29cc4afc5d3c89ad2c2d1213269a843a28cb53f678a3234b5fadf99e3ade4b61

Analysis

max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Size 5.8MB
Sample260728-e8e1msbj2z
SHA256 29cc4afc5d3c89ad2c2d1213269a843a28cb53f678a3234b5fadf99e3ade4b61
MD5 9c67ce60d6741c6d0a5a168d5a6546a9
SHA1 3a3552cad43e4101e8938592c5dfd1a768fbf37b
SHA512 acb55678bf56348dee1fa106b094733f8644f39402857835f2d4e2f3441015b212ae7aa76a77f625626baca9488f9502301bf30aac4d7bce9ca1ce5d9481ef84
SSDEEP 98304:30LgFQU3xyyj6P4eR8qLf3gbz2FSmaI7dlmg:PQU3AyjeQbz2FSmaI7dl
TLSH
T133569C52BF4CC176CA5A2570172DAF2A502DBD25773915C3A2783E7EDC313C2683A61B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery persistence phishing spyware stealer trojan

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe /onboot"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1883448242\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_738769669\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_2516_703535823\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_738769669\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2516_1439826764\_locales\pt_PT\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6812	6488	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4596	msedge.exe

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 22 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Low Rights	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296870323946504"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 19 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\WOW6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Therad = "1"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{19FCE73F-86B7-4DEC-BF8D-4B6FA02FDE5E}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Model = "208"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	6488	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Token: SeDebugPrivilege	6916	firefox.exe
Token: SeDebugPrivilege	6916	firefox.exe
Token: SeDebugPrivilege	6916	firefox.exe
Token: SeDebugPrivilege	6916	firefox.exe
Token: SeDebugPrivilege	6916	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
6916	firefox.exe
6916	firefox.exe
6916	firefox.exe
6916	firefox.exe
6916	firefox.exe
6916	firefox.exe
6488	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
2516	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
6488	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
6488	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
6488	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
6488	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
6916	firefox.exe
6488	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
6488	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
6488	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
6488	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6488 wrote to memory of 4740	6488	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe	90
PID 6488 wrote to memory of 6728	6488	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe	91
PID 6728 wrote to memory of 6916	6728	firefox.exe	92
PID 6728 wrote to memory of 6916	6728	firefox.exe	92
PID 6916 wrote to memory of 432	6916	firefox.exe	93
PID 6916 wrote to memory of 432	6916	firefox.exe	93
PID 6916 wrote to memory of 432	6916	firefox.exe	93
PID 6916 wrote to memory of 5216	6916	firefox.exe	94
PID 6916 wrote to memory of 5216	6916	firefox.exe	94
PID 6916 wrote to memory of 5216	6916	firefox.exe	94
PID 6916 wrote to memory of 5216	6916	firefox.exe	94
PID 6916 wrote to memory of 1260	6916	firefox.exe	95
PID 6916 wrote to memory of 1260	6916	firefox.exe	95
PID 6916 wrote to memory of 1260	6916	firefox.exe	95
PID 6916 wrote to memory of 1260	6916	firefox.exe	95
PID 6916 wrote to memory of 6188	6916	firefox.exe	96
PID 6916 wrote to memory of 6188	6916	firefox.exe	96
PID 6916 wrote to memory of 6188	6916	firefox.exe	96
PID 6916 wrote to memory of 6740	6916	firefox.exe	97
PID 6916 wrote to memory of 6740	6916	firefox.exe	97
PID 6916 wrote to memory of 6740	6916	firefox.exe	97
PID 6916 wrote to memory of 6740	6916	firefox.exe	97
PID 6916 wrote to memory of 1828	6916	firefox.exe	98
PID 6916 wrote to memory of 1828	6916	firefox.exe	98
PID 6916 wrote to memory of 1828	6916	firefox.exe	98
PID 6916 wrote to memory of 1828	6916	firefox.exe	98
PID 6916 wrote to memory of 6532	6916	firefox.exe	99
PID 6916 wrote to memory of 6532	6916	firefox.exe	99
PID 6916 wrote to memory of 6532	6916	firefox.exe	99
PID 6916 wrote to memory of 6532	6916	firefox.exe	99
PID 6916 wrote to memory of 6680	6916	firefox.exe	100
PID 6916 wrote to memory of 6680	6916	firefox.exe	100
PID 6916 wrote to memory of 6680	6916	firefox.exe	100
PID 6916 wrote to memory of 6680	6916	firefox.exe	100
PID 6916 wrote to memory of 4856	6916	firefox.exe	101
PID 6916 wrote to memory of 4856	6916	firefox.exe	101
PID 6916 wrote to memory of 4856	6916	firefox.exe	101
PID 6916 wrote to memory of 4856	6916	firefox.exe	101
PID 6916 wrote to memory of 1448	6916	firefox.exe	102
PID 6916 wrote to memory of 1448	6916	firefox.exe	102
PID 6916 wrote to memory of 1448	6916	firefox.exe	102
PID 6916 wrote to memory of 1448	6916	firefox.exe	102
PID 6488 wrote to memory of 2696	6488	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe	104
PID 6488 wrote to memory of 4132	6488	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe	105
PID 6488 wrote to memory of 4436	6488	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe	106
PID 6488 wrote to memory of 464	6488	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe	107
PID 6488 wrote to memory of 2516	6488	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe	109
PID 2516 wrote to memory of 5564	2516	msedge.exe	110
PID 2516 wrote to memory of 4596	2516	msedge.exe	112
PID 2516 wrote to memory of 6864	2516	msedge.exe	113
PID 2516 wrote to memory of 6864	2516	msedge.exe	113
PID 2516 wrote to memory of 964	2516	msedge.exe	114
PID 2516 wrote to memory of 964	2516	msedge.exe	114
PID 2516 wrote to memory of 964	2516	msedge.exe	114
PID 2516 wrote to memory of 3100	2516	msedge.exe	115
PID 2516 wrote to memory of 6808	2516	msedge.exe	116
PID 2516 wrote to memory of 3100	2516	msedge.exe	115
PID 2516 wrote to memory of 3100	2516	msedge.exe	115
PID 2516 wrote to memory of 6808	2516	msedge.exe	116
PID 2516 wrote to memory of 6808	2516	msedge.exe	116
PID 2516 wrote to memory of 4748	2516	msedge.exe	118
PID 2516 wrote to memory of 6924	2516	msedge.exe	117
PID 2516 wrote to memory of 4748	2516	msedge.exe	118
PID 2516 wrote to memory of 6924	2516	msedge.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6488
- C:\Windows\system32\regsvr32.exe
  C:\Windows\Sysnative\regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  PID:4740
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6728
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
    3⤵
    - Drops desktop.ini file(s)
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:6916
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1944 -prefsLen 27098 -prefMapHandle 1948 -prefMapSize 270279 -ipcHandle 2008 -initialChannelId {64cf60c6-d207-4a01-b185-5ed3576a4eb4} -parentPid 6916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6916" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:432
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2424 -prefsLen 27134 -prefMapHandle 2428 -prefMapSize 270279 -ipcHandle 2432 -initialChannelId {a8062554-8081-4d2c-954a-fed1d5dd843e} -parentPid 6916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6916" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:5216
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3740 -prefsLen 25164 -prefMapHandle 3744 -prefMapSize 270279 -jsInitHandle 3748 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3756 -initialChannelId {2209cd4b-e88f-4417-a10d-4152c95a4c11} -parentPid 6916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6916" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:1260
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3920 -prefsLen 27274 -prefMapHandle 3924 -prefMapSize 270279 -ipcHandle 3932 -initialChannelId {747165bb-e136-4981-8336-a393dc2ff3e3} -parentPid 6916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6916" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:6188
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4432 -prefsLen 34773 -prefMapHandle 4436 -prefMapSize 270279 -jsInitHandle 4440 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4448 -initialChannelId {9497b71d-2004-45f0-96db-7bf93d3e7518} -parentPid 6916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6916" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:6740
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4896 -prefsLen 35010 -prefMapHandle 4864 -prefMapSize 270279 -jsInitHandle 4888 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4912 -initialChannelId {266811f5-2c23-4c16-89db-405622e2013e} -parentPid 6916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6916" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
      4⤵
      Checks processor information in registry
      PID:1828
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5172 -prefsLen 35010 -prefMapHandle 5136 -prefMapSize 270279 -ipcHandle 3024 -initialChannelId {f28c6013-eda0-43ef-9661-eeaccb35ceb5} -parentPid 6916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6916" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 utility
      4⤵
      Checks processor information in registry
      PID:6532
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5220 -prefsLen 32952 -prefMapHandle 5224 -prefMapSize 270279 -jsInitHandle 5228 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5236 -initialChannelId {6bdcb867-4f76-47dc-ae20-0d2f7b522f64} -parentPid 6916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6916" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:6680
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5496 -prefsLen 32952 -prefMapHandle 5500 -prefMapSize 270279 -jsInitHandle 5504 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5512 -initialChannelId {8610f407-3b9a-4a39-91e6-a98d29513e47} -parentPid 6916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6916" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:4856
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5528 -prefsLen 32952 -prefMapHandle 5532 -prefMapSize 270279 -jsInitHandle 5536 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5544 -initialChannelId {5a86bcca-7a6e-4b32-b230-3f57b9b72abc} -parentPid 6916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6916" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
      4⤵
      Checks processor information in registry
      PID:1448
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2696
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4132
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4436
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.internetdownloadmanager.com/welcome.html?v=643b07
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffd8cafc188,0x7ffd8cafc194,0x7ffd8cafc1a0
    3⤵
    PID:5564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,3582122344092789418,16754066446511146268,524288 --field-trial-handle=2348,i,1987714536477767565,17037807108581799038,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2336,i,10727182375540146848,8083553321783286528,524288 --field-trial-handle=2348,i,1987714536477767565,17037807108581799038,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:13
    3⤵
    PID:6864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,373567495480739439,4246941422795332423,262144 --field-trial-handle=2348,i,1987714536477767565,17037807108581799038,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
    3⤵
    PID:964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,11830943910408352503,8639643531365328347,2097152 --field-trial-handle=2348,i,1987714536477767565,17037807108581799038,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
    3⤵
    PID:3100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,14129843226509031204,5065674201786923704,2097152 --field-trial-handle=2348,i,1987714536477767565,17037807108581799038,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
    3⤵
    PID:6808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,4463226872587754534,15097141067130749348,524288 --field-trial-handle=2348,i,1987714536477767565,17037807108581799038,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:14
    3⤵
    PID:6924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,6956883548197892457,9289071703072979163,524288 --field-trial-handle=2348,i,1987714536477767565,17037807108581799038,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:14
    3⤵
    PID:4748
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,713699754644789652,14986271354378195864,524288 --field-trial-handle=2348,i,1987714536477767565,17037807108581799038,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:14
    3⤵
    PID:6156
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,713699754644789652,14986271354378195864,524288 --field-trial-handle=2348,i,1987714536477767565,17037807108581799038,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:14
    3⤵
    PID:5756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,1515384523048694596,6846136263218010495,524288 --field-trial-handle=2348,i,1987714536477767565,17037807108581799038,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
    3⤵
    PID:5460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,7605170595265528749,15915167139775857505,524288 --field-trial-handle=2348,i,1987714536477767565,17037807108581799038,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
    3⤵
    PID:6044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,490733530293649412,6018580187779568360,524288 --field-trial-handle=2348,i,1987714536477767565,17037807108581799038,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
    3⤵
    PID:6028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,4997128304769592901,5691278255869879153,524288 --field-trial-handle=2348,i,1987714536477767565,17037807108581799038,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:14
    3⤵
    PID:696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,17269590509454412622,3704935541900640278,524288 --field-trial-handle=2348,i,1987714536477767565,17037807108581799038,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:14
    3⤵
    PID:6644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,18179681608595490188,16483846676412987938,524288 --field-trial-handle=2348,i,1987714536477767565,17037807108581799038,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
    3⤵
    PID:2324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,12235682415665631816,8069283005686730353,524288 --field-trial-handle=2348,i,1987714536477767565,17037807108581799038,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:14
    3⤵
    PID:6044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,16634285071869631340,17429184950358926392,524288 --field-trial-handle=2348,i,1987714536477767565,17037807108581799038,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:14
    3⤵
    PID:4360
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6488 -s 1752
  2⤵
  - Program crash
  PID:6812

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 6488 -ip 6488
1⤵
PID:2436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 d3a2ba92e9ddf9dca442d588673369dcd5d7d754f9be6b07ca0591c8fb77139c
MD5 ca050e61d522eee8b783b6135d6896a8
SHA1 1f4d0141009734ca8da07577c9c75c4951a329b3
SHA512 db71965495ec807a77d841b79d9fc6a86d27dbb8e6fd51720a7b7b441c53d878b429a4147d3265202dbf3ffa1217a577c2c58d68b6cd30ef5a3890368e05e050
TLSH
T10BF02DB6D921BC3729FC1B1970954B4BEB51135B3B41984B3B3C921C8FB063B478681C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0c6ed0fbf5e64a88b6649cf83e555fd29f11ef58c3289a8bc00b66496940ac3b
MD5 a8f6f20d81afe12a917f3db2edd9dcee
SHA1 9bce3c6bb1fc2cedf552c27ea0221949bc501af3
SHA512 c2c7d7bb5fbd2f3ea251ee112eb248743d38f03807696e393902ff929cac00c6a5ef1ea524a77805c2edc658821f7bd4bed6f7717d80f0225fc536b03350e29f
TLSH
T169513D764F790AD2EF2A89B310D25C5A3AF8B7DD07031B1886E97D745012F6022E25AF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ee2f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59ee2f.TMP
Size 3KB
SHA256 e5e1d8dc9c352d1ba8813054e35a655e7a8ff2c52ad817f0b7fe5112546af9d9
MD5 39afb86a21b4a99832083884b3c1850f
SHA1 e0daa81cb53b8e761b82d6560487f3ef78379adc
SHA512 4e08b2e20d912267758dfab3a57cf82cdb55f1a065213106640e8c638080be0bb0ded0c738c76e5b10f1ef654a760dcc797bd0c63959b6cf356089dfda2ca1d5
TLSH
T114513E760F790AD2EF2A85B320D25C5A3AF4B7DD07035F1886E97D745412F6021E25AF
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a626e4bd543bcb00d430b54472e446d46c1a00c2c75e008b71d09e446926ec99
MD5 672f433cc59e77ab6a1ccb24afd18cec
SHA1 b17fef691790a5773b078060a9129f81c7fc3ed0
SHA512 2047e99381200190dfefdeaff422a8252baddbdca5a01d38561965bf96f97236e9efc3f614c8f6476e51884a1d703a04900ce3063fe18a4326a3955590fbfa65
TLSH
T18351CFF783F9856DC91186F0AB18BE2BCE2D0914432C3D5A89E49F1BA3E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 d6508404b25b4d294de2d4fcaee7b71ea48c1c21585222dad32d419c4e98df42
MD5 8e3a3e3323bd2631dc5099245e972f39
SHA1 e12482cd8d34af6a27c89e728a3bd8b374aa754a
SHA512 474c209f2ac87c80ab496bf57696e2243a363597e1690df73936f32bff6902b06a8f2f4b269f0d9d7b3106d61d30e358023b9dc76780e020c29109091580866e
SSDEEP 384:sxRXDu8r/f3sUuN/RI21j/5i/WBQsGQDGjE:sjDzr/fdcW0/5YWBQsGQ7
TLSH
T17B72D81A6A349D7B8CCBD209FA557F53D6F91163E1905E44AAFC8B0C04E67ED620382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 b7c0c779ea8717083ac51db564b35e308c535ba08740c3934096dd360683ef8b
MD5 bb70dd1c38e4d3b29fd6673f83a7605a
SHA1 a2c248415e8abd2edfd5d474784ebea4a8f13710
SHA512 d69b79f8402aa2131cbc7b2ef81491414ecd1e9393e464ef98c578467023663d5b0c0e00517ca726bb34a0dff1039df1a0fd984b70609907adcaf58dfb5f56ca
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVxobbDwzror4S:Ob4YZnE7yTWg1NfwBu1jaWobHwAMS
TLSH
T13FE2FC3B280CCB7E4F804ADDEC29BD8A6DA801CF56D8C95447FA850C03C6BEB551A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 705633335728326b5fc5000c8d57f807da06f9fea0b26fc07601feb0d3afa56a
MD5 9d951edda88b004a6e40ebfb6e3873a3
SHA1 2598f88feddee26fd11d2fcb0569c44b9eba7b91
SHA512 32655c2ada6090e784edda22be7fdf43f3433a71f85f8078a4b57ffa8cbcd6b971c37cca60acb05f8c2560023719c21dc170b8805b49e0b59c8426ff631ac2db
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9EgCBdvbHAbcJVphBnQ9d8v96BWO:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRG
TLSH
T106B25D51713F4280383EB90C9178D86F96C2B4A37519E52F7B6801A65F6BE039DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 ad242e367baf08084f00d34603278df2e5646e9af74821ba2ff7502de3c42b9a
MD5 aa89b34e1d63eaa9504d5b4c37f83d19
SHA1 8fc28168b8d0882e42e1a65be41ee3bc3668e1df
SHA512 1ef481e79d8a449b92c3f8417a1e8b3f1edeb6906e6bba5b0651a526089ba05012c69105879adcfe270e7f7705548b4b8ec14339147880037ec7dbe8289ae83a
SSDEEP 384:nNiFiZcIb8NL38TUNTUlIRGPvuTNCjEqf+GGCxm+4RVXMdOObjI9G6w7Z8LEEIz8:EFQbQ3wgUuwbGCY/RV8d29MU
TLSH
T157E2C2F2A8D78972E8AE8B97A77D6D469DFCD163B5884984B7C44D0CCC421BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 8287821e278c9f0a6660a1742b111dfd4446003fdcbfb91f02e37182a67c1a6b
MD5 e344951aa15e677b89ed4978482f627a
SHA1 ff1dbfc89baea4ccf379815a78a34b8a1f1cacee
SHA512 6e809efb2e65b749192447c8079c0ec7126e6dbd766e564d2a2dce7ed1aa9109891ad8ddaabea3033391212ef0e9df147bbe6252d7fe19ce8b4462242bb0d018
SSDEEP 384:neiFiZcIU8NL38TUNTUlIRGPvuTNYjEqf+GGCxm+4RecdOObjI9G6w7Z8LEEIz8:1FQUQ3wgUuGbGCY/R1d29MU
TLSH
T19ED26D32ECA8CAB7EDEB8F95B74A7656DEE01163C59C4AC8D5D85E0C00971ED070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 9feb73cffb52657ce1218c4c1873e67550ea499674b8fad6da27b92841d871a8
MD5 b42b73d0c9b8d1a2911f44b8c6bbd97c
SHA1 1f21dae094ce0d22e97834af0cd692a1f9116b35
SHA512 78a5bd99e273dac608e0bca05f2f5059648d418c2595e7d312be0788de4e5535b4e8ce54dbdc6e71f9c6adb96002552f0b7f805b487d7507df249ded675c1afe
SSDEEP 384:nciF1tNn/s3n9Sn8Ng18TUNTUlIRiPvuTuyREqf+GGCxm+vLWOObjI9G6w7BZ8Li:HF1j+9SX1wgUurZGCYwW29Mt
TLSH
T139C26B36E859CEB7EDE74FD8B74A7A46EEE01167859C59C8DAC85D0C00872ED0307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 7f340cecb173f95173e7de02b43b116036cb14cbd2aa061d5c735125e3067794
MD5 f0a78e117c38233a8aa4b45756e06c12
SHA1 c6d2d022ab5584cb715c7945f0581223d55075dd
SHA512 8bf41542cb27fb61eeec92ef6b205f93e44e8e5e6a31e4e3c0df47495d9aaa3b8dad301d45deec02ae59cdc13ac547c613383f11092be205093063715b50a700
SSDEEP 384:nviFiZcIU8NL38TUNTUlIRGPvuTNYjEqf+GGCxm+4RecdOObjI9G6w7Z8LEEIz8:6FQUQ3wgUuGbGCY/R1d29MU
TLSH
T1DBD27E32ECA8CAB7EDEB8F95B74A7656DEE01163C59C4AC8D5D85E0C00971ED070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 188640ac2a570ce0e4744b9d54b935a71aab0166ad8c9431506658f73f17563e
MD5 b29382c3e88550cc0b656cabd1e033b1
SHA1 3815b8172915541e478e3273447b923e57185e61
SHA512 fc1992c64dbaf7aa89e1801443742e01a601b01bb3d9bfe522d760bf721342366ea9aa9792c3ad96f0cda7e1a873a3279231111012cd56d0eece373ca7761cb2
SSDEEP 384:nviF1tNn/s3n9SC8NL38TUNTUlIRGPvuTTYjEqf+GGCxm+4RecdQ3Zq8LEEIzv8:6F1j+9/Q3wgUuIbGCY/R1dQ33
TLSH
T1A1B23B36E894DD77EDEB8FD8B74A7686DEE01163C98899D8DAC85D0C00872DD070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 462d7e808963e2604c30ade17e2177d755e533a3d5aafcfbd2a338e44dc14cbc
MD5 4f68dd1a44247528a0d6d45f87ce7cac
SHA1 915377a893f8c5ecd5719a8c912769fc0dcc13d7
SHA512 a6b09d5a431c47f0a1fa3a5c33b691431b8ae6599019bd7234d89ea7c4b0db1b23099541e7816a87f856c0237ad1af9b703afe90f4f88c203704e09c67a9d5bd
TLSH
T1724163D04C391AC1D4BD0E6FB45B29FC94ECD726F490347C2858EA98567E65E314083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 5786808d4371b7aaff01d8912a67643f537bcdd019a90ca98af02855ffd842c0
MD5 bb868519ecbd0952c650fe4788336b8a
SHA1 94886b8b7911301dc8f0c6e9e5cf695262e271d1
SHA512 387343814016d0113d38296411ba57c574277834547a37e8e12386d1d97456134e03d8da6f4eaaafaeea82a9feb1622f2efc4a90a56f8f80046a9dde052c1aa9
TLSH
T1854130D04C392AC1D4FE0E6FB44B29FC94ECC726F5A4347D2858EA9855BE65E258083F
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n6eagavx.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 15KB
SHA256 4a37ee4a47f463f65ff9f4c86138622382412271466c516b822244df2561586d
MD5 c9f3fda4daa6b40d537991292f8dce1d
SHA1 b9573324e9f55885ea82bf2a8ac9d0ae375d573d
SHA512 b1d0ba76de8590d7680ab3d7014595bdfef2762871cc4debe42b328ce6742375d40a69971f5c65b8d42001b4e58c206ec71b4803842c6aa822b1e282c69c79a3
SSDEEP 384:HwCe7iO024Yrdcs3hk2nhfdDE2Ba/rIVy8eTI+HI+i:QqZYrdv3hk2nhfS2sDIVy8N+o+i
TLSH
T152729DBBDF516C5C1917D985C8AD9369DD05F9ABCFF690A608243449C78432AB0FA0CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n6eagavx.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 47818799c7e278e122dc1c585309124018c926a518236832baa070b2b7cd0219
MD5 953a25d4aed6dfbdfd79934b0d3e0f97
SHA1 131993fa98a4471cbc2fb0a7835ab3380a9d010a
SHA512 406be34dd4ff7d6f00d3ae0f98a4abd7aa7c1cc6e12aba22d04014e05a8997ca7db11cdf3c7941b6a50eed9665855ed4d23ab88c30cfb1d6e1a1de85caabe8ed
SSDEEP 3072:j3lZyuwp9zaJy6XYmdX/K4va5q1kPWVzI+NOfH1:pZyZzKvJKCaZPmzI+N6V
TLSH
T11AA3AFF6DFA2CD3C65FFD02996C2883EFD226450B3A7300AC853675062C6BB86775649
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\db\data.safe.tmp
Size 30KB
SHA256 7b6ba9be9e30493172fa1496c5ab38e9c4829e0ba2ceefa633b06001c74f6965
MD5 a481aa3b0773e62b6279e1def034dd29
SHA1 9250757f579408cb3c5390318344e8caf849c0fb
SHA512 fc73c034ab53038707e1771cae113e1a88cc02519ee70c9bfa4e280dcb1b17a034ffac8bfb2cceca47864176512a0cb9697d5c1199013231411f667f10786725
SSDEEP 768:Nwb1K4e21ShD0Gcm+uE/KqRMMzrybnbRbEXH:R4e2kM/xt3
TLSH
T14AD21144FB2A913FC41512BBDCA50B042F79B886591A2F5B3A4D646C6C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\db\data.safe.tmp
Size 30KB
SHA256 f3e03cf8ab6262934d1c91a48cf613a7403b66d7e91c1d9d2919ca0df6eb3c2a
MD5 dde42b914a18651d327e8ab9e7fff87c
SHA1 dc5037b5573cffac0d639b8068e7eecb4b2c96be
SHA512 ed9ff28d623f5784f8b82b4357c38da7bbd9e3cba5d4e8f996b77eee7d351795665eb68b88c417a123db3a6cb6b17a55288ca776dc3e202eb522592a9f260c82
SSDEEP 768:r1K4e21ShD0Gcm+uE/KqRMMzrybnbRbEXU/S:g4e2kM/xt7
TLSH
T14FD21144FB2A913FC41512BBDCA50B042F79B886591A2F5B3A4D646C6C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\db\data.safe.tmp
Size 30KB
SHA256 ae8fc5385566d6fdab77a717c44247fd403a62724d2440aee94434e021a34a0f
MD5 33b94fcfb848fb8149c5ec871fc1ae98
SHA1 6961e0db8118352aa723656a66bda03039be41dd
SHA512 9a7dc022b7ac61590d0629900f7543adb6efaab997789e4035c09bf8d8ca5fff48f0422c40c2d189fb795ec71a0ccb9eb574c4c49cf4c257ccc472ab142129c1
SSDEEP 768:r18/P4e21ShD0Gcm+uE/KqRMMzrybnbRbEXH:A4e2kM/xt3
TLSH
T1D4D21144FB2A913FC41512BBDCA50B042F79B886591A2F5B3A4D646C6C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\db\data.safe.tmp
Size 30KB
SHA256 76e89841f545f2c51dd45ecfbf5847ce43d1388e8e25f821d072a50cec4b5329
MD5 757bfa0a3fe7a44e4ece3a85657d2e8a
SHA1 4ffeb2f8ffa33564e4e61c618195da13bce931c3
SHA512 7569e18ba0aeace7db895229409edca8a1a8038cdc13c48f404b65ee70f08abd6b9fb562e8733fc19460f7d02954ae7388e2b1656d7a2e140399b525ce7c8b6d
SSDEEP 768:N/P4e21ShD0Gcm+uE/KqRMMzrybnbRbEXI1/:d4e2kM/xtW
TLSH
T1EFD21144FB2A913FC41512BBDCA50B042F79B886591A2F5B3A4D646C6C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 a3715b614a4583cf2c0b36d6d99d3144094c2f784bf2e5fa6eca317b430e6ba5
MD5 8627e6fd7f892a3249cbaf56a80fabc8
SHA1 099a70051df3cfc170f4817d52a984c5477d1740
SHA512 22f8085484c853ce8c216b5b39ba01290bc7b8135521dfa8f649af592257b2944f0864d66cb84c164e23f02635e194bc452b45b54174e1d407efdc25fdbd9232
SSDEEP 192:OOv5zbo8bc6yjTz8X1d66JoztdzgCl6mc0dz:Fbo8bc6yjgd66Joz/zgC1jd
TLSH
T17BD11D64EA288A3FC409437BCCA60F414E75385B984E7F29319DA50C2D5A2DE7BCD1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 97af2f3a31000783ff8d7fc12c03a62959c7404515aee5440fa44b6452396173
MD5 4a37604a845418c44d753b6f7ab467e3
SHA1 22187f35bdc2bce2fd544edf7d489d57d687fccd
SHA512 d11f869f33963f8822aaac799e77403232e64ffe7b71707faa508eba3d01196993f739bdcb053a39a4b0c311ca255973ae0664e15821008ebf25992e1bfb6431
SSDEEP 192:OX1d66JoztdzgCl6mc0dAOv5zbo7fZc6yjTz:qd66Joz/zgC1jJbobZc6yj
TLSH
T104E11E64EA28863FC419037BCCA61F414E75389B984E7F29319DA50C2D562DE3BCE1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\events\events
Size 1KB
SHA256 5d6177e4aa8790680c60ecf06429c2bc097da0ccdb2f6da29a5793cb6a1957d2
MD5 d45fb133f45b7367f0ec923aedc287d8
SHA1 bb7a16f2250d2180e2c80c7466122b95d6a4c997
SHA512 5f4920591782c99fb192aa24f72ab68198efda1053488da122b8289b0cbc185322cb40dc9822a127b170adad6869567f6d06fc879ffa0aaee0c7cabe4f6cefbb
TLSH
T1A6115B9C3DFA4D6AADC7E398B94105CE97254B0604471D434E12FE8CCE85BDE3369439
MD5 SHA1 SHA512 TLSH

Submit Download

1a68aba9-8275-4a33-9fea-69e50998a50e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\pending_pings\1a68aba9-8275-4a33-9fea-69e50998a50e
Size 235B
SHA256 a8389f42ff98ef498a8be8b857a144bfbfd89034d23e1640e4b8972876f4d732
MD5 fb9c4cb10f9e2234b1241eba13bedb7b
SHA1 d7bc4eb52b7024183ca4b726c389a3ea3a5f9e5f
SHA512 58ccaa52878d9d22e575db34b255861b5b65e1d4936bb8f0f23ef89c7bc9cacd3ee910ec00175ab1b4897925d7f1ec28e2c30a5dfc3d3b520a44ab099ab9a36e
TLSH
T181D0978118A8775E08084F07B0A03ACA30448C331470A8A0CE784974AEFA9C84265827
MD5 SHA1 SHA512 TLSH

Submit Download

297b5486-bd59-4403-9874-9952fb74176e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\pending_pings\297b5486-bd59-4403-9874-9952fb74176e
Size 886B
SHA256 132b8fef83461af894c0e125368d763e9732d0eec7ff35bc58aac7a18fc9c7fc
MD5 ba980580ff12c672ead38010186089ba
SHA1 8886b08ff9277e0591672e3210da9c1b63490a2f
SHA512 825a763ceec7b91c90553af3ce4c363576a189d3a3736a09af0bae357d1aec85116692d5b6a87c856c235cbe648aae709d4e7a5f2548b0f0be5290bf4c2bcd33
TLSH
T1751123408A7878B1CC7DE29B85A17B828AE4752380C649147DA18B1C0EBA21F97F670B
MD5 SHA1 SHA512 TLSH

Submit Download

2ab7dbb6-0383-4326-a3a0-31331d9dfa5e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\pending_pings\2ab7dbb6-0383-4326-a3a0-31331d9dfa5e
Size 15KB
SHA256 a80c4eeafd0957efdaac5fe337044bc0b87edd27ce2d15faab7f64228d74e074
MD5 15b72f7460f129c49ac978792babb32a
SHA1 0751843625286860b5593f935c23d3ac5af5a222
SHA512 7d2347b98f904734f63cef563fb1c1478263f0e31b94b7a3552d95ea815a394485c29f4254e514181a27bd08fea6008f0351482dd79c11963a38af19916f0771
SSDEEP 192:ZJ91goWfX7E5tBA21QlKvyW8qJ2GCG8RDi5qeRdz5aK9wSSgK9kiPvheHTE7:V1gTLEr6DODCGEDi5qeRdkKS9F
TLSH
T1DD62D956646049BE8650E768D8EC7FC3E1F518CF8C019FCE9BE4BD0869EB0AE5127847
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

70b2b789-c741-4c57-ba35-1ef748eddbe5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\pending_pings\70b2b789-c741-4c57-ba35-1ef748eddbe5
Size 883B
SHA256 e91c121d5f783c6c593efbb4b7e981e940e75ec7754bf8ad8b23ecb0a2c5fdba
MD5 f140e05d6b9c88185fd3c2a1caf2a8b7
SHA1 cb7f1a7abd99f5dc4e2b92950b0fe0dc69468d6b
SHA512 bf6365aea485ac446a80dfc935faa893d64b182356600d5a33b7a664fa1cdb3fae8ae691fb25c390e32d55912473bdf80395a97880af7ea1694f0f20e0e8f253
TLSH
T1FD11C041EA34B976CD2CD24F89597B428BE8742384C545143EE18F180E7A61FABAA74B
MD5 SHA1 SHA512 TLSH

Submit Download

c8dc254b-3611-442c-aec6-a01e0725d602

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\pending_pings\c8dc254b-3611-442c-aec6-a01e0725d602
Size 235B
SHA256 93751e0d88cf250765f96b61673ee3b2edcc4fb9de66d3e645b3bdf1abdb97c7
MD5 adc236d6267098508a27c05ce7b6701b
SHA1 01dfbe22b3d75e7eb4f7c5d956d4d3ca92ad2b57
SHA512 f24fc7b14fa693f9e63e82bf452c8f98c793d3be188d44db42d3073893d18734c774f32c55580bc117333c19c5b442ecc0ee2ed510cceea3e52581483d6c2a1f
TLSH
T176D09780148837AC58000F12F0F1A9CB70488C336861A860C6608078DDF9ECA0292826
MD5 SHA1 SHA512 TLSH

Submit Download

f6ace35c-7834-4329-aca6-3e35698928d9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\pending_pings\f6ace35c-7834-4329-aca6-3e35698928d9
Size 2KB
SHA256 d7286330018383ed3d49b63582951109a7d1cf3700f40167792a543d2b9804b6
MD5 5f0391c960a30d2bb069fef22ef866fb
SHA1 eecaa9753fa2ddb68e6ead227e4d77d64e1b0127
SHA512 c1d645661c912722f0e9ecbf5a3d9dcf3988db75cc637d8dd0eac6b9cbbdb96767bd196f5e1350f1cd49f661c74b6b49b4f79638b9d855c17adfbc6787a6fa29
TLSH
T18941256C35789C365CDEE25D9052368ED7A0591304C658432E51DF0CCE927AE23AE51B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\extensions.json
Size 16KB
SHA256 4611b666989d27c08362174b916813dab8b5ff3be7bb8e8b0879ee73a94c4658
MD5 62a4f77bd9d1734442f0066e713ded18
SHA1 80ebf2c018e5fae3e7cc992073457f350453fb0a
SHA512 cbe7010975f0f83b00a28ff3bb8eb3bc0a96c6e2dbb039464edba9f371d3c3a9489f93fe47310752ccac927277b1870c2e07ad33f62d0eddce7c94867645cdef
SSDEEP 384:GkI4voUmldvd8dhWh94zZ96oZL4HjL4PdL4HBL4HvL4HgU4h3:JI4wRfuXU4L6O4v4V454T4F4h
TLSH
T1B372511545049EB8294FA79AAA367E02C37D533B70845C78F4DD8FC802FA5B902BB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\prefs-1.js
Size 6KB
SHA256 158f6c7131b5ede3b586617603535b838a67334115b7464e0b9743d3ab153203
MD5 c5b339580f086e38d4efd08710720a28
SHA1 f894c1dc2a5fed0c21a1de238b28ae090fdb3d23
SHA512 dcb18560b8be6325b0c9aae0646d4ab7c13ff91e26a5f6a6d0b4390d19753421bf18bf92af1f52f119248ddf16c32f93803502732ef604ff79cfbc14e7a45d9e
SSDEEP 96:xHKEUTUPqGq1fiWd1zSeZ1SSlQdv9jRnRRHnyzMLEBw88u8L4cnx3hezy:kESR1fiWdDZ1SSk9nyzM4Bw88TX
TLSH
T1BDE11F7891488F7F74B677ACAC688C316AB2413BB7BF68D610B54484010CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\prefs-1.js
Size 7KB
SHA256 dc98659dbc0e19102e7b89103d7853d40dda1edf62553746fd6e011c8977aad8
MD5 d808e0fa1ee62f536d24aa963785be9b
SHA1 ccffa571bac7b953b6b28a8b07f83610eca9e500
SHA512 2d4381657189c47f6adc8e392294ea4c14b4a5e1973b1f6aef9083c6a377eef272806a7e0df67f723cf509b37718b9e7bc62b85c3dfef897c542960454594de8
SSDEEP 96:xHKENTUPqGq1fVWdObzSeZ1SSlQdv9jRnRRWRqQTyzML0ABw88tMR8L4cnx3hezy:kEzR1fVWdkZ1SSk8RqayzMwABw88JX
TLSH
T1F9F10D789444CF7F74B676ACAC6449715AB2023BB6BF68D610B944C5010CF3842FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\prefs.js
Size 6KB
SHA256 1b7393da32defdf4cd4096e0119582d974a36e0a75ad57df56661c5bf9c86e7d
MD5 03383c0acc3a08287f979c63b60f243a
SHA1 0bf92f47140c947d0e6f8a05d96bcee3fe5cfe8b
SHA512 3e5fe1e200e6217c53e508572e16466962f17af51163ae9b5968e516b9462cef20b4d317399dbe29a1f8b57b0a3c39f3323edd7b875369cd020ce5187f35bfb6
SSDEEP 96:xHKEUTUPqGq1fiHF1zSbjSSlQdv9junRRHnyzMLEBw88u8L4cnx3hezy:kESR1fiHF2jSSx9nyzM4Bw88TX
TLSH
T114E100789508CF7F64B677ACAC688C316AB2013BB7BF68D650B55484050CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 0a812bd8f569a425b0f35852dd456788eafa0e191f25ef3359f489cb914383bf
MD5 cb8039de1333306b83cab6d5ac73e417
SHA1 25b7bf51d9755e2f7595125b04ee86d3d383f517
SHA512 8f4600bf0a87d946a872b21f411d41b81c15310e6cdfa714c956e70c01fde5a316b00aeb95b200f053db2ac981c6edaf086678735aa008c1eb4083323d09944c
SSDEEP 96:eCfzHpA69ziJQeW9jILA0NjoB8kMJttn0YJZQB+4S:FDu69gIOnNcB85JttnTZE5S
TLSH
T1AB918D02370B2C63FE57C2CE9E454CF14DB4300A998088E890CF2E25A76FA4BB4994B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 0a51e5ee5bed04ca5c539a9eabac148922eb0a52263bd1ecd61378fe85fb8e76
MD5 c9f4365e855cb0b037dd0de61086d652
SHA1 384f22df6cb0a98cbbb1e6aa99211c1a414e9e87
SHA512 44edb8c889961a489b89f5fb7677827493981a942ffe1afff5ede7b3881d4e789648de745610e209b463d2eb09f02cc33816ffd515053f58ae78dca2c9932aa7
SSDEEP 96:eCfzHpA69zi/QeW9jILA0NjoB8kMJttn0YJZQB+4O:FDu69aIOnNcB85JttnTZE5O
TLSH
T1C7917D01371B2C67FE57C2CE9E454CF14DB4300A998098E890CF6E55A76FB4BB4994B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 7.0MB
SHA256 c313bcdb330d07212700a4c643441394867203ea517ce0805755fce8abdf62c0
MD5 db63c4a3ddec17cb69dad10caaa4a302
SHA1 595c3ba5577919b35bb07ec04fb6a7d302d56b29
SHA512 cf488a02ff2a71d0a7d7042ea5a4e464fce90de14f5a5a26319a903c66d78defdc5c1dfb3d258e299d44e3f49365908ef2937d551ea39ddebb1dff8ea77b6300
SSDEEP 49152:rLbrFm/W9RIYSLOAtjJ8DllKrcJjep/OlCb63/K8V6ItLWF0GIa9mt77NabY4N4t:r/YRt9gllKrcxep
TLSH
T187765CE420E1D253F38640B3718993EB21EFC01C6076CE48579496FAA9748EB8E577BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads