Overview

overview

9

Static

static

3

2026-11-10...op.exe

windows10-2004-x64

9

2026-11-10...op.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/11/2026, 08:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-10_49b2002f4f47427ca6e673977d216cff_amadey_elex_glassworm_rhadamanthys_smoke-loader_stop.exe
  • Size 1.7MB
  • Sample261110-j2mt5a1tct
  • SHA256 4cd71884bd6eb81c845dd3c6e730de49ce4b4dff5d607e252acec4ac1e39258f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
bootkitdefense_evasiondiscoverypersistence

Malware Config

Signatures

  • Custom signature
    Detects executables embedding command execution via IExecuteCommand COM object 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks for any installed AV software in registry 1 TTPs 5 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 9 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 64 IoCs
    defense_evasion
  • Drops file in Program Files directory 5 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

    Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 56 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-10_49b2002f4f47427ca6e673977d216cff_amadey_elex_glassworm_rhadamanthys_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-10_49b2002f4f47427ca6e673977d216cff_amadey_elex_glassworm_rhadamanthys_smoke-loader_stop.exe"
    1⤵
    • Loads dropped DLL
    • Checks for any installed AV software in registry
    • Writes to the Master Boot Record (MBR)
    • Drops file in System32 directory
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Program Files directory
    • Direct Volume Access: Opens a physical disk for reading
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5548
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://baoku.360.cn/
      2⤵
      • Drops file in Windows directory
      • Enumerates system info in registry
      • Modifies registry class
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1592
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffed5a4c188,0x7ffed5a4c194,0x7ffed5a4c1a0
        3⤵
          PID:3212
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1656,i,2495058539921451595,10755759027155616137,524288 --field-trial-handle=2516,i,1749272283353314428,10971690837660525865,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:11
          3⤵
          • System Time Discovery
          PID:4300
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2196,i,13145916482205577242,5437976376205202529,524288 --field-trial-handle=2516,i,1749272283353314428,10971690837660525865,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:13
          3⤵
            PID:4468
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,2125103169212194151,2295052649146736766,262144 --field-trial-handle=2516,i,1749272283353314428,10971690837660525865,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:2
            3⤵
              PID:5256
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3736,i,13397456621159657898,5641375503413773301,2097152 --field-trial-handle=2516,i,1749272283353314428,10971690837660525865,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:1
              3⤵
                PID:2840
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3740,i,14911823048428784953,13076828568215986754,2097152 --field-trial-handle=2516,i,1749272283353314428,10971690837660525865,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:1
                3⤵
                  PID:1200
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,11907166948490717809,13468827147130161032,2097152 --field-trial-handle=2516,i,1749272283353314428,10971690837660525865,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:1
                  3⤵
                    PID:5388
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,11792172935569667730,755840278314400943,2097152 --field-trial-handle=2516,i,1749272283353314428,10971690837660525865,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:9
                    3⤵
                      PID:5984
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,16553193502032612915,12335898534424975421,524288 --field-trial-handle=2516,i,1749272283353314428,10971690837660525865,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
                      3⤵
                        PID:3540
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5464,i,15445157109450942427,1473100729643901535,2097152 --field-trial-handle=2516,i,1749272283353314428,10971690837660525865,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:1
                        3⤵
                          PID:1616
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,7115809741119538351,15817220133289559014,524288 --field-trial-handle=2516,i,1749272283353314428,10971690837660525865,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:14
                          3⤵
                            PID:4700
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,12559672763799969011,1061229681216059757,524288 --field-trial-handle=2516,i,1749272283353314428,10971690837660525865,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:14
                            3⤵
                              PID:5960
                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,17758505816589615862,899294886937739008,524288 --field-trial-handle=2516,i,1749272283353314428,10971690837660525865,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:14
                              3⤵
                                PID:5680
                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,17758505816589615862,899294886937739008,524288 --field-trial-handle=2516,i,1749272283353314428,10971690837660525865,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:14
                                3⤵
                                  PID:460
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,1297847184569343610,12865264545282978910,524288 --field-trial-handle=2516,i,1749272283353314428,10971690837660525865,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14
                                  3⤵
                                    PID:2708
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,715663669262438357,17308476130139056188,524288 --field-trial-handle=2516,i,1749272283353314428,10971690837660525865,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:14
                                    3⤵
                                      PID:3636
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,3841256077560905400,10009636915763209426,524288 --field-trial-handle=2516,i,1749272283353314428,10971690837660525865,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:14
                                      3⤵
                                        PID:4124
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,12301564954116281724,17643986669839063264,524288 --field-trial-handle=2516,i,1749272283353314428,10971690837660525865,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:14
                                        3⤵
                                          PID:4648
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,3122558243707616382,14245493612204257264,524288 --field-trial-handle=2516,i,1749272283353314428,10971690837660525865,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:14
                                          3⤵
                                            PID:5748
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,18066709135700743546,12699550949120888772,524288 --field-trial-handle=2516,i,1749272283353314428,10971690837660525865,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:14
                                            3⤵
                                              PID:4884
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,10807486854925606083,10816126098729423966,524288 --field-trial-handle=2516,i,1749272283353314428,10971690837660525865,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:14
                                              3⤵
                                                PID:5116
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2784,i,7904646713152885859,6667268044588180100,524288 --field-trial-handle=2516,i,1749272283353314428,10971690837660525865,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
                                                3⤵
                                                  PID:3496
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6732,i,14913184174664655981,12767057713089921991,524288 --field-trial-handle=2516,i,1749272283353314428,10971690837660525865,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:14
                                                  3⤵
                                                    PID:2324
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6960,i,8863578864715903616,7384527009447939068,524288 --field-trial-handle=2516,i,1749272283353314428,10971690837660525865,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:14
                                                    3⤵
                                                      PID:5524
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3812,i,1069424902489619451,7949618355243223673,524288 --field-trial-handle=2516,i,1749272283353314428,10971690837660525865,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
                                                      3⤵
                                                        PID:5564
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,2129621584296719265,11094877815328225539,524288 --field-trial-handle=2516,i,1749272283353314428,10971690837660525865,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:14
                                                        3⤵
                                                          PID:1684
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3528,i,17702370227015595626,5603708116906893145,262144 --field-trial-handle=2516,i,1749272283353314428,10971690837660525865,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:10
                                                          3⤵
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:5952
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                      1⤵
                                                        PID:4624
                                                      • C:\Windows\system32\svchost.exe
                                                        C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                        1⤵
                                                          PID:4268

                                                        Network

                                                              MITRE ATT&CK Enterprise v16

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads

                                                              0243a1bd-cec7-48d1-9d67-f2f8e8595263.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0243a1bd-cec7-48d1-9d67-f2f8e8595263.tmp
                                                              • Size 33KB
                                                              • SHA256 1364810af5721fd4f6181653d0929c4e57abab483c5fd80b6efda0154b9766ca
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              4947789f-394a-4720-9462-46c067ee1b5a.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4947789f-394a-4720-9462-46c067ee1b5a.tmp
                                                              • Size 37KB
                                                              • SHA256 8f7a6b57a0444849e7fb55fa173c2d0e71a49bb27a3eee02e8fdfab939a96725
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              50cfff1f-b61b-47eb-95c8-c15c8368a5e7.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\50cfff1f-b61b-47eb-95c8-c15c8368a5e7.tmp
                                                              • Size 41KB
                                                              • SHA256 b6e9e02318f08d140de185a63cb3f9d18d04badab8dfc0bb760579bf602ac5dd
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              8f6e87c4-0e62-41c7-b11c-b48a85586ce2.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8f6e87c4-0e62-41c7-b11c-b48a85586ce2.tmp
                                                              • Size 38KB
                                                              • SHA256 aa292124c5217f011d75eb3316f1bd6c3bec618402a4f5ce564c4bace1dfc25b
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              manifest.json
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
                                                              • Size 135B
                                                              • SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              settings.dat
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                              • Size 280B
                                                              • SHA256 a0b193400a27c0cdf94ac11f5fb5b0747828b5b461169cefeffb96191b9e4834
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              settings.dat
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                              • Size 280B
                                                              • SHA256 932f01682de6215b2c3b5faeb96a07b886e28db2ff6f8242a36da556c4292464
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              111c96c3-25a2-4352-9791-0538307a0569.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\111c96c3-25a2-4352-9791-0538307a0569.tmp
                                                              • Size 12KB
                                                              • SHA256 34d2735748b380d5cc52b02b527e683a24f9d12e65d1f44788cfc7591e81d4ab
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              490ce8e8-28f0-4495-8b13-8923800e3245.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\490ce8e8-28f0-4495-8b13-8923800e3245.tmp
                                                              • Size 12KB
                                                              • SHA256 92f690166beca3466a782d457e73a7d31afee5dd29fda7a175f4c585075b52db
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              6eb22d96-b90e-4d36-aef8-fe95cd1d81c1.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6eb22d96-b90e-4d36-aef8-fe95cd1d81c1.tmp
                                                              • Size 70KB
                                                              • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              8080d06e-2d85-425e-9902-dfe85ac77c28.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8080d06e-2d85-425e-9902-dfe85ac77c28.tmp
                                                              • Size 12KB
                                                              • SHA256 fbf8843010b6feb8f76f48fa77b7ae07b313bdb993a171099813e4efa5439498
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              LOG.old
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                              • Size 334B
                                                              • SHA256 3b7338dd1dde67ca740d3bfc943d87316bb99380a65debf4db506bce76dbcb28
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              temp-index
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                              • Size 2KB
                                                              • SHA256 cd7955d7a738e7a1b841130d68e677930a8d2b701b76bc4b6c7a8cae2edb64fa
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              the-real-index
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                              • Size 2KB
                                                              • SHA256 17c55bd39b4da18386546422d65bd48eac66e6d1bf395763473f08d8bcd342d6
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              e4cf30c1-f05e-4ada-9e5d-ad0691460cd9.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\e4cf30c1-f05e-4ada-9e5d-ad0691460cd9.tmp
                                                              • Size 2B
                                                              • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              dasherSettingSchema.json
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
                                                              • Size 854B
                                                              • SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              0ebca378-1db8-44bc-88a7-76afc6c7be8d.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0ebca378-1db8-44bc-88a7-76afc6c7be8d.tmp
                                                              • Size 2B
                                                              • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              197950c1-474d-464a-aa0f-25de730fb749.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\197950c1-474d-464a-aa0f-25de730fb749.tmp
                                                              • Size 4KB
                                                              • SHA256 2e67cf2516c9689d6a2685fe8cbb6481e000fc89438cf251e310a41b6e14ca8d
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              e93b77d3-c814-4d6d-b609-63832ec5b3c0.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e93b77d3-c814-4d6d-b609-63832ec5b3c0.tmp
                                                              • Size 40B
                                                              • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              Secure Preferences
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                              • Size 29KB
                                                              • SHA256 2632302fcba8ec1d222a92345b2d5ab5b75cdabe8a5c8cce801da3b8b9606bd0
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              385e9ad7-97ab-4ebb-98a4-76d3414a3998.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\385e9ad7-97ab-4ebb-98a4-76d3414a3998.tmp
                                                              • Size 22KB
                                                              • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              manifest.json
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\OriginTrials\0.0.1.7\manifest.json
                                                              • Size 43B
                                                              • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              manifest.json
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\manifest.json
                                                              • Size 160B
                                                              • SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              bf6a9c00-27f6-4565-b335-ab886debfa5b.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bf6a9c00-27f6-4565-b335-ab886debfa5b.tmp
                                                              • Size 33KB
                                                              • SHA256 32744c0312109eebf5581c89405ca1ad88eb3342a790bc3f934b0cc1ef84940d
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              375973e8-2c40-4f1d-862c-1b78b40aafdd.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\375973e8-2c40-4f1d-862c-1b78b40aafdd.tmp
                                                              • Size 132B
                                                              • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              5382da16-0813-408b-8d90-6a12630c0de3.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\5382da16-0813-408b-8d90-6a12630c0de3.tmp
                                                              • Size 372B
                                                              • SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              b4a754d7-e16b-42dc-985a-962c52d49b64.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\b4a754d7-e16b-42dc-985a-962c52d49b64.tmp
                                                              • Size 252B
                                                              • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              e31dc711-e388-4492-a978-2908a2ef4613.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e31dc711-e388-4492-a978-2908a2ef4613.tmp
                                                              • Size 32KB
                                                              • SHA256 eb94c0c6bc3681a62ecddbc5c15a74621b44a41def78ac3a14c417289fc48015
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
                                                              • Size 158KB
                                                              • SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              99bbe5b3-6c51-4822-b373-82990a9e7f45.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\99bbe5b3-6c51-4822-b373-82990a9e7f45.tmp
                                                              • Size 13B
                                                              • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              metadata.json
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                              • Size 132B
                                                              • SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              360ini.cab
                                                              • Path C:\Users\Admin\AppData\Local\Temp\360ini.cab
                                                              • Size 2.2MB
                                                              • SHA256 7f8252aa2b600332c09e9583b785a569439c4d451ff6e13047c1ac02e9f3dd12
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              9efe08ab-13ab-46d9-80e6-73b3ff24020f.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Temp\9efe08ab-13ab-46d9-80e6-73b3ff24020f.tmp
                                                              • Size 1B
                                                              • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              360ini.dll
                                                              • Path C:\Users\Admin\AppData\Local\Temp\pLkPgEhHzRsJrEdW\360ini.dll
                                                              • Size 4.3MB
                                                              • SHA256 37fb9cfe3f0efdb59fd9ed4885cecbae676faad9d479491b9de8da8b7293e0bd
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              873c27ef-9822-4143-8134-55f1220225ca.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1592_2002225625\873c27ef-9822-4143-8134-55f1220225ca.tmp
                                                              • Size 10KB
                                                              • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              content.js
                                                              • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1592_2002225625\CRX_INSTALL\content.js
                                                              • Size 9KB
                                                              • SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              messages.json
                                                              • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1592_636566434\CRX_INSTALL\_locales\en_CA\messages.json
                                                              • Size 711B
                                                              • SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              nav_config.json
                                                              • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1592_397610733\nav_config.json
                                                              • Size 2KB
                                                              • SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              protocols.json
                                                              • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1592_40491067\protocols.json
                                                              • Size 3KB
                                                              • SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              memory/5548-1-0x00000000034B0000-0x0000000003535000-memory.dmp
                                                              Download

                                                              memory/5548-6-0x00000000034B0000-0x0000000003535000-memory.dmp
                                                              Download

                                                              memory/5548-7-0x00000000034B0000-0x0000000003535000-memory.dmp
                                                              Download

                                                              memory/5548-13-0x0000000004090000-0x0000000004091000-memory.dmp
                                                              Download

                                                              memory/5548-0-0x00000000033B0000-0x00000000034AD000-memory.dmp
                                                              Download