Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/07/2026, 02:45
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
29 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
35 signatures
150 seconds
General
- Target 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe
- Size 6.3MB
- Sample260727-c8243avtcs
- SHA256 bb9be908b549bbfbeec9bf1980379f4b1ddc3a8ed6b20413b41b5febbde13aaa
- MD5 8f8fcf710ce4c3ec6e8be1647d6a7aea
- SHA1 d50d2f081a60b831ad7f9fa19d344eb59290f4af
- SHA512 bc4c1bdf2eb9afe154053d8607ebe8d763f2f183f0cb24bfdff608f7fef596cd15e3bce51c6d726a107de7ecc713d492471a272a90e6b39f695822b6c1f74d84
- SSDEEP 98304:LT5Xr0uj5ZLdjlcP4bjX18frP3wbzWFimaI7dloDEuFJ8yHe:L6uj5ZL9lHjwgbzWFimaI7dlwV0y
- TLSH T16166BE61BF8C817AD94A1171472DAF2A102DBDA4773865D3B2B43E7EEC713C12C3961A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 3 IoCs
resource yara_rule behavioral2/memory/5164-8-0x0000000000400000-0x0000000000A58000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5164-74-0x0000000000400000-0x0000000000A58000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5164-1260-0x0000000000400000-0x0000000000A58000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers - Detects executables containing SQL queries to confidential data stores. Observed in infostealers 3 IoCs
resource yara_rule behavioral2/memory/5164-8-0x0000000000400000-0x0000000000A58000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/5164-74-0x0000000000400000-0x0000000000A58000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/5164-1260-0x0000000000400000-0x0000000000A58000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore - A potential corporate email address has been identified in the URL: [email protected]
- Executes dropped EXE 23 IoCs
pid Process 5168 elevation_service.exe 2420 elevation_service.exe 4448 maintenanceservice.exe 5464 OSE.EXE 5880 PerceptionSimulationService.exe 5308 perfhost.exe 3852 ReFsDedupSvc.exe 3928 SensorDataService.exe 2688 ssh-agent.exe 3888 AgentService.exe 1776 SearchIndexer.exe 4796 firefox.exe 4776 firefox.exe 4384 firefox.exe 4680 firefox.exe 3620 firefox.exe 4584 firefox.exe 5872 firefox.exe 5036 firefox.exe 3932 firefox.exe 2880 firefox.exe 6088 firefox.exe 1264 firefox.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe /onboot" 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe - Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA firefox.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe - Drops desktop.ini file(s) 3 IoCs
description ioc Process File opened for modification C:\Users\Admin\Documents\desktop.ini firefox.exe File opened for modification C:\Users\Public\desktop.ini firefox.exe File opened for modification C:\Users\Public\Documents\desktop.ini firefox.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe - Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe - System Binary Proxy Execution: Verclsid 1 TTPs 1 IoCs
Adversaries may abuse Verclsid to proxy execution of malicious code.
pid Process 3876 verclsid.exe - Drops file in System32 directory 58 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe OSE.EXE File opened for modification C:\Windows\System32\snmptrap.exe 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Windows\system32\locator.exe OSE.EXE File opened for modification C:\Windows\system32\msiexec.exe 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe OSE.EXE File opened for modification C:\Windows\System32\vds.exe OSE.EXE File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe OSE.EXE File opened for modification C:\Windows\system32\TieringEngineService.exe OSE.EXE File opened for modification C:\Windows\system32\vssvc.exe OSE.EXE File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\6c1193435387db0e.bin elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Windows\System32\vds.exe 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe OSE.EXE File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Windows\System32\GameInputSvc.exe OSE.EXE File opened for modification C:\Windows\System32\msdtc.exe OSE.EXE File opened for modification C:\Windows\system32\msiexec.exe OSE.EXE File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe OSE.EXE File opened for modification C:\Windows\System32\alg.exe 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe OSE.EXE File opened for modification C:\Windows\system32\dllhost.exe OSE.EXE File opened for modification C:\Windows\system32\locator.exe 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe OSE.EXE File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe OSE.EXE File opened for modification C:\Windows\system32\dllhost.exe 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe OSE.EXE File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe OSE.EXE File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe OSE.EXE File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe elevation_service.exe File opened for modification C:\Program Files\Windows Defender\NisSrv.exe 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE OSE.EXE File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe OSE.EXE File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe OSE.EXE File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe OSE.EXE File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe OSE.EXE File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe OSE.EXE File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe OSE.EXE File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe OSE.EXE File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe OSE.EXE File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe OSE.EXE File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe OSE.EXE File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe OSE.EXE File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe OSE.EXE File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe OSE.EXE File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe OSE.EXE File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe OSE.EXE File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe OSE.EXE File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe OSE.EXE File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe OSE.EXE File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe OSE.EXE File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe elevation_service.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\sr\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\sw\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\ja\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\lo\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\af\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\es_419\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\gl\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\am\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\gu\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\ar\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\sk\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\sv\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\zh_CN\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\hu\messages.json msedge.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\si\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\zh_HK\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\th\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\ro\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\is\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\or\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\mr\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\kk\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_1350999542\manifest.json msedge.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe OSE.EXE File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\el\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\tr\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\fil\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\ka\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\sl\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\iw\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\dasherSettingSchema.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\pt_PT\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\kn\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\mk\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\128.png msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\nl\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\hr\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\ru\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\uk\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\service_worker_bin_prod.js msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\pl\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\no\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\zu\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\id\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\ur\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\ms\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\et\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\eu\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\as\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\hy\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\fr\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\fa\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\lv\messages.json msedge.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\en_US\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\sq\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\en_CA\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\km\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\page_embed_script.js msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\bn\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\en\messages.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3548_2134771704\_locales\mn\messages.json msedge.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
pid pid_target Process procid_target 6496 5164 WerFault.exe 88 - System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 3320 msedge.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe - Checks processor information in registry 2 TTPs 23 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Modifies Control Panel 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Control Panel\Colors firefox.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm" 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4} 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3" 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006} 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe" 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Low Rights 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe" 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe" 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3" 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A} 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3" 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243" 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bcb96912721ddd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator." SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002e587150721ddd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e8e59713721ddd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers." SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004eb99550721ddd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000070943112721ddd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator" SearchProtocolHost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2 SearchProtocolHost.exe - Modifies registry class 19 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3986082593-3624157295-3514260330-1000\{9073A64C-C791-4257-ACBD-3A6F47526DEF} msedge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ firefox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter" 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Therad = "1" 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe" 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User" 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1" 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\WOW6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D} 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD} 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan" 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Model = "207" 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe - Suspicious behavior: EnumeratesProcesses 44 IoCs
pid Process 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe 5168 elevation_service.exe 5168 elevation_service.exe 5168 elevation_service.exe 5168 elevation_service.exe 5168 elevation_service.exe 5168 elevation_service.exe 5168 elevation_service.exe 5464 OSE.EXE 5464 OSE.EXE 5464 OSE.EXE 5464 OSE.EXE 5464 OSE.EXE 5464 OSE.EXE 5464 OSE.EXE - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 812 Process not Found 812 Process not Found - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe 3548 msedge.exe - Suspicious use of AdjustPrivilegeToken 27 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe Token: SeRestorePrivilege 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe Token: SeAssignPrimaryTokenPrivilege 3888 AgentService.exe Token: SeBackupPrivilege 3852 ReFsDedupSvc.exe Token: SeRestorePrivilege 3852 ReFsDedupSvc.exe Token: SeBackupPrivilege 3852 ReFsDedupSvc.exe Token: SeRestorePrivilege 3852 ReFsDedupSvc.exe Token: SeBackupPrivilege 3852 ReFsDedupSvc.exe Token: SeRestorePrivilege 3852 ReFsDedupSvc.exe Token: SeBackupPrivilege 3852 ReFsDedupSvc.exe Token: SeRestorePrivilege 3852 ReFsDedupSvc.exe Token: SeBackupPrivilege 3852 ReFsDedupSvc.exe Token: SeRestorePrivilege 3852 ReFsDedupSvc.exe Token: 33 1776 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 1776 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1776 SearchIndexer.exe Token: SeDebugPrivilege 4776 firefox.exe Token: SeDebugPrivilege 4776 firefox.exe Token: SeDebugPrivilege 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe Token: SeDebugPrivilege 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe Token: SeDebugPrivilege 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe Token: SeDebugPrivilege 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe Token: SeDebugPrivilege 5168 elevation_service.exe Token: SeDebugPrivilege 4776 firefox.exe Token: SeDebugPrivilege 4776 firefox.exe Token: SeDebugPrivilege 4776 firefox.exe Token: SeDebugPrivilege 5464 OSE.EXE - Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 4776 firefox.exe 4776 firefox.exe 4776 firefox.exe 4776 firefox.exe 4776 firefox.exe 4776 firefox.exe 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe 3548 msedge.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe - Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe 4776 firefox.exe 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1776 wrote to memory of 4880 1776 SearchIndexer.exe 100 PID 5164 wrote to memory of 2504 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe 101 PID 1776 wrote to memory of 1268 1776 SearchIndexer.exe 102 PID 5164 wrote to memory of 4796 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe 103 PID 4796 wrote to memory of 4776 4796 firefox.exe 104 PID 4796 wrote to memory of 4776 4796 firefox.exe 104 PID 4776 wrote to memory of 4384 4776 firefox.exe 105 PID 4776 wrote to memory of 4384 4776 firefox.exe 105 PID 4776 wrote to memory of 4384 4776 firefox.exe 105 PID 4776 wrote to memory of 4680 4776 firefox.exe 106 PID 4776 wrote to memory of 4680 4776 firefox.exe 106 PID 4776 wrote to memory of 4680 4776 firefox.exe 106 PID 4776 wrote to memory of 4680 4776 firefox.exe 106 PID 4776 wrote to memory of 3620 4776 firefox.exe 107 PID 4776 wrote to memory of 3620 4776 firefox.exe 107 PID 4776 wrote to memory of 3620 4776 firefox.exe 107 PID 4776 wrote to memory of 3620 4776 firefox.exe 107 PID 4776 wrote to memory of 4584 4776 firefox.exe 108 PID 4776 wrote to memory of 4584 4776 firefox.exe 108 PID 4776 wrote to memory of 4584 4776 firefox.exe 108 PID 4776 wrote to memory of 5872 4776 firefox.exe 109 PID 4776 wrote to memory of 5872 4776 firefox.exe 109 PID 4776 wrote to memory of 5872 4776 firefox.exe 109 PID 4776 wrote to memory of 5872 4776 firefox.exe 109 PID 4776 wrote to memory of 5036 4776 firefox.exe 110 PID 4776 wrote to memory of 5036 4776 firefox.exe 110 PID 4776 wrote to memory of 5036 4776 firefox.exe 110 PID 4776 wrote to memory of 5036 4776 firefox.exe 110 PID 4776 wrote to memory of 3932 4776 firefox.exe 111 PID 4776 wrote to memory of 3932 4776 firefox.exe 111 PID 4776 wrote to memory of 3932 4776 firefox.exe 111 PID 4776 wrote to memory of 3932 4776 firefox.exe 111 PID 4776 wrote to memory of 2880 4776 firefox.exe 112 PID 4776 wrote to memory of 2880 4776 firefox.exe 112 PID 4776 wrote to memory of 2880 4776 firefox.exe 112 PID 4776 wrote to memory of 2880 4776 firefox.exe 112 PID 4776 wrote to memory of 6088 4776 firefox.exe 113 PID 4776 wrote to memory of 6088 4776 firefox.exe 113 PID 4776 wrote to memory of 6088 4776 firefox.exe 113 PID 4776 wrote to memory of 6088 4776 firefox.exe 113 PID 4776 wrote to memory of 1264 4776 firefox.exe 114 PID 4776 wrote to memory of 1264 4776 firefox.exe 114 PID 4776 wrote to memory of 1264 4776 firefox.exe 114 PID 4776 wrote to memory of 1264 4776 firefox.exe 114 PID 1776 wrote to memory of 4412 1776 SearchIndexer.exe 115 PID 1776 wrote to memory of 5536 1776 SearchIndexer.exe 116 PID 5164 wrote to memory of 2656 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe 117 PID 5164 wrote to memory of 3832 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe 119 PID 5164 wrote to memory of 5580 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe 120 PID 5164 wrote to memory of 1240 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe 150 PID 5164 wrote to memory of 3548 5164 2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe 123 PID 3548 wrote to memory of 4740 3548 msedge.exe 124 PID 3548 wrote to memory of 6136 3548 msedge.exe 125 PID 3548 wrote to memory of 3320 3548 msedge.exe 126 PID 3548 wrote to memory of 6136 3548 msedge.exe 125 PID 3548 wrote to memory of 6136 3548 msedge.exe 125 PID 3548 wrote to memory of 2096 3548 msedge.exe 127 PID 3548 wrote to memory of 2096 3548 msedge.exe 127 PID 3548 wrote to memory of 1492 3548 msedge.exe 139 PID 3548 wrote to memory of 3064 3548 msedge.exe 128 PID 3548 wrote to memory of 1492 3548 msedge.exe 139 PID 3548 wrote to memory of 1492 3548 msedge.exe 139 PID 3548 wrote to memory of 3064 3548 msedge.exe 128 PID 3548 wrote to memory of 3064 3548 msedge.exe 128 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-27_8f8fcf710ce4c3ec6e8be1647d6a7aea_darkgate_elex_glassworm_remcos_stop.exe"1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5164 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:2504
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies Control Panel
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2012 -prefsLen 27097 -prefMapHandle 2016 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {d8bf0b35-c0d8-4ded-8a0d-255f760238e3} -parentPid 4776 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4776" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu4⤵
- Executes dropped EXE
PID:4384
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2484 -prefsLen 27133 -prefMapHandle 2488 -prefMapSize 270279 -ipcHandle 2492 -initialChannelId {88149cf4-4d05-41ba-ad78-a5b77889e4db} -parentPid 4776 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4776" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket4⤵
- Executes dropped EXE
PID:4680
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4000 -prefsLen 25164 -prefMapHandle 4004 -prefMapSize 270279 -jsInitHandle 4008 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4016 -initialChannelId {4765b7ae-2a70-4923-b839-977e10a7370e} -parentPid 4776 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4776" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab4⤵
- Executes dropped EXE
- Checks processor information in registry
PID:3620
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4156 -prefsLen 27274 -prefMapHandle 4160 -prefMapSize 270279 -ipcHandle 4244 -initialChannelId {e3d0fdb6-7987-4a46-a0d9-97e7eddb71f1} -parentPid 4776 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4776" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd4⤵
- Executes dropped EXE
PID:4584
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4548 -prefsLen 34773 -prefMapHandle 4552 -prefMapSize 270279 -jsInitHandle 4556 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3356 -initialChannelId {821bb38a-e847-46e9-836f-68a76929833a} -parentPid 4776 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4776" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab4⤵
- Executes dropped EXE
- Checks processor information in registry
PID:5872
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5088 -prefsLen 34929 -prefMapHandle 5092 -prefMapSize 270279 -ipcHandle 5044 -initialChannelId {4aa386a4-3910-4a05-9e24-96dae37ab8f9} -parentPid 4776 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4776" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility4⤵
- Executes dropped EXE
- Checks processor information in registry
PID:5036
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5456 -prefsLen 35062 -prefMapHandle 5460 -prefMapSize 270279 -jsInitHandle 5464 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5420 -initialChannelId {3d729c39-bbad-4a6d-afdd-d09946b775d4} -parentPid 4776 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4776" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab4⤵
- Executes dropped EXE
- Checks processor information in registry
PID:3932
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5660 -prefsLen 32952 -prefMapHandle 4948 -prefMapSize 270279 -jsInitHandle 5608 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5664 -initialChannelId {944e9894-3048-4c06-bd0a-f95a6f86cb92} -parentPid 4776 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4776" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab4⤵
- Executes dropped EXE
- Checks processor information in registry
PID:2880
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5832 -prefsLen 32952 -prefMapHandle 5836 -prefMapSize 270279 -jsInitHandle 5840 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5856 -initialChannelId {47233c20-792f-40e1-be14-69e7be1fe2cf} -parentPid 4776 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4776" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab4⤵
- Executes dropped EXE
- Checks processor information in registry
PID:6088
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4956 -prefsLen 32952 -prefMapHandle 4892 -prefMapSize 270279 -jsInitHandle 4968 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5848 -initialChannelId {0dbe0de2-b647-40c4-b7f8-0553bd49a3a1} -parentPid 4776 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4776" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab4⤵
- Executes dropped EXE
- Checks processor information in registry
PID:1264
-
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:2656
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:3832
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:5580
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:1240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.internetdownloadmanager.com/welcome.html?v=642b222⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffc40a9c188,0x7ffc40a9c194,0x7ffc40a9c1a03⤵PID:4740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,15858441652334714870,14548693222156288809,262144 --field-trial-handle=2328,i,961357953788424682,2435000236894166076,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:23⤵PID:6136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,2050750094817914005,16877007339840043397,524288 --field-trial-handle=2328,i,961357953788424682,2435000236894166076,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:113⤵
- System Time Discovery
PID:3320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,11096883254118907415,9927133533983655159,524288 --field-trial-handle=2328,i,961357953788424682,2435000236894166076,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:133⤵PID:2096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,4496965196396226446,13305278343260459589,2097152 --field-trial-handle=2328,i,961357953788424682,2435000236894166076,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:13⤵PID:3064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,7695635741997219051,3540706919719046668,2097152 --field-trial-handle=2328,i,961357953788424682,2435000236894166076,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:13⤵PID:1492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4340,i,4454292447480565460,16479784656818304742,2097152 --field-trial-handle=2328,i,961357953788424682,2435000236894166076,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:13⤵PID:6224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4352,i,5262598329215652072,9064404523382440975,2097152 --field-trial-handle=2328,i,961357953788424682,2435000236894166076,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:93⤵PID:6232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,16248408804158185428,10532378865756509398,524288 --field-trial-handle=2328,i,961357953788424682,2435000236894166076,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:143⤵PID:6596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,15456813093388942820,11898485979390940935,524288 --field-trial-handle=2328,i,961357953788424682,2435000236894166076,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:143⤵PID:6848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,17766314859822645524,3623310349667117882,524288 --field-trial-handle=2328,i,961357953788424682,2435000236894166076,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:143⤵PID:6856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,12620543243496514570,14275498324484112992,524288 --field-trial-handle=2328,i,961357953788424682,2435000236894166076,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:143⤵PID:6956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,12620543243496514570,14275498324484112992,524288 --field-trial-handle=2328,i,961357953788424682,2435000236894166076,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:143⤵PID:6964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,13553894243180187751,13484724984380345658,524288 --field-trial-handle=2328,i,961357953788424682,2435000236894166076,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:143⤵PID:1256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,16570453354099687576,1318152137931756121,524288 --field-trial-handle=2328,i,961357953788424682,2435000236894166076,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:143⤵PID:1492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,13766644982447484850,2846111531844514930,524288 --field-trial-handle=2328,i,961357953788424682,2435000236894166076,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:143⤵PID:6500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,13828035063936093580,12154738477036996691,524288 --field-trial-handle=2328,i,961357953788424682,2435000236894166076,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:143⤵PID:6504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6660,i,5998289703100645214,9161689094943226858,524288 --field-trial-handle=2328,i,961357953788424682,2435000236894166076,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:143⤵PID:5964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,8307516674175113609,6611819736852140024,524288 --field-trial-handle=2328,i,961357953788424682,2435000236894166076,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:143⤵PID:2820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4796,i,6905514494189871144,9821467352235623795,524288 --field-trial-handle=2328,i,961357953788424682,2435000236894166076,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:143⤵PID:1240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3804,i,17838126046915364070,5827507072394102960,524288 --field-trial-handle=2328,i,961357953788424682,2435000236894166076,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:143⤵PID:6344
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,2904421379745263797,9517447308860849615,524288 --field-trial-handle=2328,i,961357953788424682,2435000236894166076,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:143⤵PID:6620
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5164 -s 16682⤵
- Program crash
PID:6496
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5168
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2420
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4448
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5464
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:5880
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5308
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3852
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3928
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:2688
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3888
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4880
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:1268
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3032 3028 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:4412
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3052 2988 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:5536
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:6600
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵PID:6796
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 244 -p 5164 -ip 51641⤵PID:1256
-
C:\Windows\system32\verclsid.exe"C:\Windows\system32\verclsid.exe" /S /C {9E175B8B-F52A-11D8-B9A5-505054503030} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x4011⤵
- System Binary Proxy Execution: Verclsid
PID:3876
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 61a6b2017b0620dd209d50f329db16284b274b459e24a13e848b07de50a31402
- MD5 5d363c85f4d42c1c5c15f6ca7df11b45
- SHA1 4bb1e1567f8815950bd8226da622a8b1ec8a1b1b
- SHA512 8507995f7858895ffbb3b7433ee0b107ae224fb2d8ff4bd8b3dfc153bef3c6819ea18ee884ec72ceec6538f18718205356d1d31765b4c37ecf280d586626713a
- SSDEEP 49152:Vb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnquYtO2E8ywqev:r3q6mjB3uFJ8yHe
- TLSH T1A9D59D03F29900E9E069D178D7469133EAA2BC890B34B6DF0790B7552E7BEE49B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 826KB
- SHA256 1e2430e2062716ac89e554eb0ce93bc5c80a986c4f23e6c5c526689d111fcd0d
- MD5 8ca65ac85add778a86021c0bb0f93c05
- SHA1 10a16cd951abc4d55fdc20dcc18f79ed6d8b8d9e
- SHA512 116641db45e5abc2f8df30d5cad649c69a211ff3cbf3c718861453709360a092fe19606b79549c5a077ecfc6bbb3ce2528c5d865b4b031296ecce005994e5c60
- SSDEEP 24576:SXYfDtczAYm2kxUlYtEjedEeQ16ywqmpv:5tcguYtO2E8ywqev
- TLSH T12505012977E508F9ED67823CC8A2C512E633789547A4E7CB03E499690F332D85E3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 7cab6a6c0e1c136b2616f0190330365fa389319d7915023b004aa7a01c89d59e
- MD5 29d384c05edfbd5536c8959bf24b7cae
- SHA1 e380fecfa52dec63ea27c65fc791fedda724528b
- SHA512 1a7d4cc7e04df1025190e2e0b7fd9abd8272c1704d213c7e80c23925bd5a1746cd250ee08d30a1abf123438555cf8128c6be79f365d988deeaa6adeab2f48a37
- SSDEEP 24576:m0Le5ji0hmxhrMfm2kxUlYtEjedEeQ16ywqmpv:mPji0Az9uYtO2E8ywqev
- TLSH T1E235AE16F6748335D073C0B9C5D2A69EE97230861B308ACB4286D77C7E676E6C63A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 0c0425c25d902b124c133c04fe5df5480428c64cab8e1e09e5ce70d73b367e32
- MD5 a1f10e4e752215221881319d9207a1c6
- SHA1 a07c975f5a17e96f63c36f747ef7a5b7d3f36f9c
- SHA512 795c508c4dd49ea7adccaab215a365d1a4f9479d115fde5220005e788b6648d6a77258682d9105f94228905a3a1794e2bd9b0184c80e16cb244225e51b114efb
- SSDEEP 24576:Ca7/ezSC6vUyD/aqgrvWj6q8wyuFm2kxUlYtEjedEeQ16ywqmpv:l/ezSC6vUzPv+HjyBuYtO2E8ywqev
- TLSH T10D755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 50de6414f6cb1a5d7498d0f83378843d401b16adf565e14e82333540c6be0c82
- MD5 1bb21513eb1557934d29246530847226
- SHA1 881f2af7fb5cff2909d24dff184ea64fc64f9bce
- SHA512 b270d2f94d5f94469807bfbb837db66ad309318e6303da59f99b6779dcfe1ccc7f6ec4cea20d14e4139fe2f08619eb3f1af7e55be5aed00f702fab5e644d2ba2
- SSDEEP 24576:rVbqPb88hv/l+Bkm2kxUlYtEjedEeQ16ywqmpv:rVO88hXl+duYtO2E8ywqev
- TLSH T115559E66F5748331D073C0BAC4D2AA9AEE3234425B31CACB1246D76C2E677E6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 582KB
- SHA256 51d9cbc1f200c555eaf286c9aef1ae1d42198361f7c45daa08263137f146c30c
- MD5 8836b8080fb4c18af49fd6d386270faa
- SHA1 9ca13101e3a3414e5757b0292e70737628f06d59
- SHA512 29a0a6cc225cb54c935135a7de501c055d6ade5bb2464672536427f32a7412fde97fb7218ef8a82dc818e7ec6aa8770043beec9d67e8ff7bf8311ad5932ad7bc
- SSDEEP 12288:4G3LAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:4G7m2kxUlYtEjedEeQ16ywqmpv
- TLSH T10FC423C3A6263589F7655E3424FAE96312564CFA34DCD5CBCBD2B75E80BC013D2EA182
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 840KB
- SHA256 9e05c9a4567b1a444d4632802bb00bf0414f64b6442061278b01cd5f60447441
- MD5 bf14db8fe5a603aed09a8b9019c381e5
- SHA1 7d7c1802cf937d04c0b068b3fc91ef06dfdb4606
- SHA512 fa22f020eeba2362ffdcd573b8650afc8ca48d04a8513f8adf54362a8573f8b29827971200bdb454cd7beec0580a894fcbbb78df25e4ceba529d46dc909deeae
- SSDEEP 12288:SeBNUbTVO86UmLAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:SJIUsm2kxUlYtEjedEeQ16ywqmpv
- TLSH T11A05CF7BEE28FCD2C27A8D785A91C600977278704B61A3CBD165C30EDE235E15E7AC25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 a82e0d07edbedaee36a018578c4e5c67ad645ffd0cbdfc8cfcff1716415d76c2
- MD5 e27fb4f14fa39d0ff1a8259aaffc9afa
- SHA1 20d79b25f105bd4294170b1d3d56f258dffcca02
- SHA512 db778ee70aaf52447982ba5dc8a1ac70873b0a188861960ab1109c7de5edc99c5d0bf7bf127f384410a2cc24bc6a774198a6e5382c393e772e60e69e041473ff
- SSDEEP 49152:8QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THd:8QvGAdlCEL8c/WRNw5CAuFJ8yHe
- TLSH T1F9267C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 910KB
- SHA256 e74f0869ab7844317f528412b0254e0ed622be3688660802b51c0e45d76267cf
- MD5 67e0a6526f635a64c95fbe7a7618d7ce
- SHA1 1a3ae73f79f8cf8274e6d4c2d65f2ed6c2b4340d
- SHA512 6a5813b60ff27a23b1bba49c6c6efa3410a7b164ec5566dbf35390bc5051dbcaa6d2bee14ade97ae5f01fb2496868729973a2a66cffe865e092678916f6a3d58
- SSDEEP 12288:lAwSfxL/2Dc3mDLLmt0LDQewsAjALAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1E:GfewsAj6m2kxUlYtEjedEeQ16ywqmpv
- TLSH T1E415E031FE74E036D3BB0DB21B76C716142D79604BA11AC3E3E89E9E49342D26376A17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 a774c12e6ba0192c23fbe174de444180832c8eed2aff8d4ced67e8254d209c41
- MD5 32387f28001c696000bc630a2ad703f8
- SHA1 e0bb46789a442a4984562cadc1e62526075ed553
- SHA512 389495f0eafb3eb21311b762a688d477a7446224c03b10dccbd61c128deee49f2e5ddae9fbe5fcc121bd7c52ffd8df2a02f5331c0abc3fb5d953973c0986bb29
- SSDEEP 196608:JUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHg0y:JUEtQevvqc2W1cpV20I32g7
- TLSH T176474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 6d1133381f41106b3239cbe1b111a107063c029002874413d32f1dd34ceb2da4
- MD5 984bf29a05cf5724a9aa52cf3da58ad2
- SHA1 c25df3c10da97ca80e44ce3c9111adefb7c4001d
- SHA512 745ff20f75d6b7e1e6b7d3a72f81e5a7c984aaf83b008f3cdf974ac7c7a5b78a35a6e35338d1991462ecf3eb07050e40dcc8808d3cf68a8d20bcd1f1ba5b964f
- SSDEEP 49152:+CbRquA/m2yL5zQfFiV+XenmE3/ztuYtO2E8ywqev:zoqtVjnmkuFJ8yHe
- TLSH T1EDD58D0976B8C1E4D1F6C77886A2C647F37178154B34A7EF4266461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 ea57580f59c89fa7e28f55dbb40f21fc1a6372b790260a7b781eb3555794a2c5
- MD5 58fb3228b3206a70207b4794ac2106d4
- SHA1 74b7b2e31a0da263e81d40dfe0edaf08d97c4550
- SHA512 9563775656a4a3b22fa91590f94c9b39d19cb570a1d34f60c76c5d996e752475f8a3517776d7cdd4e2525fa2412b0d2ac3403d05bb93f1b2541902d6631bc231
- SSDEEP 24576:kAhGL6IFoiwtA5l7S535m2kxUlYtEjedEeQ16ywqmpv:kAM5Foiq50uYtO2E8ywqev
- TLSH T13835AD81E7F915D4F5B3AA7899B69171EA76BCAA5E30C20F2150D21F0E33A50DD24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 805KB
- SHA256 c121c3bbd83f0fcaacf3a8ee1cfe29b6ec4aef3147efefed17ec816e274453e0
- MD5 ca91a1d80461441469670cb557396a71
- SHA1 6b021ad8acf903684971e19128aec2063cc4740e
- SHA512 88b1108d4c566a847cf66834d7f01e043daaa8ee0ee0460527d6b13eb6f72ea977edfe3ca0a19bbfb55708899d7055e5ece57cc868cedffcad3943d72f64e27d
- SSDEEP 12288:xmw5HEjsChNEBFgl0WDm+CNLAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/H:swuROW+m2kxUlYtEjedEeQ16ywqmpv
- TLSH T1E705F14676A51CF9E96786388597C132F3F2BC522A24D71F07A0C65B5F37221AE2E720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 656KB
- SHA256 c183832ba652fe6bdc1dbdeac43e4669a933c0cb9d26f456518c9359497a0bcb
- MD5 4eb88d6b7fe72cbbe67cc6753ac383cf
- SHA1 cb14434eb911a270d28c634017548a8b2873c579
- SHA512 e117ea3227ebb2408672e8c0115d6b45931bc2d943a8d5e2f36a7a0560cf1f11ae09e3f8d6988216489a31467d47632678ddea1c72674f3ca6aa3fd01bd1a356
- SSDEEP 12288:OyZ1IywLAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:3Zunm2kxUlYtEjedEeQ16ywqmpv
- TLSH T17BE4128632A430F9F2A3563C98F19602D37278A73374C3CF4695526E5E776D29E39322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 113c3733b9068c1842fc96a9256454334640358defca78799e981100c0f91661
- MD5 9ec5febf45daa936bf67a3c3af89d874
- SHA1 6504c2c0ed3eb7e426139cce07694235bcf9f548
- SHA512 cd4d9a49dfa1709c22c1f478582b823a7e83107e5688d830fd368f6486bc21b4ac3aa9789666a88b129d938b413ab623ee2bbd0258b096d21abdf53caccbe19c
- SSDEEP 49152:e68Qg55nhkeWu7PNU3/9uYtO2E8ywqev:sthTRc/9uFJ8yHe
- TLSH T109B55A33B2F20099D44DE1769F4A873196D27C758FE0E3DB8551720A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 2a6da66fad743d52c1bf67f70580ed40d17626b3816a9efc157bfb39fcfabe99
- MD5 8cf29eefc02258d0181b80f94e8ea319
- SHA1 c24cb1eded931a6cf57c414a5d448b758c5d9dd1
- SHA512 fea8c10f3fe9fba1beba7833215c38e73e9471630dec76005e5c5e70222c881ef90e6c9819a94553748e5db8d7202ffcc5596b7f60730e2b05977f5c64b3200c
- SSDEEP 98304:8y5112gYy5azzVvU69nLKnhZOuFJ8yHe:9LIHRWhN0y
- TLSH T11F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 c383084b602b2422a9039cd3ed570dd3e78aecf79ad83f3e7858930e44cfcef2
- MD5 21939ef6e1e8f6e23561f7e515d2f1ab
- SHA1 cc69136078d1705f2c60d1f9b837b256903a0130
- SHA512 fabbe6222a13833538cfe3d6f0edd977b0114d50505a0b1e61e87cb341999c62ee8a3efb0648045a5ddad4d65539dd14c88e25a8818c7ba6e84f5af22b5aa601
- SSDEEP 49152:kB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glLuYtO2E8ywqev:+u6JmIxd2dLuFJ8yHe
- TLSH T167D59D13F1DA01E8D05ED578974A9233EA62BC490B34B6DF0A9073562E77EE4AB3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\firefox.exe
- Size 1.2MB
- SHA256 77bc27e83ac7157578294d07daf9e4efe1fc20719ab9c540b63c4c7899f9b940
- MD5 a2aeab5cae4be3244499cdacb79aeb34
- SHA1 6c3327d7eb391ab99d946d4cc4d44486026ba2a2
- SHA512 8f1d2a76e6ffb9e3a86e085f5a53365a43edf9b2daf902f06ab54c2e0a367eff76d99665050c0e96167f8ee4cb296b36628d0d717618ceefd9cf9563269d249f
- SSDEEP 24576:lOvG1kQvoNxaqIn4SwpemIwpelzum2kxUlYtEjedEeQ16ywqmpv:0vG1kmoNxaqIn4Zpeapel1uYtO2E8ywf
- TLSH T1AF45D103F38516F8E48AE5749A42D233A5723C880B50A1DF1BE93F2A3D71AD15B7976C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.0MB
- SHA256 a12a883c8d91fb38cfcbba5e09f732eefaa48ac593ef477fdae4f9469c8f86be
- MD5 31bd3580d876145b1992ea75874e3686
- SHA1 07b0aeeaa055736763a24e73846c5e58b59ae26a
- SHA512 69db256dce498702791d8cddac8ab48475d7042a90ef2f0d742e3dd8f18950a5fbecd9aff7b6799c6d8687f3886c0024328e37eea9ac8ee62c4dae3f53e7eca3
- SSDEEP 24576:ffwvzk9RX6wkyAIbm2kxUlYtEjedEeQ16ywqmpv:6MnYIuuYtO2E8ywqev
- TLSH T1F035CF29EBDC04E5E177923C99B7460AF2B178691B71C2CF029A536D0E37ED49E3A710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 b22b3ea853d9086fb0ba038d74efc35d50b82e4e09644d00a5981c79517f77ac
- MD5 11a484417d509b5ce363a02894b0af20
- SHA1 9c312945caa7ebd73a476d004c42c97b05db8eb3
- SHA512 2fc92d64f532d959b8e35889fc9cc270bd7eb1bc0820370b6ecfcf98a1677c5a0a36cff265ab275b848ed3724f12ed8e2d073a7ffca498ea6a0f3f2b5808e235
- SSDEEP 49152:eYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK07uYtO2E8ywqev:BySzPjuFJ8yHe
- TLSH T168067C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 c239dfc1ed1bdddabc26c14ec7350fd915ee2cc4e26545a23be38727805b94f5
- MD5 e3658d2026567388bf96c22c411bfb72
- SHA1 228a451d95d303adabb0bb6cb13275167286dcd5
- SHA512 0f8389a23641d48344bb317bd8aff29d8c7814151060c471f1871cae79f73b3628206936f508147676f51c1b22f4ace3e4a6fc192199c12bdcf017919999110b
- SSDEEP 24576:Y47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYmm2kxUlYtEjedEeQ16ywqmpv:Y47JUQjqirIhCnDHUPfF/LuYtO2E8ywf
- TLSH T1A565AE1EA3EC01D5E1BA927885558A1AEA71742E1F31CACF1270837D6F23ED49F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 700KB
- SHA256 df66037e4c09a6b02d28aa4068b3b12d8dcd12fe097a142b8ebe79e10a0cdbbd
- MD5 7ceef4cc0f0a54df45b26705593db336
- SHA1 843ac4f3b40fc34063be517ba47e3031ed25195f
- SHA512 c8ff2fc0044d9d23c80f0ad3ab0cc1a3d5a7be26d962d311a84c501f43ce2038e697f1bedd979210673ac03a6f40167999f3b948c5551f0dbf6cff636af9608f
- SSDEEP 12288:2psfrLAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:fnm2kxUlYtEjedEeQ16ywqmpv
- TLSH T139E4014AD25812D8D16E6239C7969A41B3333C6693E0D3CB57C0F53E0F7A2919EEA743
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.1MB
- SHA256 20040081e49976abddd18f9ec2ba750d0ecf88fd9c477394d657c19292a4a85f
- MD5 a8040aee49b4af41b1af415cf0df00d5
- SHA1 ebf3bd9e51f1ce24193bf68ba6ba602cc2733c0e
- SHA512 8dadab59d4e976bfde3e4ffe1c99766b07dc609b09bae3889e207368c0c7b7c09e42db490a8fc33649e1f48db31d4255bc35aa8da756adf5e24513906a687ade
- SSDEEP 12288:B3NPfU3fd37kxErqEapWIKth9p0OF1iUFhB1DBjd6Np:B3NnUPd3lJLIChf0K1iUbBhBjd6N
- TLSH T15E450640762BD78FC6A940321E36D6CCA7707D02EE05AF0773C9473F9576668BAE5282
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 333KB
- SHA256 84b39f0ddbe2d578b893736530c706b5fd9a44514bcef876af2c6ad00856e8d8
- MD5 874a489a48c2b5866defa3193cc2691c
- SHA1 07cb644e9ba11a56d67d65412e07f58e3c2bac6c
- SHA512 50f8c8ef12ff34f65f971e8391aaf5092b09f3e4630936e31ce4e1924d32da96d14387e5645bd4350aa4687d7e1f3235c98c8fb778c5b76293ed40c600f8cdf5
- SSDEEP 1536:Lt30tI2lH1HCFkRezM9Qx8G5+Ra9pT93ny985Usd2DQ:LtktI2lHpCeGG07XM8ii2DQ
- TLSH T13574A511B720F31DC4B24073C974D69BEB3CF5139F1286073BC81A6ADCB6296667AB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 18a644ba613d5b4137dabc346f57eca622b6888922eaec751025ab3c0a002fd5
- MD5 5eddc74c05def624cfd47ea0a7e304a5
- SHA1 b5f795fcc3846bb781e66e0373fce119975b2659
- SHA512 1c777d774c154e89b80817ce7344495d83eecf133c36e0ad7c60dd14d76e628697535cc3fc379ca4eeb776f3bea5096f94d0fd76a2394ecd2e52f5ca8dc0053f
- TLSH T133D09B5672455C4CD641343224E55217E3008821654546194353F0768DD668717ABD9A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 da739d58d61b2ac7b5d9bb7ad60982cb15b364d9c7c9297fd0c9719c271cd985
- MD5 2d2e0ac0da9a175b4b6a8be7c9d51cce
- SHA1 ff15c8a5ff11faefae3f7491c7968a2163702b81
- SHA512 0ae78f15909f04e1a81109917b8eeb5b8062a49558d8a40f15c02076b087f36e82b88b329e9d984fc68c62cb15408123b9db7f705f2745bfefc30b5aa2e164e6
- TLSH T1EAD09B5A72455D4CD641343224E55217E3108821754546194253F0768DD668717ABD9E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 2KB
- SHA256 962475b42890ef98b7937277c83219fd0742b659c852a43c380a5c16ee90747c
- MD5 9398245a258337f7de727971df9e03d7
- SHA1 82d13b75bc9231dd74f17d4c7a6d009727a91479
- SHA512 7490995af62bade568a5b94dff8ec3553a4afc0ca3bdf3e335425867c3a9c28aacca909f73782c9d0211ef24125bd037aa66b175c5f5aa6cabdef67a0cc2c32d
- TLSH T1B041C36013741ADEFBA5C9F32FE2BE8833B8D8F9080F6F0050C162F53A0676825617A1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
- Size 70KB
- SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
- MD5 efe54a870e0f5ff28d7e00036b861065
- SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
- SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
- SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
- TLSH T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 18801ecb0a055fc0062b7bbb56428dcf5e26cb38d6a885c6772d66cc4c3d718e
- MD5 8cdfae7eb6cd4d32829f0c2ae9f59a4f
- SHA1 1d640c57b08d73f37bf8d8b383cb250722a232ab
- SHA512 c27102273d88211782fcf1dbb4e396e64a8629366022267422c8d9981d13f874a2c32e3c50bace7f3840c7a980354fdf98dbcb68db2cc1bea777c4d3195e924b
- TLSH T11851BEF7C6E8866EC90156F0AB146E1BDE2D0914832C3D5A88E4AF5BA3E3471D14169F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
- Size 40B
- SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
- MD5 20d4b8fa017a12a108c87f540836e250
- SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
- SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 14KB
- SHA256 bc01804fe8d66812d86bb0e56606ce76a2ecbd1344080a1a369ba8114421f6ce
- MD5 7b6f48545f4fa35b7165f58c320e83e1
- SHA1 c01b735c6d4a9db182a2e42b3e51212c4a5180ce
- SHA512 423faf19071a57d0f824ea158a8db227c8c3a8af88bf4445577a4f804b764e736eb0224c6c88e512e20e770839c24992523439827c86ccfd36a3f5aea3851bae
- SSDEEP 192:sxRRRcyM/jK1Ml8wCB/fLsxkOZ3UTzoA8ppOZ/g6+WNY/z/YE63GGLrIgVRd/UJ:sxRRm8B/fLsxkoBU/5a/WxZY
- TLSH T1F162C7066A34997BDCDBD21DFA51BF53D6F81533E2901E44AAFC8A1C00E66ED221381F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 14KB
- SHA256 7d10a8bbecc7b118a9815dddf70a3f0aa04bc4d87f0ed3f13c5761b20ab0b21d
- MD5 74efa1777f6c1c628c4f3b5426db5b03
- SHA1 081b1ad8b1c9b3c2a8a0ced495e895307044504a
- SHA512 d8811e08972e8e867e6a3f8c43893ac3332da91da958cbd060f0eee554cc133853914ee209d2e294684b4a06f238a4d15ebaf62e59f614a5c141e62bebe9d23f
- SSDEEP 192:sxReRcyM/jK1Ml8wCB/fLsZkOZ3UTzoA8ppOZ/g6+WNY/z/YE63GGLrIgDVRd/UJ:sxRem8B/fLsZkoBU/5a/WxNY
- TLSH T18562D80A6A34997B9CDBD21DFA41BF53D6F81573E2901E44AAFC8A1C00E67DD621381F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 32KB
- SHA256 37a2b8e1e5198bab37265548fa2366b8493ed95208ef1d52c50263f6616328aa
- MD5 63c856c5704ef550aceaeef8126afdee
- SHA1 d221346d4a08cf8f466cd76f7214302783da52cc
- SHA512 fb80a0f443f6a8a6c84b32ed44143fee92fa08019a159a448f34918de2b6d2422be82f1e60703bb98e04685bf266ba0acebef5d5fb7af3a85a1029c9f1111edc
- SSDEEP 768:40D76DrQD8Lo7pLuLfb0DbWgQ6DjfPQDF8F1+UoAYDCx9Tuqh0VfUC9xbog/OVTv:40D76DrQD8LUEfb0DbWgQ6DjfPQDFu1F
- TLSH T1CBE2EC3B680CCB7F4F804ADCEC29BDDA6DA801CB56D8899447EA881C03C67EF55165DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 4KB
- SHA256 b3786dd9f0fecbdb185a2ac07936ec74be10a6b65c0efcbda85c69c49e492470
- MD5 ab9216735c9f5db3dc4265d724932edf
- SHA1 60ceaadbae74d6deaf1fac9eb26e5d026d1dda62
- SHA512 203098c2bdfd5f66b0f440f8b4b8370618cf6ea7a89640cfa74bb14e2335790fcde1a137bbca4069b1090fff80f4393885f53f3297f2d205afce78d7c821d045
- SSDEEP 96:KRdqjXNn7vWj4mgfvK4+gBvcldQzLkHv4dZvtNhW528gBhK4Igvhc3f+BtiHhevj:CdqjXNn7Oj4XfV+gBkldQzLkHv4dZvtR
- TLSH T17B91B354327BC3C0387EA54582B9C46F82C271E27159A53B3BA941959B2BE078DFFCC9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
- Size 22KB
- SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
- MD5 f768bcb451a187c18099961c484eef8b
- SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
- SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
- SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
- TLSH T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5ac9f8.TMP
- Size 3KB
- SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
- MD5 904e6e94a1d46374c8630cfd86cc729f
- SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
- SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
- TLSH T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 35KB
- SHA256 369bb30773a7f7738d465c362c740b08990aaaeb5c32632e043f65f6b2b2c02f
- MD5 ba0a7fbaf9bb0d541a2114ee03c95aa8
- SHA1 dcfdc75ce50f096c4257306de287b729067f2204
- SHA512 24ee61e4e4eec2a3eaa152915197315c7af2a563d627541e79ba02247bad3da6fa0a569a056da3c208d405ffa37d2e851943fafb928e9d4f16cbde38c249339b
- SSDEEP 768:oR3SzlZDTd+ZD00O8gPeX6+qTko0u229a4vsTNb9M2:oR3Sg1MOvVTVKa4Yb+2
- TLSH T1FEF2CF32FC668D7389F6D685B15736936EB521B3C6C80E48E9DDEB0D054326C1F0B826
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 35KB
- SHA256 794f42804c13f7ee0127c4b061536ce00e9022c09bd0fca03168f8927890bbaa
- MD5 3c784d4301eba05daff16f05e8e9c284
- SHA1 d8a6c39f9b27f9b06e578902196b5f5d71b3da00
- SHA512 347a41dc2544c0245be809ffba1d4da5eb9a2a0bffecadb014aba574a67a455526c43cf9039b36f725d993d301a8bed04e656689b3a283c716c7cdbfc35bcfad
- SSDEEP 768:/R3NzpZDTd+ZD00O8g0eX6+qTko0u229a4vsTNb9M2:/R3Ns1MzvVTVKa4Yb+2
- TLSH T1EEF2CF32FC668D7389E6D785B15636936EB521B3C6D80F08E9DDEB0D054326C1F0B82A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 39KB
- SHA256 acd9364629a638f1e04f414acf1d2a902e770232a99cdcefa7540f17ba993c41
- MD5 3cfdb8a80d1a9ad43488ccd9e99300ce
- SHA1 9e6f842e0f257d0d6c206608a99f1dcacfe80f78
- SHA512 cf0f8eb092b31db09ceb0f6ded28b21dcf55d174bd6f164210cb40a1666e106aa3cd7d8898390602d9f94c46700bdda37a8010e88f7e21538cdef2ee59129bc8
- SSDEEP 768:prv+4UNbdG3V0BDTd+ZD00OaeX6+qTko0u229a4vsD4eVH1SdW:pbsbU3R1svVTVKa49EH1h
- TLSH T19103CF32E86989778DE7D784B14B75472FB91163C7C81B80D8ED6B4D028B5AC270BD27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 44KB
- SHA256 6cc64267b2e75fad9c79e3713bbafe55bb2fbf86e010d930e4f89734edfa8fa2
- MD5 e3b1bca61c8f0f770d5749c2a6294d10
- SHA1 58bbea7b6ba736336b70c75214daadc2481d5bff
- SHA512 2cc0b9b77026e2cdd4536feb5c8053fca719e76a56be7e9d3830a26bb55efd09ad8fda97547476adc8324e368178bc78c91f722a2f344129ba1e2cee1c595499
- SSDEEP 768:jlFQQ3xwg3z5SnZD00O8gseX6+qTko0u229a4vsTNb9M2:wQ3nq1M7vVTVKa4Yb+2
- TLSH T16B1338F6A8D38977D8AE8783A33D2D465EBCD163B6884984B7D99D0CCC4217FC70A815
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 132B
- SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
- MD5 f5a3b29f9a977e23d6ca4eb728238f9f
- SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
- SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
- TLSH T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
- Size 153KB
- SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
- MD5 c4a20d073fe58488935da829aae6fa17
- SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
- SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
- SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
- TLSH T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
- Size 132B
- SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
- MD5 ae3a19c226264ff6cb64877f1e7e7243
- SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
- SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
- TLSH T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
- Size 13B
- SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
- MD5 2aa9e263ee3796d9ce358460a2451b4c
- SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
- SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
- Size 15KB
- SHA256 a77d0ce3718f0495accdf780c8fc9bf6d21b6e9c40e18a5f6e77f8df57bce457
- MD5 0e4a086aa79cc662489145908ce10013
- SHA1 5aa8674dfd3857a63cf0e339a601f00b63591e5c
- SHA512 64b91d1691161994c795f006a2c05d2374ae80e6fd25ae8e29440b961fe6b77aa2351e91d817f3c6ab9499d7398e636cb8818094205cd5ee82375f93af489545
- SSDEEP 384:HwCe7iO024YWdcs3hk2nhfdDE2Ba/rIVy8eRZC+lZC+7:QqZYWdv3hk2nhfS2sDIVy85+O+7
- TLSH T1AD728DBFCF516C6D1967D585C8A99369DD05F9ABCFF680A608243449CB84326B0FA0CF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\startupCache\webext.sc.lz4
- Size 104KB
- SHA256 e0353124f21dc5840372687f41c70845716af0831080df687dc5238a4436c344
- MD5 91a1821277422b24c837efddba172957
- SHA1 3bf067afb9cae2c61d78299fef4a272656ff2562
- SHA512 a0e501c30c9bd1e204e3ce44a9ec53cf2951e9da18f6f455953e47768020b01d7b97ddf498a3390bba68cbf0ff45f3e680faaf1bac0906287de3798c10fe4f68
- SSDEEP 1536:jTrliiurZU+/g+VbCcJOwPcfBIcFnyduuRyVe3+0LIPZDiEZ2fPcMjiRdhdqDmnx:j3lMbCc/mBI8leDKiEZ254dSmx
- TLSH T13BA3AFB1DFA3CE3D65FFD02EAB82843EFD662404B3A73009C923675195C6FA46675608
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\46a47be8-b254-4ba4-a3f4-72c4ce4bb3e3.tmp
- Size 1B
- SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
- MD5 5058f1af8388633f609cadb75a75dc9d
- SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
- SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\af44d359-d709-4810-a5a1-9801047d1212.zip
- Size 3.7MB
- SHA256 dd544d48a457b6c12041612325df3c7f9b4c3cd0369ca24cc4f71128e625be98
- MD5 3850f642d336e5b283975359ae18e3d7
- SHA1 3978cd7a6dd7a3e7cd38e17b153e16ec119d7cee
- SHA512 31254b8b9d53e4ea690eda16e079bcd983d40379e410e8078803078ec9a9ab4e168f3b9f7b591dadfda36bbe9c5cae7b8a9570f712af61ef14ccfc47de52a54f
- SSDEEP 49152:7Vv1Dboz1hnoFzgmLWGBR/VvhF62rIydNOW2ytsj6F6Qyla0NPjuO4J/ceo0nw8E:Zv1vgHohhFLGmtsjO6QINNohnw8ZG
- TLSH T15906F175D75C1609C9FF83BA850C2FC2984C4FAE8054A96BEA6AD9715CE33EE1F4484C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3548_834338159\CRX_INSTALL\content_new.js
- Size 10KB
- SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
- MD5 3de1e7d989c232fc1b58f4e32de15d64
- SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
- SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
- SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
- TLSH T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 11KB
- SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
- MD5 25e8156b7f7ca8dad999ee2b93a32b71
- SHA1 db587e9e9559b433cee57435cb97a83963659430
- SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
- SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
- TLSH T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 502KB
- SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
- MD5 e690f995973164fe425f76589b1be2d9
- SHA1 e947c4dad203aab37a003194dddc7980c74fa712
- SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
- SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
- TLSH T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\compatibility.ini
- Size 198B
- SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
- MD5 ce9ef13caa8a74c25157b184aa038475
- SHA1 db03a9935d8bb3ce6b120aca98feade536805160
- SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
- TLSH T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\db\data.safe.tmp
- Size 34KB
- SHA256 2001fa4f8d509e54c7bb197d7ebc13881e2dbfeed01f586da77a7105dfd1caab
- MD5 e3565fa6909005a364053e93bf9cb653
- SHA1 8f5c76d3d6fad837fb6fec2017f76df5a7d93c4d
- SHA512 80f6de7b749af024c2ea600735167702e6ae52dd56434fa916ef1c1f4f1501983005873c7735b9ef1cbdcad7cce3d4e176da732d9a3fe12a07f8744b4f568b2a
- SSDEEP 768:W1tcwBuDw7vhD0Gcm+uvxpKqtOlfoK5RbtbHbObubQbqCQyN:ccwBuDw7/7Wy
- TLSH T11AF21044EB2E953FD42812BBDCA50B042F79F88959192F973A4C64686C872DC3D9E07F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\db\data.safe.tmp
- Size 34KB
- SHA256 5fbd77676ea86a7057e68332ebd86f7059afd4e4d69b5a227452f419e0d860ce
- MD5 1197073d63a588dbbc2ac45eccbaa942
- SHA1 bca013d201010bb33d9968da8407fb8c2b2140b5
- SHA512 aacd1f56ca559d6847879713e515ad6834c2ee40b8e5335002db3239c5259f42ad9eff6c54d14507c2b0d9fb408117558ff3c468c9c2fa18cc8840cf7ec00a78
- SSDEEP 768:Zy/cwBuDw7vhD0Gcm+uvxpKqtOlfoK5RbtbHbObubQbqCN1/:OcwBuDw7/7Ws
- TLSH T18AF21044EB2E953FD42812BBDCA50B042F79F88959192F973A4C64686C872DC3D9E07F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\db\data.safe.tmp
- Size 34KB
- SHA256 7d7a5c265fad009cb8d7e8af8ea0ddea455c05b905b85a02e45f0cbaf6abfdc7
- MD5 0fce606553fa230ca5cb6d090c4042f8
- SHA1 1369aed311e8b2c9dabfb521095ce23b58ada88f
- SHA512 75ecb65ed582ea289619a93b49256da1c1122408884ba5fdb187ee97d5398a6ec2bf1dbf04b9548ef537d9e8bea333eb28f1fa3605477ecae8bba7ea602a6ebe
- SSDEEP 768:ycwBuDw7vhD0Gcm+uvxpKqtOlfoK5RbtbHbObubQbqCN1YyN:ycwBuDw7/7WI
- TLSH T15FF21044EB2E953FD42812BBDCA50B042F79F88959192F973A4C64686C872DC3D9E07F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\db\data.safe.tmp
- Size 34KB
- SHA256 b370b620ed67f6a5f9b535084ab76ceba39306a2d28944d1e230fcd6a188cef0
- MD5 08e25d2157909573942f87e17bddc071
- SHA1 fd57986625609ea5fc98d7cbe236f4a88f47392e
- SHA512 1fed1f1ddcaa762d4d2b1fbb6165852826434ff1c294f57da506b0f056b06c55d56288e4d4bdd10872456a4a412bfe9f5ee6a2ab67819ac1846d9134a680f000
- SSDEEP 768:W1Yy/cwBuDw7vhD0Gcm+uvxpKqtOlfoK5RbtbHbObubQbqCH:wcwBuDw7/7WO
- TLSH T18EF21044EB2E953FD42812BBDCA50B042F79F88959192F973A4C64686C872DC3D9E07F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\db\data.safe.tmp
- Size 29KB
- SHA256 2a4039745ff0d7797391a0031cc4bd104f907b208d668e601bbb14720306cfe5
- MD5 99131676e11ea736a3250c3c4956bc20
- SHA1 6ddae470b90890f26ebf7da6e716e70d173f29a1
- SHA512 b78e042229d39303a17684bfb92153e891a707609d06589b44da6e7e790f1c327b830a4382452f697918a4111c46f3803adc778b81fcbf6dd92fa950bf0ae9eb
- SSDEEP 768:WUWylZcU2jGcm+uxeRzUf/A7bzbObubxs6H1/:WUWgZD9e/b
- TLSH T176D21244EB2E953FD41912BBDCA50B002F79B88998192F673A4C646C6C872DC3D9E07F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\events\events
- Size 1KB
- SHA256 5e6a3960ef139dd2f1133c74ab638417e8100e3b87e12fc1563d7d65ac7c0095
- MD5 ea20cdff184f91d85f13f4eea5d34ca2
- SHA1 2c5a6d52a3909b1e11e5c4a79a0385069ce409b0
- SHA512 887f7fa9a535868f6ee90355796b9f3d0053dde062261d92bff8b19d50c4b88e30f19dd21d25088b843387feaac8cb711e5e643629dbe17d580786bd9873544a
- TLSH T1B221795CB9B88D6E68C7F39C7840428E93554E5B04871C934D12EF8DDED2AD9326E43D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\pending_pings\4e4102c8-2511-4837-b883-078a1811f443
- Size 2KB
- SHA256 6358ffe65794ee4a551ce1417912b46b219fbc17c0ead36e2340158611ff0594
- MD5 ce70dc8c29b3368275b21004eed95c46
- SHA1 4e384023d37fb24a2fcc029b9583d641cbddcd9d
- SHA512 aec93298b0c8c6c9bbf93385d4af39266b5538a738e0c81f7dbb8de01c7032e7c9626453e36f353e15b5dca5bbb989da5e91423edd085f430a4122b679110190
- TLSH T17041535C35B84DB68CCBE19D8491278E97609A4340C32C832D51FF0CCE9669E636B92B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\pending_pings\862c693a-7b9c-4e06-a3b7-1501bc2a163b
- Size 871B
- SHA256 675b4c9bc30cd226864925dbbdfc1faca3d24e7909891c75171a5812879d3643
- MD5 2c21d9b9b0a231ce3459794346b0daea
- SHA1 d416b7f761fc199aa7eeb6daad91d104d122e500
- SHA512 ee783b944f9d224d5e0c6498f9e32146de8f9a1ebb15c99541f120c7ca21a03de30ba271ec51fb9d515ade4474455378bc1c54ebd8797442502228db9b0d3a71
- TLSH T1FA11CC81D675B5F2CC78828B84A57B1787E4B523C0CA44146DA05E184FBE21BEB6B707
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\pending_pings\a9883168-db8c-49e1-af15-92b1784a2566
- Size 886B
- SHA256 2359d1ae1fa39ce9612cf8791eb5937c1ca532e853af1c16ce26759ced601b2b
- MD5 38175f1d27d09ea479429b2f98ad9d34
- SHA1 830488ab3bdc2d73e2a3e4654df9f697910b9811
- SHA512 1084bb1e06f84dedf8b5b632427f0c4712d02e91d02f9e269f98e96a82d3dcd0f301634576bba5ecc048f7a2f2c67dab58051cd2e2b54bd8bab8ec40c9ef8375
- TLSH T166110081C67475F1C868D2C7C8E17B064AE0B123C0C619047E505F184EFA50BA7AB707
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\pending_pings\b7cc7e13-0884-477b-862a-69e45e958bb9
- Size 235B
- SHA256 2e36c7246aeb03e0382334de89e1c32ecf80b4955cfe07f956eaafa8de7770a0
- MD5 536f39c41b17a717f835d5bd002d7452
- SHA1 3a9c6297b10fd309d489f3112860379da379b70b
- SHA512 5810616642cc0a3de3be94710b55f9d0d891fd6527d4fcb2ba864531b443567e959a41f96d3325acf61849173f95d68a34088072ac2682ab5e7147ff5beca5cd
- TLSH T1EED097D12898775C08080F06B0E02AC2B0448C3711645810DAA0457CCAFEEC80221817
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\pending_pings\f6da0fb3-9de5-4028-bc61-78feb8888f6a
- Size 235B
- SHA256 3a522c3cb40f9affa03a5dc2e19a4431952703f40f738534d0318e53341b5db1
- MD5 85059a752d3f3ac4d25b193e60ca23a0
- SHA1 46a9c13586f355234f6198418976c5f38ba21a0e
- SHA512 eff6998fc6b8cab54799a99094fd50edea772ef45d5a308e078586972e21987756cfc84dbb2c6e10782664971c1e4644f6b9830014a3f2567f9c1b9535eff4c3
- TLSH T1F1D097892998631E08404F17F0F0A9C630454C3328709820E56140B8CEFADDB017280B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\extensions.json
- Size 16KB
- SHA256 a63c6304d9a4a899db755d9ac05cefcf7ba6ec2aafa556943317c7a396b69bf2
- MD5 ba741c594b3c8cbd55bad2c978d2d43c
- SHA1 fb2e8c37440f2575d2b77cff33deab8f5a694c60
- SHA512 80b2431ed59cdf450e31ee8b32a45545d1eac555f0fea176f61a93eedfe028398b61f276104b161873f4eb7a4d7283bb2b7a2d05139b2c34ad63b863c42019d1
- SSDEEP 384:fkI4v/Umldv+8dhWn94zc96o/AL4H4L4PmL4H4L4H+L4HeDUG4hQHz:sI4nRfzXa4c6wi464U464k484Y
- TLSH T1ED72421545149EB8294FA78AAA367E01C37D533B60845C78F4DD8FC802FB5B902FB65B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
- Size 1.1MB
- SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
- MD5 626073e8dcf656ac4130e3283c51cbba
- SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
- SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
- SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
- TLSH T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
- Size 116B
- SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
- MD5 ae29912407dfadf0d683982d4fb57293
- SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
- SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
- TLSH T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
- Size 1002B
- SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
- MD5 dcffff15fa618a53834ee4ae8673bd23
- SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
- SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
- TLSH T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
- Size 21.6MB
- SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
- MD5 d14dd3f0107ff91c3e21f301d83f82b0
- SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
- SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
- SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
- TLSH T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\prefs-1.js
- Size 12KB
- SHA256 e2d3b08db1faf0aa8c75a2963e12c3d44ec624d54ad7798f2fed3659d167c295
- MD5 573ac38741a184f40654bf4ef148295f
- SHA1 d542c0de8a3a0658b12c151372a6bbb1b2b1a4f9
- SHA512 164604b3c1bd437b01c91ffbd85a5c8e78d6f6146327daba91237cb31de594fa558f4f3e898c697f9466f07c39decc2402fb00c52bf35f9ee5dff812e07a2bf1
- SSDEEP 192:VbORmfl+YlzSSIKLR2YBkqaJlOBw88CmOl82yo:ZLR2mf9wDUd
- TLSH T18342DF3C9140CF7F24F7B27DAC24497119A1422BB6BFBCE605F99492444DF2481EAAE7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\prefs-1.js
- Size 8KB
- SHA256 dd2bfebf567019698c848a32a98b70179b01c90d346eb6fb2323489a69bb7b20
- MD5 216565899abf122eec96dc2d9f085313
- SHA1 06500b8393592a80bfd655f19fe6accc31c4a23e
- SHA512 37aa4fea62d225cdf6ce89d5d38c6dbf07c62166813a6c29bfa5c3fbbba0b1b0aff39948ff9ce6e14383f72718cd9738d0971d028b6ad088653e8e03d5c230c6
- SSDEEP 96:xHYVTUmDqGqmfl+YObzS3zSSlvdv9ja9nKWRGda9OVAqvqaXZHBw88Wn/8L4cnZr:2bORmfl+YlzSSIbR2YBkqaJHBw887
- TLSH T1D0022F789504CF7F74F6B26CAC64893169B2023BB6BF68D710B94495054CF3442FAAEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\prefs.js
- Size 6KB
- SHA256 762be006a7c92cb93f5decfd2b46ed971ccaf40884e98152f243e0e30eac0bc6
- MD5 c37f3ab7d495c62af10a001f44afe817
- SHA1 7ad30147676ed0c1c184831c0219f06acfbb6500
- SHA512 c1c023788d771b69ff58ac9625a22aadeb21bd24f89aa4d8db9f1341cc9475d7f6b68001da14659808987369c9578d0ce1e9345525817fda52b269fd62d55c34
- SSDEEP 96:xHYUTUmDqGqmfOCs1zSFSSlvdv9janKH5OVAqvqa7Bw88u8L4cnZFs:2WORmfOCsISS35Bkqa7Bw88W
- TLSH T10AE12F789508CF7F74B677ACAC6888316AB2013BBBBF28C650B55484055CF3442F9AE7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\sessionstore-backups\recovery.baklz4
- Size 4KB
- SHA256 d74d493a1d16a6f00e2c7f19402f5fc582a607ad80c596da2b6023aa91f6a880
- MD5 532f84b906bcb3be8242869da9d6c9c9
- SHA1 50ac0149262ef70928501f43fe77070447357305
- SHA512 acceebb9313878efd9d96ac5499dab944343908243ab88962f91ae9c79bacde84ae266a39d7edf7c1313eba88b6b23164f5f346fa56746ece79c016cd95c9a95
- SSDEEP 96:ecfU9rtYQeW9jILA0NjoB8kMJttn0YJZQBsd:7U9eIOnNcB85JttnTZEsd
- TLSH T128915B02360B39A7BA57C5CBAE5A4CA245B0311A589084ECC0CE7B26A72BB0B7559476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\sessionstore-backups\recovery.jsonlz4
- Size 4KB
- SHA256 52f3556ccfada9aa4444e40c5cbfad271d0b36f591f7ec2fc3e9f18729a40976
- MD5 e6e856905356487133ba2fb2f53a3740
- SHA1 d01d9073a03abdd93a9a1c2d53a4b2b599d26821
- SHA512 d2a88a303c00250bc8374d8a4eed8750ba33e07c121a693563a647c3d3223bf7edb3fe9979bbeecae13028294d394154e846b7c6b575c9a2544ce70db1d7c58c
- SSDEEP 96:ecfU9rtwQeW9jILA0NjoB8kMJttn0YJZQBso:7U9yIOnNcB85JttnTZEso
- TLSH T126915B03360B3CA7FE57C5CBAE5A4CA245B0310A589084EC80CE3B26A72BB0B7559475
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 588KB
- SHA256 b6e76ba13d1f0779aa7a2f78ec1b228a3ca07118b5ba80d31175d4acc17263f0
- MD5 483f2443accde901ad857f57f23441a3
- SHA1 d01af250e0d1068911f8a9020c2bef3a1c16082d
- SHA512 8413cbeea3ad161441ba2b07f89f8537e808d410b0a5e014b6f918b6ac1648588c571ab8ca81123e2afe94197f5b3697c5a31dd4341b1f68c2a4c0c3112803b7
- SSDEEP 12288:iM7zLAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:f/m2kxUlYtEjedEeQ16ywqmpv
- TLSH T1BCD42383A65A3949F6755A3010FAD532131E7DFA3B88C0CBE686B25E847C0D3DEF9146
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 c7f76d2ccaa674aba02e28d0cb261a006a823be0b03c543e4b51eedb8bf98bc5
- MD5 2b19a8d7fb02078cf6aa1d2326e76169
- SHA1 cf5d5e95ab207f297579a2a9966e5f8cd3c14e7b
- SHA512 f69d021958ded3370a11f01a835978a22539484cc41a177b1d0b14ac9ee17c67404373c1b5bc085e235fa4e13ac3ae9530c3243ebbb226be718b4c2e590d14ae
- SSDEEP 24576:6gb6bmBIi49WNNFpg1rSvFv7bYFm2kxUlYtEjedEeQ16ywqmpv:6gb4mBIBhGFpuYtO2E8ywqev
- TLSH T1EE65AE1E22EC02F5E0F9D2B89DAA4417D6B278161731D2DF1251423D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.1MB
- SHA256 1f15ccc6532d5a687a335a7011493a04aee6ea0e25e0d2e27aea7174d686842f
- MD5 d9ad05afabfd439fc525f8818f84e446
- SHA1 66b93b5c48986f95c0e5f0fe67eca02cae5ace90
- SHA512 58d185a81897ce6746c16ee79c293c54223a3ad18e86330c177747c6c018632e50168516cd4eda7906881141aa002a17d49332769e659fb955c2b1f2fe75ae7f
- SSDEEP 24576:YG88u8FpJqH1vzria7/mWm2kxUlYtEjedEeQ16ywqmpv:b7ZFPqVya7/ouYtO2E8ywqev
- TLSH T1DB35016576E101F0E47BD13889824663F2B2B8251364EBDF07A88B551F33AE54B7FB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 804KB
- SHA256 843353038a45651f9b925eda3bd51ba75a16d57b98a6aaedcc4f1d9427a28aeb
- MD5 28bdb1286b0a3f349856d0ae964f80cc
- SHA1 4c75285866b5474c63b0ba585c884bb561b7f09c
- SHA512 8589d3f069650011b2217e43ea9e7ba0b0e502cf314764966ae1030e15ea56580d0c3637002cb48282c95c4801bedd7302709210b968cb6964b0f3e3fb721e62
- SSDEEP 12288:vHvUrBFrEjwaQoLAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzD:vPUr+NQym2kxUlYtEjedEeQ16ywqmpv
- TLSH T13105E15F62AD18E5F676E13C85828719E372B8621351D2CF02D1817E4E77AE8BD3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 ccfb28e0258eac4f28d6fc386b60ecbbb0247a3a86215ecd303624eb0803bceb
- MD5 e1eca8ce24860ababcae3fe9fcce32d9
- SHA1 1114a4a97aad44e0978f296eb3980e4242df8f9e
- SHA512 931518b56128eb9378530a4c538f90fb8136b718efa60efb0cb6a6611360a419176bd4d5b043c3c7e45c58451ed35a6e741a21472a3c5db0ca5c26a6cc03012e
- SSDEEP 49152:4BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjVuYtO2E8ywqev:TG05lO43bmuFJ8yHe
- TLSH T1CFD5CF6A62EC11F9D1BBD17CD9C6860BEBB23825033456CF02A486A91F27FF4957E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 4feca2f8118a27f5c933132ff7dd3badd2cb7a44bc510cde02359415ed6632a3
- MD5 a3b1b1fa3c4bcb1e3e43412fb5b7f066
- SHA1 50e8d6e582d357d24907af5edc20d394536a6b38
- SHA512 40abd573c88a399b73b00e3f8331d6af1a28bc187f39e30152a646790fcdea8c5470d74fe92bc958a3c61fa68f668d9ccf4855f0b4c851e750c4406c14ef939e
- SSDEEP 24576:Jfa5POZ3dpyWVM50JicR2hG0lasx2+47eidn4m2kxUlYtEjedEeQ16ywqmpv:Za5POZ3lJt2pasx2+m9uYtO2E8ywqev
- TLSH T1A565BF5EA6FC01D5E179D17DC583861AE5B1342653319BCF022182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 fa5f5e1f043280e9ab5bc3e33ec5533cdeda067d1a3ea61b3c7dc842409465cb
- MD5 57132c26da7c6266c6f32da5d2f0c9ae
- SHA1 bce729708b97cbae9c6ba50bc0e5bd36808cdeb1
- SHA512 1a03cd7cee0b32977083b781d8f63ef0df9b14cafc9b6e1b8f91d4fb084be4148853f4fb1347853f067aead646ddc6d61d3433b429da01a7a6e6b76cfb7c874d
- SSDEEP 24576:KNcwHdjbyQ4nLC18lb/EOjowL7Fkem2kxUlYtEjedEeQ16ywqmpv:KNc/zEOVHFIuYtO2E8ywqev
- TLSH T116857B5622E901E4F1BBE1BE89779546FAB17869133486CF0291811F1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 84afe7cdcac2b37eaec971a297326195a4ba512c78709b8f309cdac6abe882c3
- MD5 d0f2367e7fcc5defa7e75147583054ce
- SHA1 ba1012090b7d757b02f645a0ed418519c5d99596
- SHA512 a4493ace67b1aeaafe75e97a6f5af7a7604c435316dcfff2547fa82506f99c9cbdebf854bea97d0e874f74c7f219da336a58dbe316e95abb96a363d34dd33004
- SSDEEP 24576:zzkNvNnaFeYhJNtmZBm8m2kxUlYtEjedEeQ16ywqmpv:zzMwBtOmfuYtO2E8ywqev
- TLSH T16555AF6EB6B806E4E1FEC6748D238512E6727461173293CB5390C13F0E679D89E7AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 964KB
- SHA256 06a7c7714a188d306426929a505d12c4cdcb9e2bb43c94b2d5a74650677199e8
- MD5 b0ea8bdae1e28a04341b5b831cb0a658
- SHA1 63549e7d194bd5d398bbfc7946a07d369f48226d
- SHA512 b590eaaaba4e4b7a5cbff1fc3bb9bf246ab3423778babf173e3c4dbe5f13457aa511b6c9df10e29dbf02a0a13a256ffd3d0fb35190afd76048b645659136ab42
- SSDEEP 24576:AD3FHshBIYQgADm2kxUlYtEjedEeQ16ywqmpv:ADVHeBIAA2uYtO2E8ywqev
- TLSH T14325E17EE65C04E4E57AD17CD6A38A06E37138AD032156CB02D4C1BA5F6BEE46D3DB40
- MD5 SHA1 SHA512 SSDEEP TLSH