a0f687a92d02dddb50b3ade7c9273660088fbd46037be5b609dd57d85d905996

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 01:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Size 5.8MB
Sample260723-ccf7qafb49
SHA256 a0f687a92d02dddb50b3ade7c9273660088fbd46037be5b609dd57d85d905996
MD5 3699f8f804284d31c8e17fe84c4c9c60
SHA1 c518b0066d7a93c22bb18d0a7889133150609416
SHA512 fbe8699643436068d5897fa1fc9ecadf79d6d6fa588ba447fc1442fc99b707400d0992b26115cd9d5e2db4c5b379ea78035c5627e7114a75313ccff6f3db9f31
SSDEEP 98304:tYXCdr6aF5j5kbb3DX0P4Z9zqAM18frP3wbzWFimaI7dloI2a:7rX5ebbTXrZgbzWFimaI7dlT
TLSH
T11F569D52BF8C817AC95A11310B2DAF2A542AFC64773465D3B2743E7EEC753C12C3A61A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery persistence phishing spyware stealer trojan

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe /onboot"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_271117558\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1860006194\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1860006194\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6796	1420	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2472	msedge.exe

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 22 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Low Rights	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292453974664609"	msedge.exe

Modifies registry class 18 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Model = "203"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Therad = "1"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{17A74521-63BF-4867-9010-C173B177DDF2}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	1420	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Token: SeDebugPrivilege	1012	firefox.exe
Token: SeDebugPrivilege	1012	firefox.exe
Token: SeDebugPrivilege	1012	firefox.exe
Token: SeDebugPrivilege	1012	firefox.exe
Token: SeDebugPrivilege	1012	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
1012	firefox.exe
1012	firefox.exe
1012	firefox.exe
1012	firefox.exe
1012	firefox.exe
1012	firefox.exe
1420	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
4456	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1420	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1420	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
1420	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
1420	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
1012	firefox.exe
1420	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
1420	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
1420	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
1420	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 696	1420	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe	89
PID 1420 wrote to memory of 1268	1420	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe	90
PID 1268 wrote to memory of 1012	1268	firefox.exe	91
PID 1268 wrote to memory of 1012	1268	firefox.exe	91
PID 1012 wrote to memory of 5252	1012	firefox.exe	92
PID 1012 wrote to memory of 5252	1012	firefox.exe	92
PID 1012 wrote to memory of 5252	1012	firefox.exe	92
PID 1012 wrote to memory of 3584	1012	firefox.exe	93
PID 1012 wrote to memory of 3584	1012	firefox.exe	93
PID 1012 wrote to memory of 3584	1012	firefox.exe	93
PID 1012 wrote to memory of 3584	1012	firefox.exe	93
PID 1012 wrote to memory of 4500	1012	firefox.exe	94
PID 1012 wrote to memory of 4500	1012	firefox.exe	94
PID 1012 wrote to memory of 4500	1012	firefox.exe	94
PID 1012 wrote to memory of 4500	1012	firefox.exe	94
PID 1012 wrote to memory of 4980	1012	firefox.exe	95
PID 1012 wrote to memory of 4980	1012	firefox.exe	95
PID 1012 wrote to memory of 4980	1012	firefox.exe	95
PID 1012 wrote to memory of 3020	1012	firefox.exe	96
PID 1012 wrote to memory of 3020	1012	firefox.exe	96
PID 1012 wrote to memory of 3020	1012	firefox.exe	96
PID 1012 wrote to memory of 3020	1012	firefox.exe	96
PID 1012 wrote to memory of 5304	1012	firefox.exe	97
PID 1012 wrote to memory of 5304	1012	firefox.exe	97
PID 1012 wrote to memory of 5304	1012	firefox.exe	97
PID 1012 wrote to memory of 5304	1012	firefox.exe	97
PID 1012 wrote to memory of 712	1012	firefox.exe	98
PID 1012 wrote to memory of 712	1012	firefox.exe	98
PID 1012 wrote to memory of 712	1012	firefox.exe	98
PID 1012 wrote to memory of 712	1012	firefox.exe	98
PID 1012 wrote to memory of 5400	1012	firefox.exe	99
PID 1012 wrote to memory of 5400	1012	firefox.exe	99
PID 1012 wrote to memory of 5400	1012	firefox.exe	99
PID 1012 wrote to memory of 5400	1012	firefox.exe	99
PID 1012 wrote to memory of 3880	1012	firefox.exe	100
PID 1012 wrote to memory of 3880	1012	firefox.exe	100
PID 1012 wrote to memory of 3880	1012	firefox.exe	100
PID 1012 wrote to memory of 3880	1012	firefox.exe	100
PID 1012 wrote to memory of 5036	1012	firefox.exe	101
PID 1012 wrote to memory of 5036	1012	firefox.exe	101
PID 1012 wrote to memory of 5036	1012	firefox.exe	101
PID 1012 wrote to memory of 5036	1012	firefox.exe	101
PID 1420 wrote to memory of 4716	1420	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe	102
PID 1420 wrote to memory of 972	1420	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe	103
PID 1420 wrote to memory of 5016	1420	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe	104
PID 1420 wrote to memory of 5044	1420	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe	105
PID 1420 wrote to memory of 4456	1420	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe	108
PID 4456 wrote to memory of 456	4456	msedge.exe	109
PID 4456 wrote to memory of 3412	4456	msedge.exe	111
PID 4456 wrote to memory of 2472	4456	msedge.exe	112
PID 4456 wrote to memory of 3412	4456	msedge.exe	111
PID 4456 wrote to memory of 3412	4456	msedge.exe	111
PID 4456 wrote to memory of 5664	4456	msedge.exe	113
PID 4456 wrote to memory of 5664	4456	msedge.exe	113
PID 4456 wrote to memory of 5648	4456	msedge.exe	115
PID 4456 wrote to memory of 3240	4456	msedge.exe	114
PID 4456 wrote to memory of 5648	4456	msedge.exe	115
PID 4456 wrote to memory of 5648	4456	msedge.exe	115
PID 4456 wrote to memory of 3240	4456	msedge.exe	114
PID 4456 wrote to memory of 3240	4456	msedge.exe	114
PID 4456 wrote to memory of 5900	4456	msedge.exe	116
PID 4456 wrote to memory of 3288	4456	msedge.exe	117
PID 4456 wrote to memory of 5900	4456	msedge.exe	116
PID 4456 wrote to memory of 5900	4456	msedge.exe	116

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Windows\system32\regsvr32.exe
  C:\Windows\Sysnative\regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  PID:696
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1268
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
    3⤵
    - Drops desktop.ini file(s)
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1012
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1932 -prefsLen 27097 -prefMapHandle 1936 -prefMapSize 270279 -ipcHandle 2020 -initialChannelId {7a387fe1-1377-4ec4-9909-2ddec5928343} -parentPid 1012 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1012" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:5252
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2420 -prefsLen 27133 -prefMapHandle 2424 -prefMapSize 270279 -ipcHandle 2432 -initialChannelId {18ab0bf6-b9a2-4d86-9889-a00b7849c2de} -parentPid 1012 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1012" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:3584
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3852 -prefsLen 25164 -prefMapHandle 3856 -prefMapSize 270279 -jsInitHandle 3860 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3868 -initialChannelId {de0e7770-4734-4ad8-b5c9-370d3599843b} -parentPid 1012 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1012" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:4500
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4016 -prefsLen 27274 -prefMapHandle 4020 -prefMapSize 270279 -ipcHandle 4088 -initialChannelId {5315f62a-3cb0-406a-b853-652f61838f66} -parentPid 1012 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1012" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:4980
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4504 -prefsLen 34773 -prefMapHandle 4508 -prefMapSize 270279 -jsInitHandle 4512 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4520 -initialChannelId {41941f0b-ba50-4bec-82a2-77f689cc431b} -parentPid 1012 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1012" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:3020
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4508 -prefsLen 35010 -prefMapHandle 4512 -prefMapSize 270279 -ipcHandle 4956 -initialChannelId {5b3ea1ab-9c0c-4b9d-b75b-99cae659f1ba} -parentPid 1012 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1012" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:5304
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5456 -prefsLen 35062 -prefMapHandle 5460 -prefMapSize 270279 -jsInitHandle 5464 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5472 -initialChannelId {ab7ee8a7-fcbe-4abe-b102-6394cb8218f2} -parentPid 1012 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1012" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:712
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5760 -prefsLen 32952 -prefMapHandle 5764 -prefMapSize 270279 -jsInitHandle 5768 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5744 -initialChannelId {ace057b3-f898-4148-83b2-9014ff39ae13} -parentPid 1012 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1012" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:5400
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5784 -prefsLen 32952 -prefMapHandle 5788 -prefMapSize 270279 -jsInitHandle 5792 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5724 -initialChannelId {7b4248dd-1420-43fe-b68b-2e10d1d67899} -parentPid 1012 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1012" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:3880
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6056 -prefsLen 32952 -prefMapHandle 6060 -prefMapSize 270279 -jsInitHandle 6064 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6072 -initialChannelId {0b8c00e6-20b0-41bb-8d28-a9e606ede119} -parentPid 1012 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1012" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
      4⤵
      Checks processor information in registry
      PID:5036
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4716
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:972
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5016
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.internetdownloadmanager.com/welcome.html?v=643b06
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffcaa41c188,0x7ffcaa41c194,0x7ffcaa41c1a0
    3⤵
    PID:456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,1886922059088586377,11452255883109860547,262144 --field-trial-handle=2244,i,11778886221018014269,5317975514858379163,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
    3⤵
    PID:3412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,13051972101527278973,1877561463152084932,524288 --field-trial-handle=2244,i,11778886221018014269,5317975514858379163,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2412,i,8431721108011755393,13778518622171513357,524288 --field-trial-handle=2244,i,11778886221018014269,5317975514858379163,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:13
    3⤵
    PID:5664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,7967531906247445878,12052211101145439128,2097152 --field-trial-handle=2244,i,11778886221018014269,5317975514858379163,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
    3⤵
    PID:3240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3576,i,14273739543123816980,11995489045995602169,2097152 --field-trial-handle=2244,i,11778886221018014269,5317975514858379163,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
    3⤵
    PID:5648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4288,i,8054060547890628190,3282186624205459747,2097152 --field-trial-handle=2244,i,11778886221018014269,5317975514858379163,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:1
    3⤵
    PID:5900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,17254045662944622669,6195140849372213232,2097152 --field-trial-handle=2244,i,11778886221018014269,5317975514858379163,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:9
    3⤵
    PID:3288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,14364197584332100499,6799207231771948432,524288 --field-trial-handle=2244,i,11778886221018014269,5317975514858379163,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
    3⤵
    PID:3708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,12184569706718819717,8345978960922343253,524288 --field-trial-handle=2244,i,11778886221018014269,5317975514858379163,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
    3⤵
    PID:6372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,16776179528386068562,17527154955321082626,524288 --field-trial-handle=2244,i,11778886221018014269,5317975514858379163,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
    3⤵
    PID:6364
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,10725406506989628179,558249848268293482,524288 --field-trial-handle=2244,i,11778886221018014269,5317975514858379163,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
    3⤵
    PID:6584
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,10725406506989628179,558249848268293482,524288 --field-trial-handle=2244,i,11778886221018014269,5317975514858379163,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
    3⤵
    PID:6608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,10936363580610911831,11299608121428623840,524288 --field-trial-handle=2244,i,11778886221018014269,5317975514858379163,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
    3⤵
    PID:6836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,15024501281466060994,7747020671351973660,524288 --field-trial-handle=2244,i,11778886221018014269,5317975514858379163,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
    3⤵
    PID:7092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,2341309240970409149,6909757056057330785,524288 --field-trial-handle=2244,i,11778886221018014269,5317975514858379163,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:14
    3⤵
    PID:6884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,6133961634956816309,8579654742045493580,524288 --field-trial-handle=2244,i,11778886221018014269,5317975514858379163,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
    3⤵
    PID:6944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,8164675289602710033,14731938255707986726,524288 --field-trial-handle=2244,i,11778886221018014269,5317975514858379163,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:14
    3⤵
    PID:6668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3228,i,3034178133447955537,6973022168913446640,524288 --field-trial-handle=2244,i,11778886221018014269,5317975514858379163,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:14
    3⤵
    PID:6684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,12684418352495775715,17593184820894540198,524288 --field-trial-handle=2244,i,11778886221018014269,5317975514858379163,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:14
    3⤵
    PID:5864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,6358930309236848730,9007765526701824920,524288 --field-trial-handle=2244,i,11778886221018014269,5317975514858379163,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:14
    3⤵
    PID:7164
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 1464
  2⤵
  - Program crash
  PID:6796

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1420 -ip 1420
1⤵
PID:6768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 e2a1acac0fd273b8f37ec83b5ffc317556c2b2cff413c4df93f5367c7d8b948c
MD5 10d4251b9936499d79207f09f6a64d89
SHA1 6d211108747887e584ef75ba02af754edd25430c
SHA512 831e52f0de065b499a84de05c7dbe099b04af2ab9b48754b4a1473b958fa7fbd29c8c4401851ae1569de638b961cae80274bfc2fb4735679ed511a98ec453865
TLSH
T12151CBC49363E4F2CB74C8732EED58583B72AD7E05871EB290AAE879B81E36C5311250
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a254c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a254c.TMP
Size 2KB
SHA256 97229edc020fa2b3e2c23b6e7c8e836257ce90d18ff9d587c3c4ac373adb1fb8
MD5 c293eab27b5bf76d6059ba085e970676
SHA1 cacb1bba9915b399ad8ac21e7faa978fc9a25340
SHA512 11a84b8d1b074719e0b149b191028e16d64836de325cad86eca16f2ff82778e6b82a56f316df70a79c33c786149165125f679f6c37bf75509891bdd2f2afc23a
TLSH
T1C651B9C49363E5F2DF74C8732EEC49583B76AD7E00871EB290AAE979B81E36C5311250
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4591a033758038d5b647fe7020dc5079066388ef9b5bac1ecbc461ab83f2d233
MD5 243028361a447514e2ca18490f269d73
SHA1 a7c56b2a0168e7300fac20bc8c65122d7f431e29
SHA512 bf1c96d8a1d178807347227a5e79396bb0378210f5bc1d88335ec57ddbb52041303787b55d2efbb7f56a83cedf565fb0c1ffe086fc180b8f05385e1c9e49637b
TLSH
T10D51AEF7C3F8852D890196F0AA187E1FCE2D0914832C7D5AC9E4AF5B93E24B1E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 318bed056a14c2b9b506b125781541386dde1a8cf92cb6208319508c2794f3e5
MD5 e805ebd0e7dd09adbfb69976e22504c5
SHA1 786458221b4b436f3ad00cc32eaa5d00104e510c
SHA512 1b94cd19b32e2d95b248ca16b629d133fb43823ba6ea2551c67d5e51a59077a0381746b01925c22a057c787c2ad182db7f7831adfca645d9334c0457bdd4c76f
SSDEEP 192:sxRkRmCt/fHsYRVMZZGJDzoA8ppg/g6+WNYY3/YD9I6SDGzlIgVerJ:sxRk/t/fHsY3yU4K/5v/8S8G
TLSH
T17242C75A6A28A93B5CC7D219BB25BF53D2F95032A1D45F48E6FC870C04EB6DD230781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e40628fb138b9144c05573fe72d11ec64ccb267b2b03df2eb24b1a86cd084bdf
MD5 ceb22b83c2a8cca24152d46550ea736e
SHA1 de0a51e4beb963a4eb364e46d3b35ba4ec4e1bc5
SHA512 2d0ecbab93eb462f57297f9d9d560d177e2d3e72a3ccb87a865b9f78466d05b463494cb781b896ad5cee15d2998d09f34f46e7f4a9a94a05cf1cb6c161654e36
SSDEEP 192:sxRPRmCt/fHsKRrMZZGJDzoA8ppg/g6+WNYY3/YD9e6SDGzlIgDjerJ:sxRP/t/fHsKhyU4K/5v/CS8M
TLSH
T1D542C75A6A28993B5CC7E219BB55BF53E2F9503291D01F48A7FC8B0C00EB6DD230781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a148d6ee13498367d6b340445f0de995c38c5d123506774169469e13fbd9872e
MD5 606b254e45fcc5f0003d594c56dfeae2
SHA1 688a3034ce443b1bba8c595d6ba79c677436a76f
SHA512 65d542de67a72d7da656718c35f6347d19758650afb74a0bf0adab68cc03099091abab75f76552053d0f829e32a7b1082434eade7797144a581ccbf260356fde
SSDEEP 192:sxRPRmCt/fHsKRVMZZGJDzoA8ppg/g6+WNYY3/YD9I6SDGzlIgDJerJ:sxRP/t/fHsK3yU4K/5v/8S8e
TLSH
T10842C75A6E28993B5CC7D219BB55BF53D2F95032A1D05F48A6FC8B0C04EB6DD230781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 624f3fa1ef6d5f8fe59e42299551c151d0af78ba72f4beb5f6e14809652c489d
MD5 88a9d32114ff4aa19026a1d8e793d0a9
SHA1 f6d8cdcb9e847984c16b9c097b76b3493f7f9d8a
SHA512 6d0e25791c7d4321cdcdfb2520ba40bd04887e09455afbd6eb6a79a9eb38e36a7e0b87a0b60aaf6ca54d3cd3c1a721be637fe86d5aaf9fa97e4c15893408775f
SSDEEP 768:azfW/L7pLuL7J0Wg/XfHf8F1+UoAYDCx9Tuqh0VfUC9xbog/OVY8Yc16BropPN2u:azfW/dE7J0Wg/XfHfu1jaf8Yy66pPj
TLSH
T16DD2DA7B640CCA7F4F800A9DAD197EDB6DA802CB9698CD5047FE851C02C6BEA52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5ab884.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5ab884.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 73c8b47724ef010427ea50e70c118f94a4738279921e710c4ca3106d50f2e548
MD5 f03d7511be006d42e1e21aaea3a5d523
SHA1 3c54b133d94b4ed728bc471b2aaecd94aa3b9618
SHA512 8aaca9b60eedfc567ab9876b8521222f6419fd9f3a7949506114d2c18a07d1ccb59ce66bdd960bd312befcfdebe4effcaea97a289f0729f276e24c8c2f7a17a8
SSDEEP 384:n3ZcIk38Nho3l/4s/uWZlf8hyEGZjR7BFzby2rEoajo4cdR8eHhVODjYPNDUM5hm:/k3tni09rEnjN3Gac1F5b9MPf
TLSH
T131F2BF7478648EB38CEEE356B5437B53AEE416A385D40F98D6C9AB0D05839EC170B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 4220c73280a26bc2be1ccf5a8fc4772fd00d2ca856f3941d7db25a16affa3b76
MD5 4000e06acff60931bca3f42c2be35066
SHA1 577775edf6c8555b338b3918b43d05a4056be90e
SHA512 fb747e228ad4a656ac4501712dc2fd9f5415d46b0559093152e86e2d9dc2465dcddce7210c99626107cc71a80a1efa7c6e2a25fc245fa9ca6172cee65f8eb8ff
SSDEEP 768:rrv+4UNbdS3Jmi0yrEnjN3Gac1ZbeVH1SCz:rbsbg3uyQnjMawEH1V
TLSH
T12503CF3269A89EB38CEBA3857147B6037FF4125386940BE4C6DD6B0D129B5EC130B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 282fef180309fd944d82a00c1bcfa59d5b058f1e5fafe30ef9512aa5ff5fb8f5
MD5 825af39e3fc6580bf31afdd042b59131
SHA1 28084e2d6089e4a16e055399e2f43ae70974ae89
SHA512 39e1db6fc0bb12f6c7d22546522cfbe079114f18f307b232eda7086c4932702cd75f469c62019bb04dbe50c89d9e7468597bc3aa8d6f8af91c7e0756f768574f
SSDEEP 768:rrv+4UNbdL3vni0FrEnjN3Gac1F5b9MPm:rbsbR3dFQnjMaeb+e
TLSH
T10D13BF307868CEB38CEBE255B1477A537FE416A385D50F98D9C9AB0D05878EC270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 baad0f13565556799e45a97d01bc06bebe2324db89101e5bebddd82fd6dc6b03
MD5 775eccb5b8e78eadc0278b8b8b3341d0
SHA1 302560d7f1b190b4fae9b68b8c3728975755586f
SHA512 4645fcbe0be5402a38447a7ddbf120c6c7a5726fd1fc2d949a54f411367685eccec1808814cb6f496e850323ee5b3bcf0deae7de9ebd6fa7cfbab645b5b4b207
SSDEEP 384:nJZcIk38Nhh3l/4s/uWZlf8hyEGZjR7BFzby2rEoajo4cdR8eHhVODjYPNDUM5hm:Bk3mni09rEnjN3Gac1F5b9MPf
TLSH
T127F2BF747C648EB38CEEE356B5437B53AEE4166385D40F98DAC9AB0D05839EC170B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 fdba66683cc7f9b84c4efe7eab393bea6ad601b334fde2d2676cf00829515133
MD5 a5994cec7720549cf2b16d9e69a0f8e8
SHA1 e5d13898a8bccf14ad31f0d60b45cbf126065bcc
SHA512 b73c6b3bcf58722c06172dfa089192914d7f035e169774c2564e0644f4b440f855905e870ee99f2b3eacd8f05118c4c4bea054e4b8fc99c042cd89d7e06dd648
SSDEEP 384:nviFiZcIL38Nz8TUNTUlIlo3l/49/u4Hfc5yEGZjR7BFsby2rEoajo4cdR8eHhVc:6FQL3IwgtEsQrEnjN3Gac1F5b9MPf
TLSH
T13D1316F598D78A76D8EE9783A37D6E0299FCC163B5984984B7C85D0CCC825BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z75qv1qk.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 15KB
SHA256 62dcf4f5c39f81b485a1406ad13020b3aadbfbc5a54a9d3482ababb523726b2f
MD5 adec901c3a5db3f27c44585b69c007e1
SHA1 c6d6234c0a29a2e04d6191f16f6ab940e251b420
SHA512 d4f369d594591a4878ea165f8a99fcba6ebd20fcc49191dcc6dde808554929e00e68ccc3ca1e44a43d683d1e9c543c76c8687d8a6f23eb12d9a52a6df6c8904a
SSDEEP 384:HwCe7iO024Yldcs3hk2nhfdDE2Ba/rIVy8eIL+sL+W:QqZYldv3hk2nhfS2sDIVy8x+Q+W
TLSH
T13C728DBBCF516C5D19179985C9A953A9DC09F9BBCBF690A608243449CBC4326B0FA08E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z75qv1qk.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 0841002b762d534408a6b8d9a49fa99c4ea1ab665c33bcd5903a995675016b62
MD5 f4036f50f74c186a0ac5117e69bfc91f
SHA1 927cdce9e0651272ab743786628eb9f7cc7895a3
SHA512 fa2e39db9561259fbbb36cebb3e42ca108202bd8c798869e078b9cfb6948875861d3d0af35484b6b63c6b3aa6cc01cb0350a9c62f918cb0af2d866f158dddb97
SSDEEP 1536:jTrlihHPLD/PNsua8jar1bcJASAkOnP02LdS40lLe/xO1/aVu9FjjDWN/IhzsTYn:j3lyFs18jkVIOPdSFZeQt1DWN2jDbZ
TLSH
T1DFA39EF6DFA28D7C64FFD41DAA82853EFD222440B3A73409C963671061CAF787679648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

432f6f36-92d0-4ef9-bea6-66b3e1f378f8.zip

Path C:\Users\Admin\AppData\Local\Temp\432f6f36-92d0-4ef9-bea6-66b3e1f378f8.zip
Size 3.7MB
SHA256 9174664eae8a4dfc6b9a979d3806a8cfb2b1f190b4ff593cd6a9f0dac982de5a
MD5 b3292c00eec8e6afc680c31ed1b34098
SHA1 1101b4667096155117f4b2b49cd77a9435365a3e
SHA512 1499e1a4504683113095c4b61cb8724e10c535989f414a5dbe8fbd6dc0c4e4ce6da701d0008b293fda15dd223222758e968b881d86b04e199c17c6d974be4cbf
SSDEEP 49152:MMtss2HgPnuvfv67p+w0+w0vdChZlaeBDy6hEEy/W4JWwSlRHcS6/2W9a6OtiDI/:Xssh7rmgChHd7y/WSWwcckxoDIG76
TLSH
T1E706F135F25FD60BC9CF83BA850C2FC29C4C4FA680D4E56B6A6A95715CAF1E2DB44843
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4456_1351276384\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\db\data.safe.tmp
Size 34KB
SHA256 15a6e7b7ca58a5b4fc33a369c74127d0a2ab863de5f219196c550798758a1b4b
MD5 acf6fc3e48f454d155fdb829faae2dad
SHA1 1c84141fee4cc90ab3cff39d537b7a624c2a0043
SHA512 e70e7f6449c172cd4748ca9f308ac83a15adc57bb1d052a7b916f04f9458f384ff24c8a1cc79dc69c69b1e382f678023957a0100b175c8fe2bf9d9f3ff651707
SSDEEP 768:IBnoST5Fy2UD0Gcm+u3UDlKqe1SPW/6bvbDbqbZbcb21wRI:IBnoST5FpyUDl3y
TLSH
T1E3F22284EB2E953FD42812BBDCA50B042F79F88959092F573A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\db\data.safe.tmp
Size 34KB
SHA256 bdf684b8e6b52ac9b8f406ac7d986a95c981c6ce8208913fb55afd55451d9790
MD5 002f730ef2b2d932ce1ecaea4e01e573
SHA1 1146809629bc4c659055db51cd87c2ae1b094d69
SHA512 5c0176cdce556b607f028b91359128963165ded0c255ff0733eed0b7af440ef591b844ec9d72b61aa8dc9e0ad17624fbeace2df2e3cd393958bb9cb0607aaffb
SSDEEP 768:x1wRGBnoST5Fy2UD0Gcm+u3UDlKqe1SPW/6bvbDbqbZbcbH:LBnoST5FpyUDl3r
TLSH
T197F22284EB2E953FD42812BBDCA50B042F79F88959192F573A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 d36f935cb2006822c39cb1f1515ac712c7d70bc76db11a8ea76b0ae74d149005
MD5 eb21d5010a1f2c877f0e1a0bd07d69bc
SHA1 594532508887f759a269b952d5799ee7a687f62c
SHA512 f8b3b5a79ad6fbff4a41630594dcba83c5660afe0eb249bf6d33eb2d3cdc0b8cbcc2cb5771d401f19711f7e9ade957a90550cb48e95945e9ccf55c8ba865bbd2
SSDEEP 768:E8tQFjEZrEGcm+uYooGRMIPi+UTbZbhbZbgL1/:pQFjEZ29GHZ
TLSH
T129D2F044EB2E953FD42912BBDCA54B002F79B88958092F573A4C646C6C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 123b29948066cc15179383109936037a9373e3d3f3b4cc5f00efdbe9bbc78e3a
MD5 cd097982a65aa124a34bfd0faf00f92e
SHA1 47b440b13ab5cd09c9f3d1f402d3925fb647f59f
SHA512 76ada414efe470f78341308d673f465d43262f30251a5431e65153de20edecc87d7ebb3bb8bc06c6accf69913fed8247b077780f74d11ad88283467b35d3c36b
SSDEEP 768:x1LQFjEZrEGcm+uYooGRMIPi+UTbZbhbZbg0jI:vQFjEZ29GH9
TLSH
T159D21184EB1E953FD42912BBDCA54B002F79B88958092F973A4C646C6C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\events\events
Size 1KB
SHA256 d95febc6aee6958fc1aa7490f0d4a352d928c822ab0cf9f1b96554a3b6099d03
MD5 bcb61386a71e2ba40a2a26e911a19521
SHA1 62fb49f6470a1cd9abf282a40c5617a9f79f9dd7
SHA512 fdbb3aaf1790070e199e3060fb0d4759209b0efba6f451adc0b889cdec9080dd98bacff3e9db589b32c6af9033ce55b458d9f3b3252dd3c1ac5b56c3897c56fb
TLSH
T150216D5C39B84E6AA8C7F39C7441128E939A4E07085F1C470D52FF8ECE92ED9316A56D
MD5 SHA1 SHA512 TLSH

Submit Download

5f4464c7-1c7a-494e-8de6-20db8a15da59

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\5f4464c7-1c7a-494e-8de6-20db8a15da59
Size 886B
SHA256 db386d392a8f8ba9eb13f7d8544f54ffeae2c610c4f6a1cdb7936024a5b1db10
MD5 b6d998ca244b62dae5f31ff3aaa2b481
SHA1 0684524f4fac4178be9c16405bb62b84d54507bd
SHA512 cc1cbbe3a25200ae1d557b7ea943cd510869cefc2c4aa5070ad97f46a14e9d49b735712356f2ee6e2ac5e2a01e203ded13a613ca6b8dd297a913d7228d5fa223
TLSH
T1EE1104908628B9F28C24934BC4A1B7518BD5702384CA5A087E599E184EAA12B93AA70B
MD5 SHA1 SHA512 TLSH

Submit Download

86e47e3e-b5d0-400d-a2d6-16920320b327

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\86e47e3e-b5d0-400d-a2d6-16920320b327
Size 235B
SHA256 91a0bc7b8ee28fb6757a33d481020d9c1df0c32bf4d8d4e1f03feb1a9df25541
MD5 0a098cad0dbf4e4ce0a3910d0c5919d3
SHA1 da0f642fea45b5adadcc26c328d4438c3ae6432c
SHA512 2cd999580bd60ab60b4c01c82293c94b4a28bc4f95d9ee2af2a26d5aef19704689be9001aa90d1fbef3aec89e6ba10c6f98144c6db77770dded78466297e81e6
TLSH
T139D097C02888675D08240F1BB5B2A9CA308A4C3310A89820CA72813C8EBABC88292816
MD5 SHA1 SHA512 TLSH

Submit Download

a21fb24e-184a-401b-a131-e0fdd2128f3d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\a21fb24e-184a-401b-a131-e0fdd2128f3d
Size 2KB
SHA256 c643ade633662a81898c2496f4d01a0b33c7777979059e4b61dfadbb02e661b8
MD5 fd79f50a7d8536dc60899527dd1f0425
SHA1 3a3a840296a910660c4e588e3d87fffb1ec4ccab
SHA512 49ca5bf0847e026f4c189559086a966f4b45baa61197ff8b6ca89efa6a3823484624f7bbcb7dd505bb5016d3d90b79f739c55ba553a3bfa77a18740c13c7a6fc
TLSH
T1BE41306835B85DB68CCAE54DD49337CFD7609A1304C368832E51EE0C8E8769E237A52A
MD5 SHA1 SHA512 TLSH

Submit Download

a5b9ab09-2512-4b36-8f95-0e021b036c3f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\a5b9ab09-2512-4b36-8f95-0e021b036c3f
Size 235B
SHA256 4eec8d2d837bd28deba4231070bcfde33f1c9c72d0541d4a44dbf8515c550b60
MD5 895f62f25a89f60e5f31b58f0ac10150
SHA1 86482582281b1c930c18fc65cf8a96ad36181e47
SHA512 b5d1fe5c6bbde3c0b92d1339d1e62969c2677ddabf9ddd10b54ca68e08920351d67372cc33c0bb05632c1473d8c2f6068aaaedde51daca3ef491fd41830384fb
TLSH
T1FED097A928E8736C48200F17B0E069E330848C3B5470982296504C36CDB9DC442A589A
MD5 SHA1 SHA512 TLSH

Submit Download

ccfef530-a13b-4c4f-abc4-9cbe65741953

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\datareporting\glean\pending_pings\ccfef530-a13b-4c4f-abc4-9cbe65741953
Size 871B
SHA256 0d366aebce223830a09a0dccc70eee68df9a8248f4aa59ebcc690037e5deb847
MD5 f68fa3ec17bb577c934aef70fc4108dc
SHA1 3bef1ec39539c62fc8dccf015851ba4e06fd0ed6
SHA512 d75be6f8f8b3c273eaaa5585f31d95eacf9bbb45fe326d1d82483deb2192cff8f6d422e0b6764fe384bb1be72c663f6c9cfd1cde50da9ece8f0394ad0bb4483d
TLSH
T1E31100809624B5F2DC78C24F8965375587F4701340CA56083DB5AE144F6E52B93A930B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\extensions.json
Size 16KB
SHA256 b8e2c5a7aa421dcb373fd9b64207c12c67453ebd3f71f6c1552575550838c46c
MD5 880f5eaf64e5ec21647b04188d872447
SHA1 e9a86da7f327e30af3752bddbd8399da3dc834de
SHA512 a5a8e980fddcaf0e37e76933284be8ec48962bb5925e16abcf0b795fccf0f161781b1124f6665449681913cf467920c28e6aaae0d25c00d7b3db24b04004eed8
SSDEEP 384:CkI4vnUmldvO8dhWd94zt96o8L4HTL4PfL4HKL4HZL4Hkd4hg:1I4vRfjXM4H6F4/4r4Y4x4E4m
TLSH
T13D72521545049EB8294FA79AAA367E01C37D433B60845C78F4DD8FC842FB5B902FB66B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\prefs-1.js
Size 7KB
SHA256 2d4df083a8499edfa9b231331bec42df89dd95dc4753c6d9e1967d556e015077
MD5 210ab52ea7f1b075831c03dc96ce90d3
SHA1 d9f074c2de8e31b913019d4ab29311f4b1a2b341
SHA512 15c54d4cac0c4bad7a0497405b6738c444408d8de6bf3e9fed53747db1c4e5068c624df864fcec89ea59df5ae392846d7021f6ae113acdc7589e1ddddaf57d82
SSDEEP 96:xHStTUNqGq1Df5hgObzSdSSlvdv9j/bHFnNeRWReEcSqZJgvBw88DQ8L4cn1VnAx:chR1Df5hgPSSxba8R/jZBw88ZM
TLSH
T110F1FD789004CF7F74B677BCAC6489316AA2023BB7BF68D610B95485055CF3441FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\prefs-1.js
Size 12KB
SHA256 56938f10ddfa78593ac78c3814ea165f4f2ecc46da1c579888779f9852eb075d
MD5 e53ba762f0112e5a0c04f3152ac014c9
SHA1 2674e8e34bca6c837df3d4ef06be06f63588a4f1
SHA512 5b6a591f7d1927797c6e61b4851d9511a90e93b899f0c55414bd95fa0d9c4a241430ed636e4375b5384532aded257298557542142f949f4eb4b88ca29cbfc094
SSDEEP 192:/hR1Df5hgPSSxbaXLR/jSOBw88ufRsjnSbrn6G:pDnRxweJsiLx
TLSH
T18842CB3850408F3F20B3367DAC6559A069A64237B6BFBCD705F8A492045DF6441EABFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\prefs-1.js
Size 6KB
SHA256 da6dcc3b87fb636ae48dd2bf1e011e5a6e3d47dd2c77b9511904f18c98ab873b
MD5 ec19c695e91c387111b9fde2f4046339
SHA1 58f064c6a1c111dba64f7558f43c0256c860d00c
SHA512 d282eb2604ee8166a32d2caebbe8e86c3ec22e677b4cf1b99deba2a74174a01f6a9b9925726cbdefc61303578d986d57e86c6848269b27495c5edb66d659c846
SSDEEP 96:xHSUTUNqGq1DfGhg1zSdSSlvdv9j/bHFnNeRHIcSqZJghBw88u8L4cn1VnAx:cgR1DfGhg0SSxba9IjzBw88jM
TLSH
T1FFE1207894088F7F74B677ACAC6888316AB2013BBBBF68D610B554C5054CF3441F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\prefs.js
Size 6KB
SHA256 aec7391a7be8f6b610e88991337326b2e41ddcef83f560bc3c307a4c04674584
MD5 158099c49082faa5a26f00a493e75b01
SHA1 6dd4f77623e08de478d9dd7908afc9c16e5d6f45
SHA512 12e979a309bd977814ec676eec1d8a336bc0a0dc15feccd4e50b5103687aee60be6e010fc22823243038db7afac0ac5592ca918df94e123aff6b07867dbc6055
SSDEEP 96:xHSUTUNqGq1DfG45G1zStISSlvdv9j76nNeRHIcSqZJghBw88u8L4cn1VnAx:cgR1DfG45GYISSVr9IjzBw88jM
TLSH
T1ABE1217890088F7F74B6776CAC6888316AB2013B7BBF68D610B554C4055CF3846F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 a7bba9e2b255ad42e3bae9c64ed482386f52b815405f82fd181aa2abbae567ca
MD5 ea5429bf9a5450bf04bfc4d0d0dab3d0
SHA1 bf3f0358692e3f595aba63723cf8c8d9aad784f5
SHA512 ac7714fd0a61d7040cf13dc32c441029916bbeb7bd730c92e9d8563becae907d7562ee81e015a90067db435e9e7d9ae31794be415b9f676965d2621bc4a3bd80
SSDEEP 96:dQfTJ9y2yeW9jILA0NjoB8kMJttn0YJZQH:A99gOnNcB85JttnTZG
TLSH
T10F918E43370B2857FE47898FEE4A0CF20164304A559054E8A0CF6B27B63BA873598475
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z75qv1qk.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 7d5058e480098107ea19833f03348ff453cc000e7845c15df3aadd04fda23379
MD5 3b799ef7467af77ca839a81b4043eeae
SHA1 d44dacc0e05fac32e29890fb53153e2a749a280b
SHA512 3bdd0e5a2e6e309adb35de490701cedfec6de55b90b1596cfbd04ee572dc7a9743953117f731245d20d15ae048ecf1e440e7b14928c5ae90b6868d2968526119
SSDEEP 96:dQfTJ9y2leW9jILA0NjoB8kMJttn0YJZQ+:A99fOnNcB85JttnTZP
TLSH
T14F918D43370B282BFE478E8FEE4A0CF20164304A559054E8A0CF6B27B63BA8734984B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads