ce8bb5
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Windows\SystemTemp\scoped_dir952_168945383\Default\DawnGraphiteCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Windows\SystemTemp\scoped_dir952_168945383\Default\DawnGraphiteCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Windows\SystemTemp\scoped_dir952_168945383\Default\DawnGraphiteCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

b7ff618d-2ad9-42b1-84e0-4e3dc6a5125a.tmp

Path C:\Windows\SystemTemp\scoped_dir952_168945383\Default\DualEngine\b7ff618d-2ad9-42b1-84e0-4e3dc6a5125a.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

557bec83-aac0-4b50-85f4-adc7ec76e28d.tmp

Path C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Network\557bec83-aac0-4b50-85f4-adc7ec76e28d.tmp
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Preferences
Size 8KB
SHA256 1795b4c7003b83f75a906066065caccf1978a25c3acd2ef8d5cf7e156bd07720
MD5 6235d95f99d5fee76f1b13086f2f578c
SHA1 1b2d4908c3780d61680cf07f76336c429781aac1
SHA512 f6483896c13aa34f2da0c0f06f68fb1bf04ea051d2639446b09a52573e7d0d6aad759614e969e9ae921a20c0275123e44b430b6f5b277bbc1f91f5a5bbc5f5b9
SSDEEP 192:zRgiRYS9/f7sIWEupY/gb+WNVdeXlcMIg0J:zRFX9/f7sIQY/cV64
TLSH
T17E02A7526E38A93B8CCBE21DBB25BB13D5F95032A1D51E58EAFC961C04E66DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 968ba714643c7dfcdd7d821955e1efbba1fdb71c80b9f66b0464913427379cec
MD5 ec4f7a553a9fc97aaaf234ab2363dc98
SHA1 e89d00271155ec2ed4b0ca8fcff9fa7abb58eb77
SHA512 318858823e2feb37b8abf71647778057a1d3c18605e83dffb0041872bf84cddc72b6bc62e4b50020eeb58a2527be095966a2b9dc446f6b9180ce6341fae38cdf
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 94c93059e4dbf4954dbfc92c5109ee8364c8d09d4c1d4625cb852cafc1a32ebd
MD5 8a5d9aae177bb9b9b0ecd7cfe6881592
SHA1 b092c15b42807d0019a2039e1c36140893f52a4a
SHA512 d24c803aea352f878c72fe9efe45ae7f92a4190a2e7ae85c2bd9c25b8044f1a6cc805a33fc0c6829590e0ed9d59e432d1c3942ed20aaaaf9abd93c62889009e6
TLSH
T106A0021016C84CA6DA01027211820AD037399DB0C507935775D1099AD8A35F45245001
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\temp-index
Size 48B
SHA256 ecd84ee4ea1ef8f7e0d7da241cc93b5760c3fbe6017c96d1ed833dd742ad160c
MD5 d91878330c4054c329a3e1ec3247ce15
SHA1 9837d225e62d891ee3615634171b2b3dcc7970c9
SHA512 c4fb5f7d0caeb6f940c9b6d16c63245c4d90bf2cc5dacb590fd16033d4585b3424e72ba1ea39958c466c11f5324834a0130b8633a4aae807f8d19bbc19eb341c
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

cf67d890-f097-4ecf-b1da-0559588b2c3d.tmp

Path C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\cf67d890-f097-4ecf-b1da-0559588b2c3d.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 fa394bc32f9eb3faec36b59c75903cfd9bff1c140f1fcf266242fd670b4a433f
MD5 cf06d146741aa8c14c2449edb70c3f59
SHA1 3be524ecfb2d01cae36249ab43543341ea4026f0
SHA512 a7103977f961da1010340f97b3a9bb6a887aa3cbc6908d9f1d5fcad6e7d66de4f2511d80baceca78ff879a31f8a484da986323a3e9f9dbf0fc395bf861e237b5
SSDEEP 48:3pI1ZzXLkbXyPIyxkKdBVrkh50YSz55yVjINKg0YghIhKCksDye0zIk2H:lWYK7622juKg03hWKCkq5
TLSH
T15F914510301F4282FB7D789449B98F56154374F9366AA46F3799CC622E6BD102CFF8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Windows\SystemTemp\scoped_dir952_168945383\Default\Sync Data\Logs\sync_diagnostic.log
Size 1KB
SHA256 13e1bcaec67a8df1302dcfda392baa05849b8a9d9cd45a1c96042af31c9d4f96
MD5 3c413d7b11e655ab6f029bc30d2ab020
SHA1 51ad589621105a273e69b08d44cb1e6697d5f75f
SHA512 72abbc613a5ffb518e77d560ad474f8eadf353c88606fffb930d85bfb9fef441504dd837f9af2c55986ba193b0aab3c1e2e6cfe12f1e2980134fd8614afd9d1c
TLSH
T15C219E20711F87C1EB3D35881AF88B161A4370F53916E46E3769CC553926E106CFF4CA
MD5 SHA1 SHA512 TLSH

Submit Download

ab5a34fa-2eab-484c-9313-7b4ddae98058.tmp

Path C:\Windows\SystemTemp\scoped_dir952_168945383\Default\ab5a34fa-2eab-484c-9313-7b4ddae98058.tmp
Size 414B
SHA256 a0716be504014d078873495804c7b6825d0dc06775beb110335dec6fa1247a9e
MD5 3d0f965964f704b42fff5c1fd613a5f7
SHA1 c2d35c0974db8e457e695382daef41b4d5148a07
SHA512 b8eeb7a873e1f492fb335440ea12827187859607bddc1d8d345470b23b1a22cfb0cfb7889641f6e0b07895a72ce92e9472655500929e7175d76c085bf86edb84
TLSH
T108E022AAD861EC2B2AFD1B695650434AEB54134B2A40994F7B3E810C8FF5A3B46C785C
MD5 SHA1 SHA512 TLSH

Submit Download

ea5489e9-1b90-41e5-859e-6c2379dd2e69.tmp

Path C:\Windows\SystemTemp\scoped_dir952_168945383\Default\ea5489e9-1b90-41e5-859e-6c2379dd2e69.tmp
Size 8KB
SHA256 e6a5e18a91aa723cae621d47e74b1510c4931e1d8bbcdd99ff5465a19d0dcb95
MD5 6968e2eca38f3dbdc1b8d318a5476288
SHA1 cb81e9076160fac1703bbe92a56f77d0fd25ca05
SHA512 026748132a50cc7bc83693afaa6256c8934743151f33ce5d3f2e0fa81049ec391c872200b22b5bfc3f80bc44da2c38d296b085a91d92269e57123a8be0f93502
SSDEEP 192:sxRgiRYS9/f7s5WIupY/gb+WNVdeXlcMIg5lJ:sxRFX9/f7s5eY/cV6J
TLSH
T1CF02A7566E38A93B8CCBD20DFB65BB13D6F95032A1D10E58E6FC861C04EA6DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a1bdce22-e3f5-4620-a264-6928996b231b.tmp

Path C:\Windows\SystemTemp\scoped_dir952_168945383\a1bdce22-e3f5-4620-a264-6928996b231b.tmp
Size 19KB
SHA256 68f383e58a5a8f2b505d1fa6aff127216a42db59e2116c819d5f8ee651014597
MD5 2245e6af8f4a210c5fd053c23fdf5a73
SHA1 1e96cfbc75958be8473ea98cd38c9fc550ca59cf
SHA512 1cb9f0869582cc4f201749f8a1c2aa96a84039007746dccbefa6b94d9955c54be9aeeafbfd2895dd38cb3d8c543fd4d8697fa49739c13a45bae2bc5d4d52f698
SSDEEP 384:n3GQkUSvFj38NDHFrEyRPkv1fcitT2uK7vBEBF8Ll1IzHIIlnZgG6CCI:3mFj3iVB7itT2uK75ENLTgXCCI
TLSH
T1A2926BB4A8A4AE778DF68B81F71D3B83BEF09157C4E40A94D9D95E1D01832CE234BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ef2418fa-eb47-4c13-ab72-ea341b10e838.tmp

Path C:\Windows\SystemTemp\scoped_dir952_168945383\ef2418fa-eb47-4c13-ab72-ea341b10e838.tmp
Size 14KB
SHA256 1a633f6402ee3a709e095a7c187d535db469384412779c4dc9e76e48d570699d
MD5 ffcbd5e2beb07152770a55fbe7720d91
SHA1 4a7fafa8a314f1a710f5c4d93a04455cab36b0b3
SHA512 2c3f78d63f566080ad1433b6f30ef65ea1ba9ae4a3794e9ea53e16172c91b090ef09e948f520e9265ff85b6f973d77ebd04a29485d8f8b300f9e2fa4aa0b31d0
SSDEEP 384:n33QkUSvFj38NDHFrEyRPkF1fcida3uMx8Ll1IzVj:3JFj3iVBrida3uM1j
TLSH
T1F352197168A4AD739DF6DB80B64A7B43BFF01227D9D50E88DADD190D058329E234B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

791115af-870a-470b-910a-644d5d4589a6.tmp

Path C:\Windows\SystemTemp\scoped_dir952_168945383\extensions_crx_cache\791115af-870a-470b-910a-644d5d4589a6.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

directx.sys

Path C:\Windows\directx.sys
Size 57B
SHA256 bcafedda46a837ee98f7d8240f4f814dad16982a3db6d38e649fe6b95925e872
MD5 8b6dbdb20a933485f224b31a3a3e42e1
SHA1 dc7def0dd173aea45e38e48bf2aa618d952adf21
SHA512 a0634db794b8398e6b1294864f7ecc4457a733ebe3be8ca44540fd316bbf87d05f514b9aae31efdf390a67140f7bf7dcc9354091d64c389bd25436e82385b028
TLSH
T1DA90020442C7D62949755217056A664DD8A0486C6B4D2B304B128558556180EA5C1251
MD5 SHA1 SHA512 TLSH

Submit Download

svchost.com

Path C:\Windows\svchost.com
Size 40KB
SHA256 e8638156d8ffcd62d1310a66c97859d9d2a3cfa51bb2d68eff1fb3bb5e0b88fa
MD5 bbe7c2a598307f1959111956daa7d18d
SHA1 b5475cb967f67d394929ead4ebb9fc50a7bf9f09
SHA512 24e2481d21c87a464478194213e7692d52631a626f4d7699d4d57f9fad6288353ecec52ac447d5fb6347269c381b35108fb191a7d39cdf1229df51a32ebe455d
SSDEEP 768:eyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJakk0pEDSO:JxqjQ+P04wsmJCHkOz
TLSH
T1BE136C52FAE18871D0301EFCCC1A9258C57A7B303E7A1AF5BAF91D5DEC693D1290C58A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1532-1087-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2036-908-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2036-1164-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2036-1138-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2036-506-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2036-730-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2836-494-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/5116-1080-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/6080-1137-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/6080-603-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/6080-907-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/6080-1163-0x0000000000400000-0x000000000041B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads