fd91cd8dcd173e1b39d3a257caa5114929b0355af7ea9d78eeef1f1cac26f25e

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 03:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
Size 5.8MB
Sample260703-dkpphaax4z
SHA256 fd91cd8dcd173e1b39d3a257caa5114929b0355af7ea9d78eeef1f1cac26f25e
MD5 57691625bcea2f115c3e9a91c38003a7
SHA1 42612ecce9248a5c225d9b7504b5fc91b93adda3
SHA512 5d931fdd06fca28a038cc6f71590c712bf9ff6db24f6ee9f14481dea99df0d2428a9f03b9cf3dec211399cb2d8f9365031792af4c6e199c07b868a89794f6c01
SSDEEP 98304:k8Iio791z9hXms6P4e8l18frP3wbzWFimaI7dlo6i8:7o7vz9hWVgbzWFimaI7dlhj
TLSH
T1ED569D52BF8C817AC95A11310B2DAF2A442ABD64773465D3B2743E7EDC723C16C3A61B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery persistence phishing spyware stealer trojan

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe /onboot"	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2876_52195254\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2876_52195254\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2876_322582801\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2876_322582801\nav_config.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2876_1374961773\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6636	4068	WerFault.exe	87

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1788	msedge.exe

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 22 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe"	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\Low Rights	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3"	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe"	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243"	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3"	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3"	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm"	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe"	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134275214908516626"	msedge.exe

Modifies registry class 18 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan"	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1"	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Therad = "1"	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe"	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Model = "183"	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2639994890-966400312-4246138405-1000\{D7624268-8DE3-4AB2-8C85-EE8F96834144}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter"	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User"	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
7120	msedge.exe
7120	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	4068	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
Token: SeDebugPrivilege	3536	firefox.exe
Token: SeDebugPrivilege	3536	firefox.exe
Token: SeDebugPrivilege	3536	firefox.exe
Token: SeDebugPrivilege	3536	firefox.exe
Token: SeDebugPrivilege	3536	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
3536	firefox.exe
3536	firefox.exe
3536	firefox.exe
3536	firefox.exe
3536	firefox.exe
3536	firefox.exe
4068	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
2876	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4068	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
4068	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
4068	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
4068	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
3536	firefox.exe
4068	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
4068	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
4068	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
4068	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
4068	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 5436	4068	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe	88
PID 4068 wrote to memory of 1580	4068	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe	89
PID 1580 wrote to memory of 3536	1580	firefox.exe	90
PID 1580 wrote to memory of 3536	1580	firefox.exe	90
PID 3536 wrote to memory of 5076	3536	firefox.exe	91
PID 3536 wrote to memory of 5076	3536	firefox.exe	91
PID 3536 wrote to memory of 5076	3536	firefox.exe	91
PID 3536 wrote to memory of 4944	3536	firefox.exe	92
PID 3536 wrote to memory of 4944	3536	firefox.exe	92
PID 3536 wrote to memory of 4944	3536	firefox.exe	92
PID 3536 wrote to memory of 4944	3536	firefox.exe	92
PID 3536 wrote to memory of 1568	3536	firefox.exe	93
PID 3536 wrote to memory of 1568	3536	firefox.exe	93
PID 3536 wrote to memory of 1568	3536	firefox.exe	93
PID 3536 wrote to memory of 1568	3536	firefox.exe	93
PID 3536 wrote to memory of 1152	3536	firefox.exe	94
PID 3536 wrote to memory of 1152	3536	firefox.exe	94
PID 3536 wrote to memory of 1152	3536	firefox.exe	94
PID 3536 wrote to memory of 2648	3536	firefox.exe	95
PID 3536 wrote to memory of 2648	3536	firefox.exe	95
PID 3536 wrote to memory of 2648	3536	firefox.exe	95
PID 3536 wrote to memory of 2648	3536	firefox.exe	95
PID 3536 wrote to memory of 2572	3536	firefox.exe	96
PID 3536 wrote to memory of 2572	3536	firefox.exe	96
PID 3536 wrote to memory of 2572	3536	firefox.exe	96
PID 3536 wrote to memory of 2572	3536	firefox.exe	96
PID 3536 wrote to memory of 4508	3536	firefox.exe	97
PID 3536 wrote to memory of 4508	3536	firefox.exe	97
PID 3536 wrote to memory of 4508	3536	firefox.exe	97
PID 3536 wrote to memory of 4508	3536	firefox.exe	97
PID 3536 wrote to memory of 5068	3536	firefox.exe	98
PID 3536 wrote to memory of 5068	3536	firefox.exe	98
PID 3536 wrote to memory of 5068	3536	firefox.exe	98
PID 3536 wrote to memory of 5068	3536	firefox.exe	98
PID 3536 wrote to memory of 5940	3536	firefox.exe	99
PID 3536 wrote to memory of 5940	3536	firefox.exe	99
PID 3536 wrote to memory of 5940	3536	firefox.exe	99
PID 3536 wrote to memory of 5940	3536	firefox.exe	99
PID 3536 wrote to memory of 1224	3536	firefox.exe	100
PID 3536 wrote to memory of 1224	3536	firefox.exe	100
PID 3536 wrote to memory of 1224	3536	firefox.exe	100
PID 3536 wrote to memory of 1224	3536	firefox.exe	100
PID 4068 wrote to memory of 1436	4068	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe	102
PID 4068 wrote to memory of 3276	4068	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe	103
PID 4068 wrote to memory of 5012	4068	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe	104
PID 4068 wrote to memory of 1760	4068	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe	105
PID 4068 wrote to memory of 2876	4068	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe	106
PID 4068 wrote to memory of 2900	4068	2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe	107
PID 2876 wrote to memory of 3168	2876	msedge.exe	108
PID 2876 wrote to memory of 1788	2876	msedge.exe	109
PID 2876 wrote to memory of 3732	2876	msedge.exe	110
PID 2876 wrote to memory of 3732	2876	msedge.exe	110
PID 2876 wrote to memory of 3732	2876	msedge.exe	110
PID 2876 wrote to memory of 5604	2876	msedge.exe	111
PID 2876 wrote to memory of 5604	2876	msedge.exe	111
PID 2876 wrote to memory of 1904	2876	msedge.exe	113
PID 2876 wrote to memory of 1904	2876	msedge.exe	113
PID 2876 wrote to memory of 1904	2876	msedge.exe	113
PID 2876 wrote to memory of 2096	2876	msedge.exe	114
PID 2876 wrote to memory of 2096	2876	msedge.exe	114
PID 2876 wrote to memory of 2096	2876	msedge.exe	114
PID 2876 wrote to memory of 4632	2876	msedge.exe	115
PID 2876 wrote to memory of 5096	2876	msedge.exe	116
PID 2876 wrote to memory of 4632	2876	msedge.exe	115

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-03_57691625bcea2f115c3e9a91c38003a7_darkgate_elex_glassworm_remcos_stop.exe"
1⤵
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Windows\system32\regsvr32.exe
  C:\Windows\Sysnative\regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  PID:5436
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
    3⤵
    - Drops desktop.ini file(s)
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3536
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1948 -prefsLen 27097 -prefMapHandle 1952 -prefMapSize 270279 -ipcHandle 2036 -initialChannelId {d48cebbd-f7d1-4a6e-a073-ed5f1b2b5d4b} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:5076
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27133 -prefMapHandle 2436 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {8009e89e-6486-4208-9fd0-59a456cc193b} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:4944
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3936 -prefsLen 25164 -prefMapHandle 3940 -prefMapSize 270279 -jsInitHandle 3944 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3952 -initialChannelId {bb5221ca-bfb5-480c-a498-760d955dbeb7} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:1568
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4092 -prefsLen 27274 -prefMapHandle 3900 -prefMapSize 270279 -ipcHandle 4164 -initialChannelId {9ace36da-72f7-4d3c-a86b-ae3de07e7105} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:1152
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2880 -prefsLen 34773 -prefMapHandle 3384 -prefMapSize 270279 -jsInitHandle 3128 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3132 -initialChannelId {ecccade5-c52e-4963-92f8-dd61d4680eba} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:2648
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2904 -prefsLen 35010 -prefMapHandle 3020 -prefMapSize 270279 -ipcHandle 1628 -initialChannelId {ef988721-763c-4d12-94f3-578190aaa2f2} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:2572
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5388 -prefsLen 35062 -prefMapHandle 5392 -prefMapSize 270279 -jsInitHandle 5452 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5460 -initialChannelId {87f738b4-48ac-4969-9126-3a4584be8351} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:4508
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5688 -prefsLen 32952 -prefMapHandle 5696 -prefMapSize 270279 -jsInitHandle 5684 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5448 -initialChannelId {23e49eb7-2712-49c1-aa9d-3ab8f0dd6ea1} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:5068
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5656 -prefsLen 32952 -prefMapHandle 5664 -prefMapSize 270279 -jsInitHandle 5668 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3256 -initialChannelId {911a0218-70e5-4adb-8117-be492b958531} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:5940
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6020 -prefsLen 32952 -prefMapHandle 6024 -prefMapSize 270279 -jsInitHandle 6028 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6036 -initialChannelId {2482c477-17a9-4a00-af44-3ec70b5619e1} -parentPid 3536 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3536" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
      4⤵
      Checks processor information in registry
      PID:1224
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1436
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3276
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5012
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" http://www.internetdownloadmanager.com/download2.html
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7fff4e68c188,0x7fff4e68c194,0x7fff4e68c1a0
    3⤵
    PID:3168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2160,i,2423242339850423802,11256203788907763183,524288 --field-trial-handle=2936,i,14006464357243696680,7474898502545306055,262144 --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1980,i,2840376288033809090,2688639754411143102,262144 --field-trial-handle=2936,i,14006464357243696680,7474898502545306055,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:2
    3⤵
    PID:3732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2532,i,12147233508980917354,17477981646573087239,524288 --field-trial-handle=2936,i,14006464357243696680,7474898502545306055,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:13
    3⤵
    PID:5604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,4099974409584020606,14232400517579155414,2097152 --field-trial-handle=2936,i,14006464357243696680,7474898502545306055,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:1
    3⤵
    PID:1904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,9783628721286470588,5672610638684795667,2097152 --field-trial-handle=2936,i,14006464357243696680,7474898502545306055,262144 --variations-seed-version --mojo-platform-channel-handle=3876 /prefetch:1
    3⤵
    PID:2096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,6622011693921740923,13936821717847076735,2097152 --field-trial-handle=2936,i,14006464357243696680,7474898502545306055,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:1
    3⤵
    PID:4632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4428,i,14867917928473304248,11675656845039310154,2097152 --field-trial-handle=2936,i,14006464357243696680,7474898502545306055,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:1
    3⤵
    PID:5096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,1572503394913208955,9250570717549427726,2097152 --field-trial-handle=2936,i,14006464357243696680,7474898502545306055,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:9
    3⤵
    PID:5588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,10696395881601561653,10077976859472590876,524288 --field-trial-handle=2936,i,14006464357243696680,7474898502545306055,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
    3⤵
    PID:6008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5520,i,12621921713665530486,5129582079825841983,2097152 --field-trial-handle=2936,i,14006464357243696680,7474898502545306055,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:1
    3⤵
    PID:1216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4076,i,6575563380376051747,13999295097027324242,524288 --field-trial-handle=2936,i,14006464357243696680,7474898502545306055,262144 --variations-seed-version --mojo-platform-channel-handle=4012 /prefetch:14
    3⤵
    PID:5508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4072,i,871622152993799761,14237092883864129604,524288 --field-trial-handle=2936,i,14006464357243696680,7474898502545306055,262144 --variations-seed-version --mojo-platform-channel-handle=4052 /prefetch:14
    3⤵
    PID:4188
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,13573711438775608558,7527571895182739645,524288 --field-trial-handle=2936,i,14006464357243696680,7474898502545306055,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
    3⤵
    PID:4248
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,13573711438775608558,7527571895182739645,524288 --field-trial-handle=2936,i,14006464357243696680,7474898502545306055,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
    3⤵
    PID:3332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6520,i,3376585077066290402,18067935241022097917,524288 --field-trial-handle=2936,i,14006464357243696680,7474898502545306055,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
    3⤵
    PID:5404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6788,i,10444442313911231433,11094889119734384424,524288 --field-trial-handle=2936,i,14006464357243696680,7474898502545306055,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:14
    3⤵
    PID:2092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6788,i,7511004785678266235,5200847315072318135,524288 --field-trial-handle=2936,i,14006464357243696680,7474898502545306055,262144 --variations-seed-version --mojo-platform-channel-handle=1276 /prefetch:14
    3⤵
    PID:1512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6944,i,1986718587236687686,17719618789638856368,524288 --field-trial-handle=2936,i,14006464357243696680,7474898502545306055,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:14
    3⤵
    PID:2092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3576,i,9466272838095250056,6255151572295119826,524288 --field-trial-handle=2936,i,14006464357243696680,7474898502545306055,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:14
    3⤵
    PID:7152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,5493515333816909962,4465228453269218655,524288 --field-trial-handle=2936,i,14006464357243696680,7474898502545306055,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:14
    3⤵
    PID:6924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4028,i,10878165151824270853,352798771357199674,524288 --field-trial-handle=2936,i,14006464357243696680,7474898502545306055,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:14
    3⤵
    PID:6656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6976,i,14162732120641837264,6953982692124579804,524288 --field-trial-handle=2936,i,14006464357243696680,7474898502545306055,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:14
    3⤵
    PID:6768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,15271205489359909314,6805558980563687395,524288 --field-trial-handle=2936,i,14006464357243696680,7474898502545306055,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:14
    3⤵
    PID:6648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6300,i,1792385541880487062,15830004024938730891,262144 --field-trial-handle=2936,i,14006464357243696680,7474898502545306055,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:7120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.internetdownloadmanager.com/welcome.html?v=643b02
  2⤵
  PID:2900
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 1960
  2⤵
  - Program crash
  PID:6636

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4068 -ip 4068
1⤵
PID:6604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e1a5fea1006889b9c3bcf0a470a6a4256d5300a4b7036038ddce5fd042c424c
MD5 e9af81b8f1175d007e2c699939cb3df6
SHA1 696178bffe86e4e363a26747d6a5cb80e28621ce
SHA512 38174d529846c50b0af9a056e65ca491645c3cbf1fb867ef22a3b7c7ee4287ba29c3a28d736bc2e9c562faa24bb671db3b9cc40507a467140e47eaa4aeae6d51
TLSH
T145D0C0343E38F408C540207AE4514310E3138131302B8242B010F03DEC581810BDE0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 674d24008448b140a9b320032b4ed333cf5a592b073bf375c453c816d33c703b
MD5 b989ec4e221bd567659492bc1ad7ab3b
SHA1 372670805b3060960e77e6ba32a3b9edd0241cf0
SHA512 f6934e6a831bcac97110107a79389dae0e669b743e0d62e5b411c19471bf237f4d61c7cee27d9fcacbd7045cbe27e78b4e6c38f6e76ca789a7760295558b0bb3
TLSH
T1CBD0C0383E28F508C5402076E4504310E3238131742B8242B010F02DEC581810BDF0DF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3d86dce0ea707c2457c53424346b8ef6595c70e3c9867a0fbc6f6f9dfeb6ffaa
MD5 2b463fa9ae067c12d8add6a7494dc1fb
SHA1 ba8de2cce2cb40e6125daa415b3cb508b59afc19
SHA512 64b7d717fd53e9e94c982aab54237be0cdfa1db825e29ca7be8dc95a9b10c78ee5bbeab91db391d437455492d3fab4d1c9ac5a33cc4b4ee31873e78bcffc9d35
TLSH
T137510F5546251972C725C5BDC3E111D473F0E9BF42876E493CD4A97D995AF08F372070
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 793d351c392b4dae1f3b7ae43938a7c8444685f4c88673e913f71902cfeca08a
MD5 112e2a04ec3b0074e6265754691646d2
SHA1 4930b7afc7ec7fd6d366f609f9bc73f71c1eeabd
SHA512 04ce5f9fcbbeb7fe2f0fe039d56fbb20808b1a267f0f964842bb3cc7a145b29bed242d24471b485ddcc56afa61d5c7706dfa78eb00008792fbe46f616ab9caf4
TLSH
T1A051C0F783E5852EC90185F0BA186E2FCE2D0515836C3D9A89E4AF1BA3E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

c9272583-da2f-42ca-84e1-cbffb91da7f9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c9272583-da2f-42ca-84e1-cbffb91da7f9.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 0131ee4f2c8b1cad6c32394e4a56201fa9b4d466172b065984d61fb5688ec5e7
MD5 ed47f85e9bc6821d5b176173c7a6c7a3
SHA1 bd52fbbd90d0fc0e70a022256a48ae2e0afbdf6d
SHA512 2e2615867812b7864efa2a6bfc3a3eccb56a0de86331cf0a9ff40a604573b6b82013cb5f56b47a78a86f409ecfc9c01539e87302196f25d9065c1f2244fdef11
SSDEEP 192:sxRfRkyM/jK1Ml8wcH/f4e/sbt9jZu7rM0zoA8ppj/g6+WNYZefY+4uFHGdIgDuJ:sxRfOCH/f4e/sbfNorc9/51ffFEW
TLSH
T11A62DA16A634593B8CDBD20DFA55BF53D6F91573A2901E44AAFCCA0C01EB6DD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 71c1095580297cfe07a47e2ae99a84389841a886352b2212288bf1e0d4b269ae
MD5 55bd260a67ca52ba5cbe437f87f9f351
SHA1 24569ae546060ae3e82dd22cfd3763fbe955a2c9
SHA512 a6e56820d4399a06ae22febeade1bba430a11436c1db0e279efb8beb5898907559d5d860da42ca7b048fe8dbef41a11348ec558903fb30ef1d91fc00f018b3da
SSDEEP 192:sxRkRkyM/jK1Ml8wcH/f4e/sXt9jZu7rM0zoA8ppj/g6+WNYZefY+4uFHGdIgtJ:sxRkOCH/f4e/sXfNorc9/51ffFE3
TLSH
T17D62DB16A634593B8CCBD209FA557F53D6F51573E2901E44AAFCCA0C01EB6DD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 9ab86aa5889589406fb4032ab68d2bd95fa9470f5f0156df30728bfd8b9dac8a
MD5 ca8f13085835eaf19296fdbeb0276f22
SHA1 f0f7395fd9ee6ccd8affeaf436f840c4d5946ceb
SHA512 51cd0b5c83a061039824c073c7e56c48eecf8e4359a04d745b8a3fbc5486d294deebcacd502fa6ba9c6620de19ca239cfb7eaa4164aa7bbebecbb778054097f3
SSDEEP 768:7dUhBR7pLuL7tgWgEyf3w8F1+UoAYDCx9Tuqh0VfUC9xbog/OVxLGe0GoroddsJ:7dUhBHE7tgWgEyf3wu1jaGLGRGTd2J
TLSH
T19BE2EB3B680CCB7F4F4049DCE829BD9AADA801CF9698CD5447FA841C03C6AEF551A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7262caeb0faba5bad87444baf06e2b0d9f6e126e889e7c6f10b7f14dcdb00d18
MD5 523ff617faad4bef2af0d3ca3908fdb0
SHA1 e9994f2a9eb7721e0b09a532f4fc87dd4f38d0ee
SHA512 494b7333860f74b45ea8fe16d9802f88325f05936590eaa2800877246f5033d23613538b7a0925745e32c5e77199cda558eacccb1953a59c72bb770fc3661cde
SSDEEP 96:KwVuKOYSeleKWwiKvWK8c8qWEhZg6qK4fgAqcqCpYaDHCHuC0UECWMZxgyCKJ:MB1VKvWK8c8VEhq6SfgAxqCpYaDHCHue
TLSH
T16EA16204367E1780387E641E86B9952B4283706230DAA93F77B851D26F27E065EFDECD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59f468.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59f468.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 ce892991e4bba696c72e688c1201a25e499252dc259370ecfb42f41fec22c6f4
MD5 0b97d16982c97edd1a1626d5ebdd4a1c
SHA1 befcf940e1ab19f5a38dabecde8cc2059ff77291
SHA512 70e7d20b079989238ab61f4356786b509af7a8232e83370e1c4f9f47acaa2a44add0f4d53cc647509e0bc0c137e30fe9f1f4215ce25f3674747c6579f59ceb9c
SSDEEP 768:5F1j+9Q3vwgv09rc/PMcvnWgWWR+2SrXH78tRMGb9MO:I9Q3t0GJPWg1bSroLb+O
TLSH
T1D91327F198D38A72D8AE8783A33D6E46AEBCC193B5885984F7C44D0CCD875BFC606815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6071d22eca73e400960946ac2b9430207297a85f78784a43124a58df34678ac0
MD5 cad2e6f12a9aac5e08638944a9de6f87
SHA1 7188fa1790079bf4f8d9e8eb585f93336e949d26
SHA512 73b619856180066aaa210c536cd7c0f29f21a8a7e09fc839fea867b6a1dfed162a57b98c96da02b962fa81c556fa9278d8e4c4d3fe5500aa66abf493722f59df
SSDEEP 768:Orv+4UNbdp3zm5IMcvnWgWWR+2SrXH78tRky+8rr6F:Obsb/3ZJPWg1bSrozDr6
TLSH
T17703BE32A8688973DCF2D685B20A72537FF44193D6C91B88C4D91B4E429F9DE270BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 102d684b475617049edc6f9fc4bbc739c95d3a5eb0b41c263298fa3b51e1a3c8
MD5 fc02a5a1e7994fe0711ab254a0703021
SHA1 a302d54b8dc0e43b1a0448f78528030b63d3f198
SHA512 81d38dc42815c26df64902e9d390a36f117c944bf3891d30db077880ae9955e341a89e468f51ccfa2675a0acf990513c8d22cc06c5bc84fa729911d770e9a085
SSDEEP 768:vj+9b3Y0Ir+5zXMcvnWgWWR+2SrXH78tRMGb9MO:C9b3Y0PJPWg1bSroLb+O
TLSH
T18EF2BF31A8618E738CE2D695B2077793BEF011E7C5C95F48C4D99F0E069B99D1B07C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 0f238b6a22c0259d26ab9850aaf7b6b0fc25dfdcc8c95442e23a1714e9f50253
MD5 ce0136c63de7d5abc4f6692dbca138b9
SHA1 f98ca9dd32f8831a6ee7f3ab067310b40201ce79
SHA512 35088d9480b4ccb405d56308dd46459a0da233b6c98a1ebfa9b5d2abb88702681def527309679f46330482e72e735ed6b3ebd5a5c240c85ba4a7821d9b16f567
SSDEEP 768:0rv+4UNbdp3b05S5zPMcvnWgWWR+2SrXH78tRMG+8rr6G:0bsb/3b0wJPWg1bSroLDr9
TLSH
T16603BE31A8688D739CF2D684B20AB283BFF41093D9C95F88C4D55B4D425B9DE2B0BD67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 921eee3a1653afa541d0caaefe88f81ab283e5c507cca2a32ba3131692527ca5
MD5 1ec1637e997c6ee63bdd158820b2a04b
SHA1 b86132f92e2943acf5cdf81622537d601fcd4646
SHA512 1d647009d5b3617de2a87f1b1b9c0047947ba5126a3e9679eefc84ff35fe8e9923c3c5e2459179a80275862bef52e963fa59ee551233eab22b654f0db4fdd8bf
SSDEEP 768:jj+9b3f0Ir+5zXMcvnWgWWR+2SrXH78tRMGb9MO:m9b3f0PJPWg1bSroLb+O
TLSH
T1B3F2BF31A8618E738CE2D695B2067793BEF011E7C5CD5F48C4D99F0E069BA9D1B07C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

4e31299e-5f4d-4170-9d93-bc4c12146cc2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4e31299e-5f4d-4170-9d93-bc4c12146cc2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

9512A4488B00CC053350DAC32D417B4A35C11513

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\81dulmej.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
Size 13KB
SHA256 2957c2f7a7dc2a0be943beea1f36ac334cc3216ad2dcfd7a795db11656481226
MD5 1d44336919ffc75b9d15e62ae4815fc8
SHA1 d6e12295e8c5a6a485e28ea5b9b915b6b55ae4f2
SHA512 237013bd2aa0d71e23e57f05f13f761b7cb959774dcceef9ec374d5fecd947674977336a3e2d80ff6ff3bf78b8ae98b5c3a37adc3ef65ec76123ff147eaf2b03
SSDEEP 384:H9XghOiO024YVo6J+Sl1xDnZBPsac4j0lpDII+ZrI:dX+ZYVo0+Sl7zZlsac4ID8LG
TLSH
T15F528D7E9F0138AA1E63D191D9BD9254CD04EABBDEE3C09616143C14CA84BB8F4F64CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\81dulmej.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 b76983a104b288fae0a4d22ac5d1bf2cc9968884faacc975f4e52226037ecd9a
MD5 7ae46683a66dc4205c3a4d9dced63f94
SHA1 1de6cf2e4d1c303f842307d51af7a7be131bc0cd
SHA512 ea357a09cc80de74e5b39180e72c112ea59650dcbf0a0fcc7979f94dd334e9cc8e681e2573634c35216ab99b3c19f5ecd64ca3f9c47673a1c0346e6443bdb435
SSDEEP 3072:j3lcVv9wm6uItcP40vm/LUJjD61U6nZTeorqiD1:pcbwmjI6P40vm/LUtDgnZt/J
TLSH
T177B39EB6DBA3CD7D65FFD42DA6C2C43EFD162400B3A72009C923675062C7BB86679648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0635c1d5-da20-4216-ad64-00abb1e874d9.zip

Path C:\Users\Admin\AppData\Local\Temp\0635c1d5-da20-4216-ad64-00abb1e874d9.zip
Size 3.7MB
SHA256 d594c4c1e82d2293c2996e1a0d9f687db132fc85335d037bf53ae54d0d2bf4e5
MD5 85be32534f6db5e64f5fe96dd890234e
SHA1 43b8d5861b73ce5184717c7e31e93d5b10b3adeb
SHA512 1945d9efdc163ad64cbe3001456324768022556704ff3d8a99a1bb42f1a820c76a3daf1e3707a1ca7b59af452fbf5b7b084086b206c57a2fa930078f468b0ce5
SSDEEP 49152:MtrhrApFrJipqGsR2ubf9PvX1ccJkYhcqIqKDWl2YGAqS42PH1Uqcxhcq2MzcwMD:MtruGLUNX17ZgDWl9GA9Pl6Tzcw1s
TLSH
T1B406F175D69C1A09CDCF83BE850C2FC2987C4FA68054A96BFA6F99715CA33E61F448C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2876_1393062745\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 21.6MB
SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
MD5 40bf410fa9ef0d5499907e34885af6f4
SHA1 4d7722337a0e26bf4a1c6478129356acb2f7b720
SHA512 b763712aa4bd9819b7972a40216c08fd32338b14fab7ce4b166e39ce441ad62678bf0e1f25da436ffdb56ff1b1a21e3dbbaf47c0f5918c252e70656f5d0307ac
SSDEEP 393216:KYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHY:3mghF5QDwWCm/2YU8Ivq9u5P
TLSH
T14F37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\81dulmej.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\81dulmej.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 9804b5d81662c9b6174184f1cb6d3308882f433a576f3c561b5c2d88505f8797
MD5 01fb3ddf43b3fcf2984caf3f98856fd9
SHA1 b0792d554f14e15b6bcd9aa4eda232e735542981
SHA512 6ba52a4796d61028a3c0360c49a044c047850db8ff752b21cf55cae472c396ed083ea1f8636da2eb531ccd86f792068d57e593eb09ae29243b41b0ab8b1a3e5c
SSDEEP 192:poOv5zbo7zoZ2xyjkbS3NJk41d66JoztdzgCl6mc0dz:dboYZ2xyjnd66Joz/zgC1jd
TLSH
T1B7E13064E729867FC408027BCCA51B450F39399A984E7F29369D640C2D872DEB78E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\81dulmej.default-release\datareporting\glean\db\data.safe.tmp
Size 30KB
SHA256 b99bb1bb34a38d34e49a7590685f593e96a883902c3561e6c5a8f6c62ba4f238
MD5 834caa4e4b2c3f8722fd195c91d77053
SHA1 43dbd045cedd3e5abbeb139bd88b841fc6df66ac
SHA512 a7765e951891f7f2b9ba9950d941be2c530c94e3dfcb1000dfe67f2fa31fa2ae3becef8e1fb783bc52c9c7f018bcceac36c94c0d5d297ba5301e9894505f9c85
SSDEEP 768:/5ThLlFUHGcm+uGO8KPwGYiFLb9bdb2bYjW1/:xhLeO8SE
TLSH
T183D20F44FB2A913FD41412BBDCA547042F79F88A591A2FA73A4C64286C872DC7E5E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\81dulmej.default-release\datareporting\glean\db\data.safe.tmp
Size 30KB
SHA256 d9799caee8031c894eff266b2e506b99d3398c3e67fcbe7b43fafdadc7b5592e
MD5 eaa3535f6724ccae86cdae6efa067213
SHA1 98f070fec059db4c54f11ef1ac9f5f8e5980f311
SHA512 8d554ff68f55d41f559e702da7e79faa8e328b3c3db32f263100b002b77eaf2de8de5e1ff462848d1099d073d6b4cbf0334efdac92722c0c75030a1c81627caf
SSDEEP 768:dhLlFUHGcm+uGO8KPwGYiFLb9bdb2bYjO551/:dhLeO8Sy
TLSH
T1EDD20F44FB2A913FD41412BBDCA547042F79F88A591A2FA73A4C64286C872DC7E5E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\81dulmej.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 d3ad3e8a015fc064c9c7bb6cf9d4bcf9771e9c49aa37b026a20a19dfdceabdde
MD5 93fbe7a4d51bd1e091b3d8501d3bb7a7
SHA1 8f28f3c9b9fb7118408a849bb2a76edb9894939c
SHA512 7f143b7e4f09ad8e4476311954cc8b9c53ae820e5289d7dbb1353d0d8319cc6d7c5b8cfbdb9efab4a137c89ccd02b39e74d4ca909ad2d9eea2622f950dc09e90
SSDEEP 96:W2hzSdF95/7bkW6ArvE2xDyUR6ckWZOVIP2FRBFRVFRAFR4/dd66JoztdzgClKtt:WoOv5zbo8M2xyjWw3NJk41d66Joztdzv
TLSH
T183C1CD54F729463BC408423BCCA51B410E76799B988E7F2532DC640D2D972DEBB8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\81dulmej.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 75a7b44786ee57d1614e64c06d6fa4a74852f027b6322cf1d0d2c2a5575afc2c
MD5 398b870cecfd32f160e20d2ba433c51c
SHA1 edcc484b7288007af5453a713f9321b3a1a32db1
SHA512 49f54afa0334c35f5e835faaa7f41d35b29344c4a9158a252095698398d34365e658fe9b27f71da0aa381a7b634f0728111cdf2d815fab7042675e5134c59204
SSDEEP 192:V3NJk41d66JoztdzgCl6mc0dBoOv5zbo8Z2xyjWiI:5d66Joz/zgC1jrbo8Z2xyj+
TLSH
T181D1ED58E729467BC408027BCCA51B410E76799A988E7F2532DC340C2D972DEBA9E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\81dulmej.default-release\datareporting\glean\db\data.safe.tmp
Size 30KB
SHA256 c5157949d64ecde84199adc86d019556ec2412914be397468a0697f9b1d58baa
MD5 7093f0cd9719e8a01323833255ad90bc
SHA1 99bf488bce4c9b30e2eb82dd3bd27763f24d7920
SHA512 511cf40a3954d0fcded078a2807a1ab1cdd5a98f2f42e1d156d8c0d88fdf80db017868a6d3c055169011104931c33e76280be87c32814d2e6ebc9efffb0bda83
SSDEEP 768:b1W5ThLlFUHGcm+uGO8KPwGYiFLb9bdb2bYjH:shLeO8Sj
TLSH
T131D20F44FB2A913FD41412BBDCA547042F79F88A591A2FA73A4C64286C872DC7E5E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\81dulmej.default-release\datareporting\glean\events\events
Size 1KB
SHA256 5c6888c15b6cbe90d0f67400398666f75acba2c8eb346c51e50f294b2458caca
MD5 d6e56521407962ec1ddc181f7c1fc4b3
SHA1 f8dc5328a26e0266a483bd97d88fce8006972f27
SHA512 ab75278dd2c687e65f728b9fe6ed7bb6125e546d7cbbbf1087a95a418bb2842015993057e7d2dc2501d07d2de58b6800385cbe340b83019185169b8b8ad9f42d
TLSH
T1AC212B6C3AB94D2B688AF69C7840018EA3658A0B48871C538D53FF8DCFD16DD3179439
MD5 SHA1 SHA512 TLSH

Submit Download

146bc461-7b0b-4b6a-91ec-32c4bc0396a4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\81dulmej.default-release\datareporting\glean\pending_pings\146bc461-7b0b-4b6a-91ec-32c4bc0396a4
Size 883B
SHA256 4926329ca80dfb734adbebf12ae3b632de76415a4fa3f86ff677d34e26e6b93e
MD5 4267ac9bd4eee727ecd645c951bdc5e4
SHA1 b578e38c7ae602224f3b7e19fdf3d98201a02e63
SHA512 70979f417335f6cb7ec5feadadd211bf4a7749f55059118d40439102eaa56ece9a16e6b46c155e5de9b305ea454078c116e34c83480834dea2d1461f7a22ff96
TLSH
T17A110040933676F2CC38D24B8AA43B068BE47623C0C695143EE55D084DAB61EA36B74B
MD5 SHA1 SHA512 TLSH

Submit Download

28c8c1b2-1c4f-49de-b94d-4782a29d5d0e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\81dulmej.default-release\datareporting\glean\pending_pings\28c8c1b2-1c4f-49de-b94d-4782a29d5d0e
Size 2KB
SHA256 974b344f90160f41cc23ebd48e636da931eb3b7c51d8db38e1a6fafaa19f825b
MD5 0c0d492e1badf6931ec9894f750ad005
SHA1 90366236bcb270efd83f935d151b200a07837584
SHA512 9e27368eb02fd01e663ae60f7e1d80bd04cfb2ce34d556a938f15338da5d3c334d630ee69960e322ed541ccb392bdfb621d23c5fe57e9a54ae55ce1667a2f973
TLSH
T1E041F11C39789D769C9AF59E9481378E57A08B1300C228832E61EF0CDD9375FB36E52A
MD5 SHA1 SHA512 TLSH

Submit Download

63862478-6aff-4538-a395-774448168c27

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\81dulmej.default-release\datareporting\glean\pending_pings\63862478-6aff-4538-a395-774448168c27
Size 886B
SHA256 888b2273317bf6a39a6e1c11f6f7ba9042e7838ad027831a6306f7337edc3349
MD5 a61736c97a3b13f8428f988d96e45ba9
SHA1 c9ce5e97ab69c9b27a7cb7086604afdb9d7b8ad6
SHA512 5e5638f0e2d8d4169693f198505418bc2ecbf52321b53769b11dbcfe836d842be9921c2d2ba72da9dfc039f891c7302447a2c789871ccc7f9b0b97428eea20b4
TLSH
T1FB1104409735B6F2CC38D28B99A07B478EE0B63380C75D247E651B184DEB51AD76734B
MD5 SHA1 SHA512 TLSH

Submit Download

64b7a275-b97b-4d34-a03d-189aa015b8dd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\81dulmej.default-release\datareporting\glean\pending_pings\64b7a275-b97b-4d34-a03d-189aa015b8dd
Size 235B
SHA256 32170cb6a0e18f22e65c09eacd2a77765daf9e150f31af773c08ecddee02db8a
MD5 573029b0232c3f1559d60139f427ff21
SHA1 0cb2e7223ef0d0b1dbe4f86251f62680f1d17f16
SHA512 8569ec66402eee4dc7f1d553ccc66dc8d9b3cdfde068481b48630c9ae900529ea035bff113c5e96c9ada3cea2045c29a4c7f32927421a7534d27e403bf9cba25
TLSH
T101D0979418A8BB1C08080F0BB0E02ACBB0888C335078A8149E7A02B89BB8AC4821681A
MD5 SHA1 SHA512 TLSH

Submit Download

8b369925-4a52-4873-bec9-c8e7084f5dfd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\81dulmej.default-release\datareporting\glean\pending_pings\8b369925-4a52-4873-bec9-c8e7084f5dfd
Size 16KB
SHA256 f315b8ddd58aaf0e5693acc76f249e8dde9fe5b4f8693f1b3f19c43dd4a751da
MD5 fdacb57bcc4f0c19f69d8f8a6421e387
SHA1 9d8355382e6852d5a4b95de982043717e156ce28
SHA512 12c3eaa5c745173f3ee16b0ed9f2cec6d6c5501932908d9caa5588d05ba338ffa55b3041fd271d74b06f7e09d3717fb628eb2922434249f238a9e765c2455c09
SSDEEP 192:KNVA3b+JRefhymjGTZ3Te2F1OqGJjgy8cc2qzziunB7itaBlgYTUwD21IPBoscoI:uAr4e8Cq5nB7itaBlgYTZtPeWcf
TLSH
T1E372EA5628205ABA8150E75894FC7FC3E5F638CB4C419FCA9BE4BE0819DA06E5137C4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

be434a73-bee2-45ae-a339-a7057cd2d60d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\81dulmej.default-release\datareporting\glean\pending_pings\be434a73-bee2-45ae-a339-a7057cd2d60d
Size 235B
SHA256 4bd1506642ae4b2dea92106efef4cddba9fd06b7dd90e35377b892738bee48b3
MD5 666a75626dfac1445298f2a671d474bc
SHA1 1c8e53a072c6fe418cd7a517f2d7b8750a88a5a5
SHA512 2bf597981e862154eaece1b9c454fda22311153f754b681ded2f20caeb1d897a3cd30b0a6ab72115d35b549678c56a62efb21e68cf7b93559fc19743f3485c96
TLSH
T17DD0A7C014D8A7AD4C145F1BF0EC69CBB4994C331474A9609A6149B89AFDBCA4162C5A
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\81dulmej.default-release\extensions.json
Size 16KB
SHA256 bdc4b85d184dd8f145ca50c128b0aee5c9445a14a1dee272b10f764b8905b3a3
MD5 6f169526a422f975fc56bd45e7b97042
SHA1 ee1ac4cd2b37b32ad4544994ce6b613151b3bd5f
SHA512 3e594be1f94e8424645bec532097863f68dd9db2c6c20bdd532e78f676f204b34eaf88330f99806bc930ceeb019439c322d4969f6c6fe4fb1fa133281d3b6ad2
SSDEEP 384:GkI4vDUmldvl8dhW/94zi96oOWL4HsL4PwL4HSL4HXL4H3UI4hb:JI4LRfmXW4C6u4G464A474X94p
TLSH
T1CB72421545048EB8294EA79BAA367E01C37D473B60845C78F4DD8FC842FB5B902FBA5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\81dulmej.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\81dulmej.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\81dulmej.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE.tmp
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\81dulmej.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\81dulmej.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\81dulmej.default-release\prefs-1.js
Size 6KB
SHA256 5a6e2c208960fd1d0b306be737f1aecf70a043529575c474c9f17647e5fbe541
MD5 e21d1e12e01a00e737336ee22e2d46f3
SHA1 72f525503212121ea7be339e9a4b1d5eaa3eca8b
SHA512 bf1ab27702a677c0d1c05d9a8c3d551f0434c1e0f742ca2a8853255b63c6653d506fd4dbc7ca606d85b1311129b6b91524ecf905c56ded674cec4bf1765ec70f
SSDEEP 96:xHwUTUqqGqxfXWV1zSLSSlldv9j4MnYRHIiel+0Bw88u8L4cnfuvGA:KtRxfXWVaSSO9Itl+0Bw88g
TLSH
T15FE12F789008CB6F74B677ACAC6889319AB2013B77BF28D650B954C5054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\81dulmej.default-release\prefs-1.js
Size 8KB
SHA256 d2f0c1f210ccf1be9a37d4148cb7f43b95d8b76a7c8fc34193b7d46b39099dd3
MD5 a29e94a09b8d089a2dad35619211b079
SHA1 585daee77c3fc54513b762101b6ba097b53577e3
SHA512 dad6fa2754fde2d5bcad61d1e2035c771d9a2fb31fc5f02d486cb9e54de4e9bafbe66a99dcff2795302f38a77558f5dcc37a3e6b1091acc4570b0d7e902ca1ee
SSDEEP 96:xHt1TUqqGqxfhWVObzSLSSlldv9j4MnYRWRl0iel+h1Bw88uCq8L4cnf5vGA:fERxfhWVBSSO8RKtl+PBw88uC1
TLSH
T1C602FF7C5504CB7F74B676ACAC6449315AB2023BBBBF68D710BA54C50608F3841FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\81dulmej.default-release\prefs.js
Size 6KB
SHA256 675413f1b906de79141bc916838880089713147bbc6366f01debd8f8cd1d7a8e
MD5 377463216c843f17a62324f5b8eb8e1c
SHA1 9597ccb21f29baf5e8da665df58762f86fe0638c
SHA512 181470cf9f7af5e7bebd68a08c9d99d7736f5e4967492fb9088b29b81ced751002b27c5bdcd2593a009a84d43301c963a8bc1d2e501af03f32030dc73722d4a5
SSDEEP 96:xHwUTUqqGqxfXKx1zSU5SSlldv9jinYRHIiel+0Bw88u8L4cnfuvGA:KtRxfXKxN5SSn9Itl+0Bw88g
TLSH
T177E12F789008CB6F74B677ACAC6889315AB2013B77BF28D650B954C4054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\81dulmej.default-release\prefs.js
Size 6KB
SHA256 8d8857ef1bbfe435d310d25cdc15d339b8538e3c2f918966c482f410ae431556
MD5 8e429fba6e704e9ac4f67fa62c8efcbf
SHA1 dd1b67605eed384c7a7e89811f0fdb3031bb59b4
SHA512 e03af5e711c637f451704c101c037ca99857fbd7c1604114af57630c4b7e4f07f57975046100fa7a4a9a8f8420d2e84aba6c685069193d42ce1b1f4ba80a3dbb
SSDEEP 96:xHwUTUqqGqxfXWVObzSLSSlldv9j4MnYRHIiel+0Bw88u8L4cnfuvGA:KtRxfXWVBSSO9Itl+0Bw88g
TLSH
T1C3E12F789508CB6F74B677ACAC6889319AB2013B77BF28D350B554C4054CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\81dulmej.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 0ab14ffef180724ab9257bd58bf013f026898caee956d97826a1162210c2c30f
MD5 b404dfc4552f41ddd01746fba9b42103
SHA1 cdc0cbbf9d97d5fbe4407d1a42febec3d0d8264a
SHA512 0b158dd3419feef38498a887da0b414011083d0b5a3202451b89ed2a6dfde4fd68f405c6163cc44fb7b8e86ca9c00ce1aad6bf208e40d502bc595cc65e8ae335
SSDEEP 96:ewfeE8N9k3BBQeW9jILA0NjoB8kMJttn0YJZQBei:fenN9QBIOnNcB85JttnTZE3
TLSH
T1E5916C51361B2963FD5B86CAAF494CF145B0310A448044ED90CF6B25B76BB4B75984B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\81dulmej.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 11.7MB
SHA256 797a778b04962099d9700242c6989a96f0c117a09d77e4afbe659cbc7282050c
MD5 8c7fe510c597f976fc1c33d0f6848673
SHA1 9cdb5eba98829d9ca937aa006bec98161629d9be
SHA512 03b8fb869eef21da1e5851070f95db2efe43c16326859df891c12931eaebac2d5b892f1a27f3c0eb06f83656a17a1e3094311854144dab57030b65d46c26f4e8
SSDEEP 49152:D65hne5nLq3YAL/9uVtmHAdtNVjYBZR17Vs6ADk:WXBFuVtmH0jVUB
TLSH
T121C63A9670D4DA92EB4186B2F30F43CB35BFC2CC20D5859416B8BA5C991729BEE2F354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download