989ad01a2f4931fbc11dddd05d62f93905f4ffea48c9d578322e740172cb3656

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 02:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
Size 5.8MB
Sample260714-deebkscy8k
SHA256 989ad01a2f4931fbc11dddd05d62f93905f4ffea48c9d578322e740172cb3656
MD5 daef8492b4a43cafe88901cc4559eb1d
SHA1 27da92d889953b2380fa5d8cb36036f1776b03a9
SHA512 c3cfbd5c81daddce0700f63ce9dc55b4e4248882f06b7dcc0c8df13f410119e8793b668f898253326a8f84cba09af98ac38c1b0a91244d69ed1591be18a77cfa
SSDEEP 98304:B/vv0r6aF5j5kbb3DX3P4j9zqAM18frP3wbzWFimaI7dloI2A:SrX5ebbTXIZgbzWFimaI7dlN
TLSH
T1FF569D52BF8C817AC95A11310B2DAF2A542AFC64773465D3B2743E7EEC753C12C3A61A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery persistence phishing spyware stealer

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe /onboot"	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_1871536884\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_1026033679\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_1026033679\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_985284977\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1228_985284977\nav_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1876	msedge.exe

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 22 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe"	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm"	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243"	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe"	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3"	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3"	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe"	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3"	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Low Rights	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134284713445271208"	msedge.exe

Modifies registry class 18 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter"	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User"	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan"	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1"	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Therad = "1"	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe"	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Model = "194"	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{049C48B6-B105-4272-A2E7-DE7C1B247C03}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	1004	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
Token: SeDebugPrivilege	4244	firefox.exe
Token: SeDebugPrivilege	4244	firefox.exe
Token: SeDebugPrivilege	4244	firefox.exe
Token: SeDebugPrivilege	4244	firefox.exe
Token: SeDebugPrivilege	4244	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
4244	firefox.exe
4244	firefox.exe
4244	firefox.exe
4244	firefox.exe
4244	firefox.exe
4244	firefox.exe
1004	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
1228	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1004	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
1004	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
1004	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
1004	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
4244	firefox.exe
1004	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
1004	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
1004	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
1004	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
1004	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
1004	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
1004	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1004 wrote to memory of 1112	1004	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe	88
PID 1004 wrote to memory of 4840	1004	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe	89
PID 4840 wrote to memory of 4244	4840	firefox.exe	90
PID 4840 wrote to memory of 4244	4840	firefox.exe	90
PID 4244 wrote to memory of 2800	4244	firefox.exe	91
PID 4244 wrote to memory of 2800	4244	firefox.exe	91
PID 4244 wrote to memory of 2800	4244	firefox.exe	91
PID 4244 wrote to memory of 4704	4244	firefox.exe	92
PID 4244 wrote to memory of 4704	4244	firefox.exe	92
PID 4244 wrote to memory of 4704	4244	firefox.exe	92
PID 4244 wrote to memory of 4704	4244	firefox.exe	92
PID 4244 wrote to memory of 4216	4244	firefox.exe	93
PID 4244 wrote to memory of 4216	4244	firefox.exe	93
PID 4244 wrote to memory of 4216	4244	firefox.exe	93
PID 4244 wrote to memory of 4216	4244	firefox.exe	93
PID 4244 wrote to memory of 5420	4244	firefox.exe	94
PID 4244 wrote to memory of 5420	4244	firefox.exe	94
PID 4244 wrote to memory of 5420	4244	firefox.exe	94
PID 4244 wrote to memory of 4232	4244	firefox.exe	95
PID 4244 wrote to memory of 4232	4244	firefox.exe	95
PID 4244 wrote to memory of 4232	4244	firefox.exe	95
PID 4244 wrote to memory of 4232	4244	firefox.exe	95
PID 4244 wrote to memory of 3200	4244	firefox.exe	96
PID 4244 wrote to memory of 3200	4244	firefox.exe	96
PID 4244 wrote to memory of 3200	4244	firefox.exe	96
PID 4244 wrote to memory of 3200	4244	firefox.exe	96
PID 4244 wrote to memory of 5292	4244	firefox.exe	97
PID 4244 wrote to memory of 5292	4244	firefox.exe	97
PID 4244 wrote to memory of 5292	4244	firefox.exe	97
PID 4244 wrote to memory of 5292	4244	firefox.exe	97
PID 4244 wrote to memory of 4756	4244	firefox.exe	98
PID 4244 wrote to memory of 4756	4244	firefox.exe	98
PID 4244 wrote to memory of 4756	4244	firefox.exe	98
PID 4244 wrote to memory of 4756	4244	firefox.exe	98
PID 4244 wrote to memory of 5056	4244	firefox.exe	99
PID 4244 wrote to memory of 5056	4244	firefox.exe	99
PID 4244 wrote to memory of 5056	4244	firefox.exe	99
PID 4244 wrote to memory of 5056	4244	firefox.exe	99
PID 4244 wrote to memory of 3168	4244	firefox.exe	100
PID 4244 wrote to memory of 3168	4244	firefox.exe	100
PID 4244 wrote to memory of 3168	4244	firefox.exe	100
PID 4244 wrote to memory of 3168	4244	firefox.exe	100
PID 1004 wrote to memory of 3404	1004	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe	101
PID 1004 wrote to memory of 2984	1004	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe	102
PID 1004 wrote to memory of 5600	1004	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe	103
PID 1004 wrote to memory of 4240	1004	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe	104
PID 1004 wrote to memory of 1228	1004	2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe	107
PID 1228 wrote to memory of 5096	1228	msedge.exe	108
PID 1228 wrote to memory of 2384	1228	msedge.exe	109
PID 1228 wrote to memory of 1876	1228	msedge.exe	110
PID 1228 wrote to memory of 2384	1228	msedge.exe	109
PID 1228 wrote to memory of 2384	1228	msedge.exe	109
PID 1228 wrote to memory of 1140	1228	msedge.exe	111
PID 1228 wrote to memory of 1140	1228	msedge.exe	111
PID 1228 wrote to memory of 1648	1228	msedge.exe	113
PID 1228 wrote to memory of 3376	1228	msedge.exe	114
PID 1228 wrote to memory of 1648	1228	msedge.exe	113
PID 1228 wrote to memory of 1648	1228	msedge.exe	113
PID 1228 wrote to memory of 3376	1228	msedge.exe	114
PID 1228 wrote to memory of 3376	1228	msedge.exe	114
PID 1228 wrote to memory of 920	1228	msedge.exe	115
PID 1228 wrote to memory of 2252	1228	msedge.exe	116
PID 1228 wrote to memory of 920	1228	msedge.exe	115
PID 1228 wrote to memory of 920	1228	msedge.exe	115

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_daef8492b4a43cafe88901cc4559eb1d_darkgate_elex_glassworm_remcos_stop.exe"
1⤵
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1004
- C:\Windows\system32\regsvr32.exe
  C:\Windows\Sysnative\regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  PID:1112
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
    3⤵
    - Drops desktop.ini file(s)
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4244
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1952 -prefsLen 27097 -prefMapHandle 1956 -prefMapSize 270279 -ipcHandle 2040 -initialChannelId {efec82f6-d878-48f2-9a6c-197f2cec5a93} -parentPid 4244 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4244" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:2800
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2368 -prefsLen 27133 -prefMapHandle 2364 -prefMapSize 270279 -ipcHandle 2296 -initialChannelId {ecd15310-f19a-4855-877e-8cb9dc13bc6d} -parentPid 4244 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4244" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:4704
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3848 -prefsLen 25164 -prefMapHandle 3852 -prefMapSize 270279 -jsInitHandle 3856 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3864 -initialChannelId {5caa3efa-e655-4ed1-9bdd-33a6463cb8ef} -parentPid 4244 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4244" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:4216
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4016 -prefsLen 27274 -prefMapHandle 4020 -prefMapSize 270279 -ipcHandle 4088 -initialChannelId {1467b6a4-55cc-43b9-a33f-cacdc6b700a5} -parentPid 4244 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4244" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:5420
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4400 -prefsLen 34773 -prefMapHandle 4404 -prefMapSize 270279 -jsInitHandle 4408 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4416 -initialChannelId {a33a38e5-0082-4803-8949-091077c1d3f5} -parentPid 4244 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4244" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:4232
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5100 -prefsLen 35010 -prefMapHandle 5104 -prefMapSize 270279 -ipcHandle 5112 -initialChannelId {df8dc396-46ea-4e20-8ca3-b011b1e60567} -parentPid 4244 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4244" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:3200
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5516 -prefsLen 35062 -prefMapHandle 5520 -prefMapSize 270279 -jsInitHandle 5524 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5532 -initialChannelId {2cbee6dc-903d-468a-b3a6-71a39a4c18af} -parentPid 4244 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4244" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:5292
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4680 -prefsLen 32952 -prefMapHandle 4684 -prefMapSize 270279 -jsInitHandle 4688 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3152 -initialChannelId {4589b123-7b31-452c-8eda-a71780542648} -parentPid 4244 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4244" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:4756
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5928 -prefsLen 32952 -prefMapHandle 5932 -prefMapSize 270279 -jsInitHandle 5936 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5676 -initialChannelId {8d066bda-f7a9-42ca-b40b-1d52b34ddf70} -parentPid 4244 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4244" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:5056
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6120 -prefsLen 32952 -prefMapHandle 6124 -prefMapSize 270279 -jsInitHandle 6128 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6136 -initialChannelId {525eecad-9a5d-4409-9538-de4457a39756} -parentPid 4244 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4244" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
      4⤵
      Checks processor information in registry
      PID:3168
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3404
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2984
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5600
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" http://www.internetdownloadmanager.com/download2.html
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffabf9ac188,0x7ffabf9ac194,0x7ffabf9ac1a0
    3⤵
    PID:5096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,16349972191615890301,3819610519284209006,262144 --field-trial-handle=2408,i,17320900926444594156,168418830292475222,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
    3⤵
    PID:2384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,10355168652617970331,8519671721755234155,524288 --field-trial-handle=2408,i,17320900926444594156,168418830292475222,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2560,i,2835085140728228243,17929364971360806265,524288 --field-trial-handle=2408,i,17320900926444594156,168418830292475222,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:13
    3⤵
    PID:1140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,10512981122056641177,5898657171059293121,2097152 --field-trial-handle=2408,i,17320900926444594156,168418830292475222,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
    3⤵
    PID:1648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,2775416485133069936,7575484311564049974,2097152 --field-trial-handle=2408,i,17320900926444594156,168418830292475222,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
    3⤵
    PID:3376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4380,i,4922217772265098973,4637724883211799322,2097152 --field-trial-handle=2408,i,17320900926444594156,168418830292475222,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:9
    3⤵
    PID:920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4360,i,2026785091335632156,6073298079656719885,2097152 --field-trial-handle=2408,i,17320900926444594156,168418830292475222,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:1
    3⤵
    PID:2252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3796,i,1048319288465778823,2257217742038889394,524288 --field-trial-handle=2408,i,17320900926444594156,168418830292475222,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:14
    3⤵
    PID:3068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5472,i,6241041611824289661,4597121771774996813,2097152 --field-trial-handle=2408,i,17320900926444594156,168418830292475222,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:1
    3⤵
    PID:1312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3888,i,1071841397722043591,4452813557455070164,524288 --field-trial-handle=2408,i,17320900926444594156,168418830292475222,262144 --variations-seed-version --mojo-platform-channel-handle=3876 /prefetch:14
    3⤵
    PID:5012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,9374107870849691024,1579142323248154117,524288 --field-trial-handle=2408,i,17320900926444594156,168418830292475222,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:14
    3⤵
    PID:824
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,16257417043600576203,12589561947682431422,524288 --field-trial-handle=2408,i,17320900926444594156,168418830292475222,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
    3⤵
    PID:3720
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,16257417043600576203,12589561947682431422,524288 --field-trial-handle=2408,i,17320900926444594156,168418830292475222,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
    3⤵
    PID:296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,15316996557007803984,16671657370334365475,524288 --field-trial-handle=2408,i,17320900926444594156,168418830292475222,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
    3⤵
    PID:5972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,12390203824767733776,13646878200470469099,524288 --field-trial-handle=2408,i,17320900926444594156,168418830292475222,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:14
    3⤵
    PID:5720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,2723847851544275214,14193410157977670212,524288 --field-trial-handle=2408,i,17320900926444594156,168418830292475222,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:14
    3⤵
    PID:6932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,6521661165452522687,3524899011517210183,524288 --field-trial-handle=2408,i,17320900926444594156,168418830292475222,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:14
    3⤵
    PID:6944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,9877725116337062048,3094382490290955674,524288 --field-trial-handle=2408,i,17320900926444594156,168418830292475222,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:14
    3⤵
    PID:6880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,3082759666874316106,14034776745051923246,524288 --field-trial-handle=2408,i,17320900926444594156,168418830292475222,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:14
    3⤵
    PID:824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,647753875029430383,16524415552146560894,524288 --field-trial-handle=2408,i,17320900926444594156,168418830292475222,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:14
    3⤵
    PID:1464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=948,i,13637810648709254582,4583234988041958865,524288 --field-trial-handle=2408,i,17320900926444594156,168418830292475222,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
    3⤵
    PID:6368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,2852025664973522995,10992930067135185061,524288 --field-trial-handle=2408,i,17320900926444594156,168418830292475222,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
    3⤵
    PID:6748

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b53c58762bff2a5723ae446675e8f65fd50818b95383c8f3c7efef01af06e466
MD5 629a18fe1b7a241215c77a30d7d8d7ee
SHA1 5e7bd5b514f4e46a4b986c8b89d0025cf81a1f36
SHA512 04fd58619789dc107f680a57dba3aec42e4bab7c29c0defd7e1b8ca2d078ca4c91317932ff076171bae60d370b28de32c94039c6ab690d5004ddcb857977f38a
TLSH
T182D09BD575146914C5A1303E21D2935392504835601945874051E56D5C5479743FB5AD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c36ac766a384a109222b8b647d2f5c1c2e6c4672a4a2c6b8a01f6eac0a5df074
MD5 f9f896b0e6f281d55b1ca3fa3c1ccdcd
SHA1 db44df3874cd86a961c82d25f3ae2004f249b2df
SHA512 6b8c8d305c2d7e4a3b5efb6e1967d7db1b1ffdb7979edd315013037da369c923060dae4ef8a7219176aa7e0bc1fa4cb98e48470ea2f569243a95d3301f5a40bd
TLSH
T160D09BD575046A14C5A1303A21D1935392604835741945874051E55D5C5479743FB5BD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7ce6187af66332ac1f0f031e4baefe9ae76e6cd0ce2ba5d1776d9bee8cce45a2
MD5 73beec678520547e700538210f25fbb8
SHA1 543dda419c3b0f97a92e7f62941f9e90937857b2
SHA512 81559f4281da1c4e1144d442bb0ddda0a929f886e7b7f41ea54d9e8678f60f2bd2dd00255cf8af181c5a13a4ce38a5e859e38df03215e87d3fb2c0ddb7a8cdec
TLSH
T138616F505B2F03E2E328C6B26BE2E6D43A784874060B6EC15DB874BB453EBD7B103450
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a5ab4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a5ab4.TMP
Size 3KB
SHA256 4b63e87b9d38252d3dfc3d093293da92b98e9fade856c987772c9244f4d51158
MD5 42940642adaa9bc95d35b05d7e60c792
SHA1 f000e07902373f3b8a8277a0eb0219a08f72f2d6
SHA512 11c1788e3c70510e68b18ea72c65fbd1f5b672930745a5c760c34dfaeef47a5bda18b679b61898cbe1e2934edaea86122b2bd613438e584952e0448b91f88975
TLSH
T1B36150545B2F03E2E328C6B2ABE2E6D4367C8474060B6EC58DB874BB457EBD77143450
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 93ef99630a459c6691e0adca11b68878f5848e839948ab260149d7790e4944ec
MD5 5321df9c519cadd5d2594a6a9ca8d192
SHA1 215a3f37dd55a2e131587cf363128eb55873f255
SHA512 448313207e3a5bceb66f50f467ba29828e4590f22559661b966e521b36e6da51afc5c5971a59f5d8c450535153e6fd0ab6505c8d93b824b69f47478baafabb2f
TLSH
T1C631D0F3C3F5856ECA1156F0BA186E2BCE2D0505836C3D9A89E4EF5B93E3474E10194B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 9dab42adcdb60ddf01a7430d55cb093014ec2ce18c45b691b333fafec7f148bf
MD5 ee79b16c0fdef2233f9cb6ad5e5dad91
SHA1 a744a7dd452b3c14e116b4478d0bd4139b4814d6
SHA512 0b95f663731340ac8611d734b236f1b5baa25b8ebc9305ff246b037b72c34c47dd7431edf622b78dc87759ccbbae1514f9a3b6a8c499c6b94a4b7f736d525dd5
SSDEEP 192:sxRIRryM/jK1Ml8wCb/f5sQshZ87YEgzoA8ppo/g6+WNYfH/Yx8JLG2IgtJ:sxRI18b/f5sQsv87pq/5Q/7T3
TLSH
T1DC62E8166A389977DCDBD20DFA557F93D6F81563E2901E44AAFC8B0C04E6ADD220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 efc8719ebcd285d192d79be6da1710a14bdc842d2db1df6743a66c70bfa30707
MD5 6ba3db6f770d7bd9dbcc2eebd5d89288
SHA1 2e5b96a09b5f7841cfe59e38508a9c9d7e5a57eb
SHA512 44dbb49e9ae842729b9d7ebfed6e0ff0e29338cec9b68f7e69bd27a024836066eeead2db314e162b1c0c9ba0c5b7e1d5617579ccabd75fa674e9fa7bef926275
SSDEEP 192:sxRnRryM/jK1Ml8wCb/f5s7shZ87YEgzoA8ppo/g6+WNYfH/Yx8JLG2IgDCJ:sxRn18b/f5s7sv87pq/5Q/7Tq
TLSH
T16862E9166A385977DCDBD20DFA557F93D6F80563E2901E44AAFC8B0C04E6ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 57b3e4df8ea5d2e84ed265b08e5846b46c3cceabbf2fabcbeeaa11b44c1b698a
MD5 5172cabbc4e275f3512bef7cc4ffa3df
SHA1 38354d153c7ab3a71722f5e3ce56df409792bfd9
SHA512 f2ead1480f5333081d75ed71db47b3bbd428fbc2263d4462cfd9f4f8b3adbc8720f77d38f248d9cd6cdb46a7b2b27c7f61c3e3401296ec304f7149ea3d2c96c7
SSDEEP 768:0xCyDs7pLuL7ijWgbrfM18F1+UoAYDCx9Tuqh0VfUC9xbog/OV4sHrVAeroJqnts:0xCyDQE7ijWgbrfM1u1jaTsHpA1JqYF
TLSH
T1E4E2DC7B680CCB7E4F404A9DEC297EDEADE802CB96D8CD5447EA840C03C66EB51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c0d465f1-757e-4ee3-8949-2d050d8a6f0a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c0d465f1-757e-4ee3-8949-2d050d8a6f0a.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 72ae999153be2aac5ec55129766a9ab66a9adb915ab031e1290e90bdef23472c
MD5 1f2b244cf809bcc3cc1062af209a8c2b
SHA1 91ae23a5b60b437ddee08a60a6b8b31e53fa3386
SHA512 9aafbb0342681d7751a5bafa0d05ade29dad8ee8b1334b56a4743723c9a27ed6b8712fb68f9b270cd18f37056abf958e87f50639aff7023fbeefa5373596a25b
SSDEEP 768:4j+953/qWkKL251jF669yrqUjWiIwwxMt5b9Mi:n953/YfjF66INWZTM/b+i
TLSH
T13DF2AE707C559EB388E6DB95B21337C6AFB011A795C40F8CDADCAB0D09975DC2B4342A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 c99400408da7dbaea3f674ae3b5b3d7b511beab3786fb12cc4ae357bf226d583
MD5 a37821f8c33a9bb30257ed9f85f5acbb
SHA1 8c21ba60945c196491d81cb8a54d6c203dca4783
SHA512 2dbcdb326b086072183ecfd1d18e189f93b49b57df4e63cee4def0f9e6a0811bd1d48d33638390aa3b5f29a8d629c5ec4dc9c18cdccc087bac40ce891f7d8b0a
SSDEEP 768:Lrv+4UNbdf3VfWkKL25ZjF669yrqUjWiIwwxMt5UileX:LbsbF3V1XjF66INWZTM/UsQ
TLSH
T13013BE70AC589E73C9F6D685725377C3BF7420A395C00F98CAD9A70D0A9B0C92B4792B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 cd00e9f461d3afed6ca740c54cb1475007cc9795a30593aa63be9940a38fb750
MD5 337092380685052867849294ee15b4e9
SHA1 17bed5a52432424d3f01ceb9d1c4eb4e08d96c5e
SHA512 721f6bb29a631d06ce2ddcaf6e07a317f5d40bc9ea65f79bf86dd891a5f6c47334516e5e1ae9295f7f843b1bc9fdf7ada74367b9b2a96f442bf717b5a31acd34
SSDEEP 768:arv+4UNbdl3APkKL2QjF669yrqUjWiIwwxMRiUiler:absbX33YjF66INWZTMwUsQ
TLSH
T12C03CE31AC589AB7CDF2D68672537783BFB4109396C50B88CADC670D469B0DD2347A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 1e6c7cad15c77607da0a553bb5358789b26c00f99cb8d687bf89aba70a47384d
MD5 6b05f32aa4d8efa95d696c17915df801
SHA1 371e34e27249327670ab9e98c0b9079dc9c83327
SHA512 4a6716950c148e228fde796ac0dbdcc15cb909864594f25f585be888d46ce76b754e077c4451c6f207d5a1d7c7d177e133e475e0fcc092544bce3baa707fa066
SSDEEP 768:tF1j+913zwgLzLv+nF669yrqUjWiIwwxMt5b9Mi:k913BmnF66INWZTM/b+i
TLSH
T16D132AF598D78A77D89D8787633D2E869EBCD063B5844988F7C85E0CCC860BFD606815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

9512A4488B00CC053350DAC32D417B4A35C11513

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
Size 15KB
SHA256 ab137680ff8e96da47a0aedc245ecab7711958dcb72d7fde6b031202f77c2ae8
MD5 144f7092cdf2f2404ca4097397f03050
SHA1 0ffcaf7050b682310393329728dde900b25a5be3
SHA512 789f844590bbb78101a7545c552f578e03f9411768096bb1ad961eb2f953ff5ea752a51ae797b4d4f805f30346462a35341ed1dabf7481e2995388d39db8fe27
SSDEEP 384:H9XghOiO024Ymdcs3hk2nhfdDE2Ba/rIVy8e7V+:dX+ZYmdv3hk2nhfS2sDIVy8x
TLSH
T12D728DBF9F017C591967D545C8AD8369DD05F9ABCBF690A618203549CB8432AB0F60CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d66c9ff5-50fb-4c5b-9418-ee90b36b700e.zip

Path C:\Users\Admin\AppData\Local\Temp\d66c9ff5-50fb-4c5b-9418-ee90b36b700e.zip
Size 3.7MB
SHA256 25326972e41839bf5e2215fe16f654f3ab0837021cdf85301d4ac1e8f9173a9d
MD5 7da8127d70eca1b60ac2eb927d145a0e
SHA1 53a2dfc74992e4a772a8d494b033ad1425c79259
SHA512 2e1848d2c9658bc56317a383a65ec1b19087a4689cdd6cd9ff22d68d22e605b01bda01fea410b9d844bec4dd5c14cb6d2b99bab3c44620011245eec8df1d656b
SSDEEP 49152:M3vznYVJ5jQhrUOjmO59sJDtpuuTc6dcWWSe1M7+6GoOKus5v7iykxbcKwMfwIwg:M3v7UDcUtpTJO1M7nGod5NoJfwIV3
TLSH
T17406E035D6DC1A09C9CF83BA870C3FFE98CC4FB68054A96B7A6E9D715CA31E61B44844
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1228_2071520597\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 9cac877dfa90a79fa2c821cf8bc845dadb1e1179eedf452038b618096462c21c
MD5 35b93b9c09358c40defbfcea591d57cb
SHA1 3341aad82cff0e6517ae59f47ced05c49c360935
SHA512 470855f7b5382576566964e09b721ef7fc8e6660b059d7792fc9c7d39cb22e1cdb01a75965b9ad4f09288f552f003ebb6bb56f448dddf6df0e9938b4b8125a33
SSDEEP 768:0Ji535/3/LGcm+u/BRYBJV5XbVbIb+bKz1/:H535/3uBXx
TLSH
T1D7D20244EB2E953FD42512BBDCA517002F79B889590D2FA73A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\db\data.safe.tmp
Size 34KB
SHA256 dab9f6474b5d682e20b398533295ded4cb96d1c5992f0e2291b6721d4837338e
MD5 247bc68bc1a9d8d00cbbee463c1b6ef3
SHA1 8687c25fe39dbc97b6ce4107af6742b29c77412e
SHA512 487c1b8d67169e054b79249f6ae2ef87d0ca9d1d111ca650ac45b516c85932f836afb94babf96ceb4695131c4afb4b8c805aa430296a359d1b8ff45559aba396
SSDEEP 768:ItK7YIYlD0Gcm+uOqz60KWaRQJAf9b7bobMb+bRbCvZ1/:ItK7YIFI1e
TLSH
T18AF22344EB2E953FD42412BBDCA51B042F79F88959092FA73A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\db\data.safe.tmp
Size 34KB
SHA256 6cec90e4e5b9dfc64d0f445a9b4d59dc867d686c0ce822d160327ad62509e197
MD5 d039c9b112c21506c8736fbf24b3c369
SHA1 782d5f58d1b3f5232dd384c0c6765d71995e2da2
SHA512 6d64c050586b78e5c75eb5584517946b6abc1f4d5d71351745f0098d4370b4a4db1766e86efaf3cc4dd99a117c3ed8204208496f407a03cc69718b9d01800987
SSDEEP 768:l1TtK7YIYlD0Gcm+uOqz60KWaRQJAf9b7bobMb+bRbCv2:TtK7YIFI11
TLSH
T17AF22344EB2E953FD42412BBDCA51B042F79F88959092FA73A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\db\data.safe.tmp
Size 34KB
SHA256 b887fb8a155d7af83b0f4f62fd8448f6df43e0ff92aba1450f81297896281570
MD5 abf147c81de7c6793395c646b282dcf9
SHA1 dca45fb1035e5556d4b6368c8e9522994bd5489a
SHA512 e05390501ce17c2ab048b04c5d505facb959f77800cc23a9187ec2b969be708ada2e082eeff739e31fc434d8227a896d9bf7bc62f551cd4e9e0a79355536910c
SSDEEP 768:fHZ1TtK7YIYlD0Gcm+uOqz60KWaRQJAf9b7bobMb+bRbH:PtK7YIFI1r
TLSH
T1B0F22444EB2E953FD42412BBDCA51B042F79F88959092FA73A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 99301a8b697b1be9bc06517926e0f598ab3d12444b3f2e407cdc2e123d3f11c0
MD5 8fa00cc16003ea35ae82a3fd580fa6df
SHA1 f406abd2d7f610740cf62f3e54fa3aca530cf9b9
SHA512 f5f4e86bcf843777b308d243587f85191244b61aaeeee55734b845eacc1a2661625d3256b4ef65a2e9fdd5a474bc5113a3f04d299a2aff51b28ec02acea20994
SSDEEP 768:l1t8K535/3/LGcm+u/BRYBJV5XbVbIb+bK:9535/3uBX
TLSH
T1C3D20144EB2E953FD42512BBDCA547002F79B88A590D2FA73A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 653f7cd1589ad2b366ecd23a43f2f39b3d9a699ccee9adfad9eaa0ece4017a05
MD5 41edb739f7f7dbabb608f0b14d13d935
SHA1 009a93e1b25a5b5e0d9053dd89dad6d18cbbd5ec
SHA512 e58753521136ba79adaa6d7c74ef3cc2230061ce8124c5489b30cb4dac33658f85745386bd7873b4710c5f8edc04d44ecf5ede59c68870f28e511dd425d94d3d
SSDEEP 768:W535/3/LGcm+u/BRYBJV5XbVbIb+bKX8J1/:W535/3uBXU
TLSH
T1C1D20144EB2E953FD42512BBDCA507002F79B88A591D2FA73A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\events\events
Size 1KB
SHA256 eddd187c211a280e5d1dbf180cf4e467d2966d83f16a38ae61e63708f89ec6c0
MD5 3c29fae86ccefe1946662b38f9b76aa3
SHA1 0094377a6c6b3bf95d77acfed72487d2525a0d51
SHA512 9d9b8f9baa0b1ae41c01eac841e95001efc65bbfb6fb770d5b508ceb76926ea986b520e892a1c85257334ee79be6032a24a7d82f4928a7119b86f1f58410e062
TLSH
T19311575C39B84D2B98CAF29C7851028D93954E0619871C474D93EE8DCE95BDD323A53C
MD5 SHA1 SHA512 TLSH

Submit Download

1b0e86d4-d7c1-4533-bb31-a59da5c66eb1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\pending_pings\1b0e86d4-d7c1-4533-bb31-a59da5c66eb1
Size 235B
SHA256 7a29becfd17938f922caad56d870b3bd037e15118666647c407d75a8c9c1568c
MD5 f0b31411d042145c57d1141c10f6ac48
SHA1 18fdb21c2d1e25c89298febbbf6b6ba97e930599
SHA512 de1ef8fdc6f9953ecf71702de0abf8628fd4b428f1fe704210dd70fcb40da96146d7bf5fd6e5c88ca79625e8a332695f30ac6195ebd6bc0a21e3db4ebf7d4e86
TLSH
T17DD023D024D827DE08204F17F4E0B8C630888C3B16F06C14DE6209B8E9FCEC91361C67
MD5 SHA1 SHA512 TLSH

Submit Download

24a27e0f-67db-46b1-973c-62e5e9027a0b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\pending_pings\24a27e0f-67db-46b1-973c-62e5e9027a0b
Size 871B
SHA256 e43d815358857ce62c0cfcd30e7c5924fad5e0d763c6eccfc400cff26e512e13
MD5 a0b6b2638f7a0665de44dcbad3b4c208
SHA1 975ab98eff612dce6590413eacf8e98ea77e5806
SHA512 be90b88308ca4b5468530ed860550c7e7ff7cd88a7d80a1d07c247783982e51bce52816ccbd607812d1ac3b7fd483ba2fe6856d365c3cebb139e2f3d0e1285e0
TLSH
T17A111B50D534B6B2CD74E25BC991375557F4F41380C584043E7569180EBF75FA75630B
MD5 SHA1 SHA512 TLSH

Submit Download

2ab2f5e0-cd4b-46ec-8f10-b53821a175aa

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\pending_pings\2ab2f5e0-cd4b-46ec-8f10-b53821a175aa
Size 2KB
SHA256 221842db6814fbadfaaa847890454a3d4069f53b71b7d4e16b4cf49db93d89d1
MD5 5913ec253fe83d03d160656c4be6d935
SHA1 998f57ec637b0c61ff37742d629b98a1745cb190
SHA512 4a1f4972436c2d264638ac322479ea7b902ed5dc320870310d3fc259a19393604bb82b524704b5a0451e75cd25161cf6770008de53e4088383854a1556a6146f
TLSH
T1DA41236C35784D778CDBF15DD482238EB7A4994304C61C532E62EE0C8ED679E336A52B
MD5 SHA1 SHA512 TLSH

Submit Download

a54be8db-f378-4afe-bfb2-b13fa381549e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\pending_pings\a54be8db-f378-4afe-bfb2-b13fa381549e
Size 886B
SHA256 14784958048644fedba9dd9b365a765a1e75d5cf648f58d0f0b261b91f180cbd
MD5 361d6d5fed0c33f1da8b40927e3b1567
SHA1 e98a4455433ab2be472a9b0072a6d429e47a805b
SHA512 c9bb2f6e7a759478bb6aaa1bfae8f943d113cd8c13a590682881b3be8797f1459dd21690a37e1b4665cab53f917cc7004d3ecb339fe0e8238d2d0a5465f4653e
TLSH
T1D81127819934B5F1CC74928BCAD0779387E4B52380C68C083E61AB1C0EEA75FA757307
MD5 SHA1 SHA512 TLSH

Submit Download

c8f1ea95-4553-4b5b-9e48-2bed74222807

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\pending_pings\c8f1ea95-4553-4b5b-9e48-2bed74222807
Size 235B
SHA256 f3600bc5b31fe01ed70880c0b072d40121174a275b9e52538e1fb937482856c6
MD5 c142550158c6f76883e21032e9d5d26e
SHA1 a907993de50e808c00bd3e8a61127f4f8a36e4d6
SHA512 9f7a329278015bfb58bc4a6e044afb89ffc133060beb7fc65fb86947b23f671a079a3bb4b926372011569c2694bfd9aaf6cd3a32baab3519c8c401e9dfd4e010
TLSH
T101D097D014F8A32E08144F02F0E03AC630548C3314A8A820D69042B4D9F9AC842A2827
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\extensions.json
Size 16KB
SHA256 4e5f1470c0dbdf56b770f815f179f6f08f27bca1ef02df0bc56c6c47fd783bd6
MD5 45596a8ab269907f5d824761077053cc
SHA1 9756a393028beae19c7c6463a1e856583d8fef79
SHA512 d3603219350d6ae142319e7700f8a985f6b8b9f5cd1539e41cf8d86a4890126dff0d12b789c50abdfb4a67f0669a86678e57184ff002baabbe12800c253b9644
SSDEEP 384:lkI4vlUmldvB8dhWM94ze96oML4HIL4PqtL4H6tL4HxL4HjX4hW:2I4dRfSXJ42614q4St4at4J4L4I
TLSH
T11572421545049EB8298EA79BAA367E01C37D573B70845C38F4DD8FC802FA5B902BB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\prefs-1.js
Size 6KB
SHA256 b2fb4d2c4623f77decc8a10019fc2999d37b0500e2075aec36a02a24d549caa3
MD5 b00d9bb2dfa7af2e2b775574d118d18b
SHA1 588acd35bf8deda8a9700e34db38b40ba00f9ab5
SHA512 f41ff038150849ab56e722b72ba7e72840175f7e94237a32df55dd5b00c68812e8ffcf3f1b874d05ba912a7c905fe5aa554a0d1631b80c1383f6dda8f3c38ee8
SSDEEP 96:xHLUTUhRqGqUfje/1zS7SSlcdv9jnnTRH0wkysLBw88u8L4cndBOR:B+RUfje/2SSA90wkZBw88Ri
TLSH
T19BE1207894088F7F64B6776CAC688C716AB2013B7BBF68D750B64484055CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\prefs-1.js
Size 12KB
SHA256 f7df4aa186adc6ec67b21a2866b7cd08eaf66dd86af1c0ac323056329262a46a
MD5 20ca2261da2e5e4dbdb71d822009ecc1
SHA1 387ab7694cd37c8ece4d4064a31cc902395eb58a
SHA512 e5d915b7de4a7c8416d250a4ef0b9b4252a9d09965bfaf5830c0549a6d2a03915efe300ecf5cdadadff287c21e4d2a9b9bc214fec68daef597f7e23d0b089358
SSDEEP 192:XbMzYMU1RUfje/5SSAXLRzwkSOBw88IopFMBfMi:yDRjlw3Kd
TLSH
T1AB42CE3C90808B7F24B6327DBC6159B019D542277BBFBCD205F98891485CF6941FAAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\prefs.js
Size 6KB
SHA256 95834c77024d7d642f9eb973c9002bca1d7096fc11c0c66010e5c9032e271bfe
MD5 01473a66ab338523cb0076c153c5e9c3
SHA1 b5e5abff5e09c084f01f199c86402df716fdd680
SHA512 a6179a966274ca598c6d95f213cece177666353628ab1d4514bb09d028648da60a4b8db7f897f28cb4d678f537e64b71460ee0e9100953e48b9abc963baf54ec
SSDEEP 96:xHLUTUhRqGqUfjyq1zSJSSlcdv9j2nTRH0wkysLBw88u8L4cndBOR:B+RUfjyqYSSj90wkZBw88Ri
TLSH
T1CAE1207850088FBF68B6776CAC688C316AB2013B7BBF68D750B64485050CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\prefs.js
Size 7KB
SHA256 b45faebab22190003b3934b7fdc18c3593141bc29af45c3be86b0fd1d411530b
MD5 142bc4a0d24e207d8cca008eef24636b
SHA1 ebbe43a84ed3c2a0491116e4993680b1b6fe5e4f
SHA512 ae39990e2f6ee9ecc9b4b33c3ce90590ee00ab8f1931b07a8cf6562a5aa224db12952dc961d4006a9746b939e2a183242b51fe6264b891caee260cdf07f6cb87
SSDEEP 96:xHLbMzYMUvTUhRqGqUfje/ObzS7SSlcdv9jnnTRH0wkysLBw88Py8L4cnddOR:BbMzYMU1RUfje/5SSA90wkZBw88Bi
TLSH
T1FFF11E789444CB7F64B677BCAC6448315AB2023BBBBF68D750BA4484055CF3841FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\prefs.js
Size 6KB
SHA256 c2d434a6b195f4252b82bcb514344fdb9913ccb0aab64f11a461141b92073787
MD5 60346f92d174e3a0a5fb613b48bb1c1f
SHA1 e0bec169f5ae4c61b7e766cf03acbb18ea1d795d
SHA512 130b9ef546135f1ad4ffd778c44f158266663672ec6ac9a06f22c4c4166346a8113901ae6222a1f911510f324c75123b9fec7b4f67618d57214879f97a2bc1df
SSDEEP 96:xHLUTUhRqGqUfje/ObzS7SSlcdv9jnnTRH0wkysLBw88u8L4cndBOR:B+RUfje/5SSA90wkZBw88Ri
TLSH
T1E7E1207895088F7F68B6776CAC688C316AB2013B7BBF68D750B64484055CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 3cca1fa97eacafae650655f1e26dc60613226866ddc688f3c411717b38937412
MD5 4f6381fcd84124a1c79cd951b42889ef
SHA1 468e5ac8ffed4ff5e0b59dd22f8bb9e1c306298f
SHA512 c281f2747a78a826762cf79b54967ebcfffe2732458df271838b0c3b363ac5138e2faf7f79aba5779615870c0ab48e11cc28d79660d1f66eb6cb112c505a4872
SSDEEP 96:dpfz9/OR94r947eW9jILA0NjoB8kMJttn0YJZQ6jK:bJ/S94cOnNcB85JttnTZ3K
TLSH
T168917C42371B29A3BE5B59DFEE098CF24060351A44C188E890CF7E25B62BB4B3855475
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 89cb3f8b2df8df3ea91acbed11d913a78297bec20f6a5c2ec10776a6f54ef4fd
MD5 82369ed8657252b1ef7ffc2ed7950b80
SHA1 0154764f88f734aae5adc682454802e98f026ddb
SHA512 cd99f32cb6587c5aecd2a850a99f198ef919cce92c624e19d6f247c179779013ea4427a1e1d4e8c57940a5af183a953b3e9a919e427f920531d52e80aa82a6c3
SSDEEP 96:dpfz9/OR94r940eW9jILA0NjoB8kMJttn0YJZQG0K:bJ/S94rOnNcB85JttnTZaK
TLSH
T17E917C02370B39A3BE5B499FEE498CF240A0351A44C188EC50CF7E25B62B74B3855475
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads