08cbe80a75ccef773b602235702829f065e9120676369bad293500441bfb5a28

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 01:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
Size 5.9MB
Sample260813-bkrsrayfja
SHA256 08cbe80a75ccef773b602235702829f065e9120676369bad293500441bfb5a28
MD5 4f9a41904f62d841bb4713e8b4220898
SHA1 a8f9fd552f38674a4450038acef2c4884f9f5174
SHA512 319426a1c6b7894cbc3507dba8958fa7bd131f5b18061dd5ab76c21c663ac9ac38ca93322c4913bf98ae5d14209f02363e408e223067b6dd32f028b0d24cef0a
SSDEEP 98304:CmllN4RU7ccFvjj29P4wa18frP3wbzWFimaI7dlol:3OUAcF7jOgbzWFimaI7dl
TLSH
T165568C51BE8D8176D90B113347299F2A102ABD28773865D3B2B43E7EEC723C16D3961B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery persistence phishing spyware stealer trojan

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe /onboot"	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_76502871\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_76502871\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_356053909\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7020	3316	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4556	msedge.exe

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 22 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243"	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe"	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm"	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Low Rights	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe"	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3"	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe"	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3"	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3"	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134310572016460418"	msedge.exe

Modifies registry class 19 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe"	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Therad = "1"	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	firefox.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1"	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan"	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User"	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Model = "224"	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\WOW6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{D8D732A3-FC0F-4776-A4EF-34BE35DF0A26}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter"	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	3316	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
Token: SeDebugPrivilege	4312	firefox.exe
Token: SeDebugPrivilege	4312	firefox.exe
Token: SeDebugPrivilege	4312	firefox.exe
Token: SeDebugPrivilege	4312	firefox.exe
Token: SeDebugPrivilege	4312	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
4312	firefox.exe
4312	firefox.exe
4312	firefox.exe
4312	firefox.exe
4312	firefox.exe
4312	firefox.exe
3316	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
4120	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3316	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3316	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
3316	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
3316	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
4312	firefox.exe
3316	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
3316	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
3316	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
3316	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3316 wrote to memory of 5212	3316	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe	89
PID 3316 wrote to memory of 1520	3316	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe	90
PID 1520 wrote to memory of 4312	1520	firefox.exe	91
PID 1520 wrote to memory of 4312	1520	firefox.exe	91
PID 4312 wrote to memory of 5868	4312	firefox.exe	92
PID 4312 wrote to memory of 5868	4312	firefox.exe	92
PID 4312 wrote to memory of 5868	4312	firefox.exe	92
PID 4312 wrote to memory of 4952	4312	firefox.exe	93
PID 4312 wrote to memory of 4952	4312	firefox.exe	93
PID 4312 wrote to memory of 4952	4312	firefox.exe	93
PID 4312 wrote to memory of 4952	4312	firefox.exe	93
PID 4312 wrote to memory of 3380	4312	firefox.exe	94
PID 4312 wrote to memory of 3380	4312	firefox.exe	94
PID 4312 wrote to memory of 3380	4312	firefox.exe	94
PID 4312 wrote to memory of 3380	4312	firefox.exe	94
PID 4312 wrote to memory of 4100	4312	firefox.exe	95
PID 4312 wrote to memory of 4100	4312	firefox.exe	95
PID 4312 wrote to memory of 4100	4312	firefox.exe	95
PID 4312 wrote to memory of 5124	4312	firefox.exe	96
PID 4312 wrote to memory of 5124	4312	firefox.exe	96
PID 4312 wrote to memory of 5124	4312	firefox.exe	96
PID 4312 wrote to memory of 5124	4312	firefox.exe	96
PID 4312 wrote to memory of 4800	4312	firefox.exe	97
PID 4312 wrote to memory of 4800	4312	firefox.exe	97
PID 4312 wrote to memory of 4800	4312	firefox.exe	97
PID 4312 wrote to memory of 4800	4312	firefox.exe	97
PID 4312 wrote to memory of 1404	4312	firefox.exe	98
PID 4312 wrote to memory of 1404	4312	firefox.exe	98
PID 4312 wrote to memory of 1404	4312	firefox.exe	98
PID 4312 wrote to memory of 1404	4312	firefox.exe	98
PID 4312 wrote to memory of 1140	4312	firefox.exe	99
PID 4312 wrote to memory of 1140	4312	firefox.exe	99
PID 4312 wrote to memory of 1140	4312	firefox.exe	99
PID 4312 wrote to memory of 1140	4312	firefox.exe	99
PID 4312 wrote to memory of 4764	4312	firefox.exe	100
PID 4312 wrote to memory of 4764	4312	firefox.exe	100
PID 4312 wrote to memory of 4764	4312	firefox.exe	100
PID 4312 wrote to memory of 4764	4312	firefox.exe	100
PID 4312 wrote to memory of 4808	4312	firefox.exe	101
PID 4312 wrote to memory of 4808	4312	firefox.exe	101
PID 4312 wrote to memory of 4808	4312	firefox.exe	101
PID 4312 wrote to memory of 4808	4312	firefox.exe	101
PID 3316 wrote to memory of 3376	3316	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe	102
PID 3316 wrote to memory of 1964	3316	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe	104
PID 3316 wrote to memory of 2864	3316	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe	105
PID 3316 wrote to memory of 1872	3316	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe	106
PID 3316 wrote to memory of 4120	3316	2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe	108
PID 4120 wrote to memory of 4376	4120	msedge.exe	109
PID 4120 wrote to memory of 700	4120	msedge.exe	111
PID 4120 wrote to memory of 4556	4120	msedge.exe	112
PID 4120 wrote to memory of 700	4120	msedge.exe	111
PID 4120 wrote to memory of 700	4120	msedge.exe	111
PID 4120 wrote to memory of 5804	4120	msedge.exe	113
PID 4120 wrote to memory of 5804	4120	msedge.exe	113
PID 4120 wrote to memory of 4844	4120	msedge.exe	114
PID 4120 wrote to memory of 4844	4120	msedge.exe	114
PID 4120 wrote to memory of 4844	4120	msedge.exe	114
PID 4120 wrote to memory of 5816	4120	msedge.exe	115
PID 4120 wrote to memory of 5816	4120	msedge.exe	115
PID 4120 wrote to memory of 5816	4120	msedge.exe	115
PID 4120 wrote to memory of 5300	4120	msedge.exe	116
PID 4120 wrote to memory of 3944	4120	msedge.exe	117
PID 4120 wrote to memory of 5300	4120	msedge.exe	116
PID 4120 wrote to memory of 5300	4120	msedge.exe	116

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_4f9a41904f62d841bb4713e8b4220898_darkgate_elex_glassworm_remcos_stealc_stop.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3316
- C:\Windows\system32\regsvr32.exe
  C:\Windows\Sysnative\regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  PID:5212
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1520
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
    3⤵
    - Drops desktop.ini file(s)
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4312
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1956 -prefsLen 27097 -prefMapHandle 1960 -prefMapSize 270279 -ipcHandle 2044 -initialChannelId {552c3b02-7ff0-414e-98bb-04fbb5462838} -parentPid 4312 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4312" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:5868
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2436 -prefsLen 27133 -prefMapHandle 2440 -prefMapSize 270279 -ipcHandle 2448 -initialChannelId {d643dffd-a5d4-4689-9c11-822c7fdea902} -parentPid 4312 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4312" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:4952
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3880 -prefsLen 25164 -prefMapHandle 3884 -prefMapSize 270279 -jsInitHandle 3888 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3892 -initialChannelId {037419ba-889e-4188-8232-c68a9c0e8732} -parentPid 4312 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4312" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:3380
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4064 -prefsLen 27274 -prefMapHandle 4068 -prefMapSize 270279 -ipcHandle 4156 -initialChannelId {13fc1e0b-1d22-443d-88f7-6f7685e56882} -parentPid 4312 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4312" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:4100
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2864 -prefsLen 34773 -prefMapHandle 3008 -prefMapSize 270279 -jsInitHandle 3012 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2900 -initialChannelId {6474aa69-1a5f-4a30-b578-489048da36fa} -parentPid 4312 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4312" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:5124
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5192 -prefsLen 35010 -prefMapHandle 5196 -prefMapSize 270279 -ipcHandle 5204 -initialChannelId {ab4a1b3c-8f78-48f8-bb3d-601932550f98} -parentPid 4312 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4312" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:4800
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5508 -prefsLen 35062 -prefMapHandle 5516 -prefMapSize 270279 -jsInitHandle 5520 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5528 -initialChannelId {7d92c6de-30aa-4da7-924c-15d4e270349c} -parentPid 4312 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4312" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:1404
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5736 -prefsLen 32952 -prefMapHandle 5740 -prefMapSize 270279 -jsInitHandle 5744 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5752 -initialChannelId {0c7d459f-c134-4831-ae19-157cb7e84d25} -parentPid 4312 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4312" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:1140
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5904 -prefsLen 32952 -prefMapHandle 5908 -prefMapSize 270279 -jsInitHandle 5912 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5660 -initialChannelId {406bf6a5-153b-4333-81db-22ecc743325d} -parentPid 4312 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4312" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:4764
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3028 -prefsLen 32952 -prefMapHandle 2844 -prefMapSize 270279 -jsInitHandle 5992 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6068 -initialChannelId {21a5e86b-5c16-40ff-9623-8313382a865c} -parentPid 4312 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4312" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
      4⤵
      Checks processor information in registry
      PID:4808
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3376
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1964
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2864
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.internetdownloadmanager.com/welcome.html?v=643b08
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff803a2c188,0x7ff803a2c194,0x7ff803a2c1a0
    3⤵
    PID:4376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1972,i,17660686343657880062,8297450390348266419,262144 --field-trial-handle=2508,i,8390383591070826979,9281098292787332204,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:2
    3⤵
    PID:700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2136,i,16053603526858444381,15308051971305495606,524288 --field-trial-handle=2508,i,8390383591070826979,9281098292787332204,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,13083169948926350182,13886971430493505033,524288 --field-trial-handle=2508,i,8390383591070826979,9281098292787332204,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:13
    3⤵
    PID:5804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,16991883229947517152,15639363775313528208,2097152 --field-trial-handle=2508,i,8390383591070826979,9281098292787332204,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
    3⤵
    PID:4844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3660,i,9607646503458210038,12923494122312535573,2097152 --field-trial-handle=2508,i,8390383591070826979,9281098292787332204,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
    3⤵
    PID:5816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4316,i,6175269481829586778,12599395274165656719,2097152 --field-trial-handle=2508,i,8390383591070826979,9281098292787332204,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:1
    3⤵
    PID:5300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4328,i,7839350815579335142,2867976916571043385,2097152 --field-trial-handle=2508,i,8390383591070826979,9281098292787332204,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:9
    3⤵
    PID:3944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,272275706437829540,10322660945278687687,524288 --field-trial-handle=2508,i,8390383591070826979,9281098292787332204,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:14
    3⤵
    PID:4540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,15285025137236202724,8314609816995867746,524288 --field-trial-handle=2508,i,8390383591070826979,9281098292787332204,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:14
    3⤵
    PID:1060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,4332663250354048423,6890853150594185617,524288 --field-trial-handle=2508,i,8390383591070826979,9281098292787332204,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
    3⤵
    PID:1600
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,15018658680167003510,14731970683832091683,524288 --field-trial-handle=2508,i,8390383591070826979,9281098292787332204,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
    3⤵
    PID:1492
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,15018658680167003510,14731970683832091683,524288 --field-trial-handle=2508,i,8390383591070826979,9281098292787332204,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
    3⤵
    PID:5280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,56947253639110683,17777901753540980360,524288 --field-trial-handle=2508,i,8390383591070826979,9281098292787332204,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
    3⤵
    PID:6576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,2271941468937353164,15409283624308953810,524288 --field-trial-handle=2508,i,8390383591070826979,9281098292787332204,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:14
    3⤵
    PID:768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1424,i,7382636617811205235,8042655563155981393,524288 --field-trial-handle=2508,i,8390383591070826979,9281098292787332204,262144 --variations-seed-version --mojo-platform-channel-handle=1284 /prefetch:14
    3⤵
    PID:6768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1432,i,11454153399207407835,8244957351946865894,524288 --field-trial-handle=2508,i,8390383591070826979,9281098292787332204,262144 --variations-seed-version --mojo-platform-channel-handle=1288 /prefetch:14
    3⤵
    PID:6780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1440,i,16977677671277021927,15821672062995575196,524288 --field-trial-handle=2508,i,8390383591070826979,9281098292787332204,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:14
    3⤵
    PID:6792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,884944447719012800,13199565055022208479,524288 --field-trial-handle=2508,i,8390383591070826979,9281098292787332204,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:14
    3⤵
    PID:6624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,10555374417960042370,6017459234729986317,524288 --field-trial-handle=2508,i,8390383591070826979,9281098292787332204,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:14
    3⤵
    PID:7012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,17527015703854982947,9878481433220466061,524288 --field-trial-handle=2508,i,8390383591070826979,9281098292787332204,262144 --variations-seed-version --mojo-platform-channel-handle=1284 /prefetch:14
    3⤵
    PID:5280
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3316 -s 1764
  2⤵
  - Program crash
  PID:7020

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3316 -ip 3316
1⤵
PID:6964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 2d6eb838aeeb4192174d7f5312416a8ad6e6a941da4ae0cc9093a9a03f496235
MD5 89465cf25108f7806ee660a6aa635989
SHA1 61566141ad719cd5a80282e3b7a7414c71e8453f
SHA512 fe50bb85c66c1a6a6d4faa6f5c3648071d1ee4b8073761525924cbccefc7e2a0425d72b02a725e0b3224272d45e33784d7af464bf6e893145d9de9be6dae595a
TLSH
T15C314F708F3426FFDBAF49B657E28A9C3271885F37076E512394AEB44E4A377111005E
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 6001def7a32f1d9c199336e5d2accaa227f3c681dcc5972eca90c34bcfb451bd
MD5 ec071e58ec42e9a0ce0b2e14b6416095
SHA1 e2253d499476082f58a86d82d16a766774ad1bfe
SHA512 02f642a552d92ce15d3e6892e7f73fdf64209d08357651a58781d7d1b6e6c7c20d29918acf8befd15d062e3dff07390ebba7f935de476a82f2e538f441931f19
TLSH
T17341E1F383F4856D8E1196F0AA186F1FCE2D0515432C7DAAC5E0AE2B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 3add235a5bfca95b264509dbe4f7bedb3cce393b5c09981ae790c16d3f6405d2
MD5 8735d527464063125c69d3fd1b94e46a
SHA1 ce4a7079c29aa4120db95cad4b306115dc79db2a
SHA512 8806597c5192743f2412b54014e9ea476983718047ce61756741bd7c1f6bccd2c9aaf5e04fca9d5c2f20202a9cdc1361abaeaa10bf8b95f0d24da0c21c16ac4f
SSDEEP 192:sxR4krCu/fFsD9KwGbzoA8ppJ/g6+WNYHU/YoMjAYp+GyyIgV4cHJ:sxRbeu/fFsDAp6v/5r/JIoSC8
TLSH
T18D42B7166968A93B4CC7E21DBA65BF53D3F95032A1D46E48B7FC961C00E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 30a9edd306fb2ad61f30ca1487e3718df5c5af7cb97b55db6649689ae030b8c2
MD5 31a24f21ff60a5eb6fbe43986178c9c2
SHA1 b837ff9bf3d7eae17abfa0b2486345db92f47ae6
SHA512 2615beae9407eb12a9d47a31c7e19a89784f672ba0f412433a0580e719dbe87229bba2bb03915375d52387680a38ac01907c3320ec4758a08458359a3d6e0692
SSDEEP 192:sxRrkrCu/fFsc9KOZCGdQiGzoA8ppJ/g6+WNYHU/Yoh7AYp+GyyIgDO4cHJ:sxRgeu/fFscAo4i7v/5r/mIoSH8
TLSH
T1D54296156D68A93B4CCBE21DBA65BF53D3F95032A0942E48BBFC961C10E76DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 96d87a709d3bdbbc3f93df7409f5aa3b4b34f760deb20f2f59dd979996431fac
MD5 39a156a3c4c68096694d80e94f14b346
SHA1 681b319e99bc8ce4e06baba637c7127467c67e91
SHA512 40a5b40a1a16a49e26622667cdb3c9d3b0c80886447d488f4f63c43ad73a8b02c8e39337f910be4c9052dc5c69051ce0ebeac80a8c8d071926bde7b14b578a9f
SSDEEP 192:sxRrkrCu/fFsc9KwGbzoA8ppJ/g6+WNYHU/YoMjAYp+GyyIgDc4cHJ:sxRgeu/fFscAp6v/5r/JIoSJ8
TLSH
T1CF42B7166968A93B4CC7E21DBA65BF53D3F91032A0D42E48ABFC961C00E66DD620781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 eadb8316f7aca16cef8d72a4e79cce732931efa02dac13403f2d02b5eda8f090
MD5 382453ad9b6abb949ecd2b593607ca36
SHA1 138165e99f0194e7c171b38f914f0b64985c4df9
SHA512 bd9a515e0e8ea0c2849e570796c74b0e779d8e8591d3e3d4944d51ee0c20c7aaf25695f6bb4de51cdcedaf9180a8b1e9355e418af72625e8fe63bd6c4163e00d
SSDEEP 768:j26HWo7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVvVuwFro9Se0Ur2:j26HWUE7MRWgs2f02u1jaO4w+t2
TLSH
T1ECC2CB7B740DCEBE4F800ADDDC197E9F6D6802CB9698CD8047FE951C02C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c4b16f158e9892a91529e03881b9c2a2d849cb6e0c7f89beca29790ee709585e
MD5 ac0deb4bb93cb4077f392ee3467e634a
SHA1 9ceea025ea7b78f65cd97a0d7f76ac78c2910edf
SHA512 519e0b16229188a17775c9a02059756682ee9f541635d593ae1194c8a3b9992a4e51c11ae4eebd5aec4057c3e62edec8375976e3bc994024136d384ecaf2168f
SSDEEP 96:KRENE8EzEnE9EXErE/WEzEoEWgEvE/K4EugERE/cEVEtEgEDEbEUHEuEDESEOEoY:CENE8EzEnE9EXErE+EzEoEHEvEFEugEv
TLSH
T12BA10A50B43B4381397DB60CD4B88D5E82D27896345DA5AB3B940661CF6FE538EFC8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

31484885-8848-475e-ac51-0d46e682a82e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\31484885-8848-475e-ac51-0d46e682a82e.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 80ace5f8284df7d6fc8f4f44457b87e39ac16358ba16b63dede3074654ecf5ce
MD5 791e7f5c268e5d7505718cb2063e1de4
SHA1 b45666b3f06c85124acc08f626b0772b729be1a2
SHA512 cc1745df93bf269106db9cbf59721eb75dbe07f50eca7932c99a1355936253aeb4c8312e65931915405d2762360c6a94ac252570564c9302159eb8e5b4dfe41c
SSDEEP 768:XFQk3Mwg6+uVsOWZAGPONXyer1IRCzni9Ly3ba:qk3/0SIqnksa
TLSH
T1D21328F594D38A37D8AE5383A33D6E429EBCD063B5884990BBD55E4DCC8257FC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 01bb9eaeca9937675fd623a2de21792386c9abbcf116c71c44d0a489d243d149
MD5 2a91e3f7f43aba0b9c11ad567ea7a629
SHA1 35525fa07812478a0400f09c760e231a65fd93c8
SHA512 a5ade83fd6571fe7a6219e3648f5eb6b707be6effbdca71e59fc3e2e8836422b14a2a0f0a83062c386748db4a7051882ec4519fe51df6360090357cf01d28da9
SSDEEP 768:hrv+4UNbdz398/TBOWZAPONXyer1IRCzniB8eVH1SK7:hbsbV3eCSIqnfEH1l
TLSH
T18503CF32E4A89E374DE2A3C6B14773437FB85057C6840790EDEA2F4E069B59D130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 f420e5827ae0fefee8dfbefd56d06b40a7cee1bbf501beac8f7173f1cd1d90d6
MD5 d1f5de6f5980aab954954dadd58e6e67
SHA1 f78a8f26c041c1c9ba4e084390647632de5bb9cd
SHA512 530762ca2349847ccb125d6b18832d8d7de72882d93c381095893a4534dd6a0f74724e5fbc983088053d9b3415c525456b1504160098d1c0609222dd494aaada
SSDEEP 768:Nrv+4UNbdB3/zNJ/TBOWZAGjONXyer1IRCzni9Ly3b+:NbsbT3TxSIqnks+
TLSH
T18B03BF31E4A99E334DE2A2D6B14B77937FB8206788C40B50EDE56F4D058755E230F817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 101989f3dd582802ec274917bb804561472b52429dd41f1aad52197d17c8c9a2
MD5 73d692edf712bcc66f78588106860471
SHA1 a5797dd99089807f8f868c8b70a76180d8d53186
SHA512 1df7af6365838a80bcaaa8191493b3ab7781ce49021b847d276ebc677e753c18356429cfa1d7ef1b72cbf71caa0f90ac14b5792d8346e77088615dd31b36c29f
SSDEEP 768:5q3t0J/TBOWZAGjONXyer1IRCzni9Ly3ba:5q3ExSIqnksa
TLSH
T1C9E29E30E4A69E334CE6B286B2467793BFF86067D5C44B50EDE9AF0D058765E130B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 3412e97a2ddbaef42c1f8492fae74852f04499ad3f2b5cc60e244fed0571f877
MD5 cf4caba4c76db7106a49534ca2877e38
SHA1 810809bdca8c0e56d10142469f4fe7b0d157f77a
SHA512 0a3dd920ead08e526c18fe6563362882a1f80f42cc2d3ac3fbe347e89b2be132da247730e19b39b6d0244976c80f1124e0ccc9398a53062974b144fb4d3b0d12
SSDEEP 768:Hrv+4UNbdz32//TBOWZAGXONXyer1IRCzniwLeVH1SK7:HbsbV3iJSIqnnEH1l
TLSH
T16B03B031E0A9DE334DE2A396B14777537FB8206789800B90EDE56F4D069759E130F91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

38ebaf87-d377-40d5-aeb7-706952854020.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\38ebaf87-d377-40d5-aeb7-706952854020.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 0432539adcd075026338d19e22c5f6e8f0dca979420bd491d6ee7a464e74165c
MD5 56134c42d95f307b8c482c5977f90dee
SHA1 0f8aa1623da24be919e2dd8c6663c72adf560a36
SHA512 117cf65af8ad2f0be6352e9c3bf75f3f6f1a9ffbc91c64519ed7b0be93be1c368f6e6c0cde4cbddfe86a951dc84de507cd1c2cd7fcdddc3dc60dedeb8f5c271a
SSDEEP 384:HXkRyiO024YYDL84KKDL849B7SOEAd9KVRaAcP+AWRMAV:3mZYYDL8lKDL8CB7S/AmVAf+hRM0
TLSH
T1AD728E3D4F003CAC15A7C0E8C5B992AA4D08B7A7CFE6806D21183D0DC798969B5F948F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 2e3d0610281e66e5536b0ee2ff117aa9edbd84755d08754651c1929c7a9d36ba
MD5 f27f693e1fe7761f17c59d02440bddd9
SHA1 487e2130263ae63535a5d235df2eb6ef1f97b9ea
SHA512 3187c49d67bb75ecb87d460dc48b2829439a6317a6de341b2a5c34ea0af8f2b87e0ea00018c56870ecabedda484b330238baf48f21ced967c6b9f10bf8367b14
SSDEEP 3072:j3lq+ZFq8j/xE+DuiXXRVHeMTWdcHGzSmgbTz2YB:p9RjpXDuwXn+kWymzSmI5B
TLSH
T18DB3AFF6DFE28D7D69FFD41D5A93C83EFD222400B3A7200AC9132715A2C6B746679648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4120_1491327013\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 34KB
SHA256 87a586ce2dfa2be5ee25e34f8408e270279f191c580d4851a101e69169c5fb12
MD5 22e1318f88b11e6571b993276387fa62
SHA1 e1727d16d03da8472f8bcda27db6a424b44d9c5a
SHA512 78fdcdb8c2c2199db0e21219b894391b76ffb5a2e1f51feb8940d7b20d573407a5fdb09ea9ae5eb2b57a236bc60e7c876fe6765826952c4ae1be8080a4e163d3
SSDEEP 768:F15L+/zzbw0D0Gcm+uGnG0FKqT/Cinx/bNb+bQb3b7f4wt+:ZL+/zzbWnG0FH8
TLSH
T1B8F20044FB2E953FD42812BBDCA50B042F79B88A591A2F573A4C64686C872DC3D5E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 34KB
SHA256 76f6a32cf3389360e2def544194d9e789f298213a34be8940e5cce90fdf3e89c
MD5 1d0d87796a30de60311d11830841f7db
SHA1 627caecbb74497ef846917c041279e0ab3d63ec6
SHA512 a30e05ae0fc7c4d6c4884801fc3d12f0216d808a476776bf5d37f15c935b77c1470d49e0b8a69a17b733143c569af5c3c1409f98bea17ca1706761f9b3cd4dfa
SSDEEP 768:F14tqL+/zzbw0D0Gcm+uGnG0FKqT/Cinx/bNb+bQb3b7f4H:jL+/zzbWnG0FH0
TLSH
T15FF20044FB2E953FD42812BBDCA50B042F79B88A591A2F573A4C64686C872DC3D5E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 336e5062113492118ed6b48b4a522c9d1e88e91e9ede9fec311dcfe24d493a3e
MD5 c94963169a3cb4cc162a0beba841a282
SHA1 0a887ca5d8e8a5b3253846bc045b81486ab6b3c4
SHA512 82883286221fc1bd70a2a3b1177a11e9715af61f99f8e1aee13638adeb4d837e8462befefc52b146ec05de46e814de3fa49ca43cf2fefe1461a3547f3d969096
SSDEEP 768:F13NDsf7Gcm+uhJRN8i0m8bTbUb3bHsP+:XNDscJjD
TLSH
T126D20144EB2E953FD41812BBDCA55B002F79B88A58192F573A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\events\events
Size 1KB
SHA256 86c76e45fb9aaf6dc1034334aa476add5d40112f51e07786e171d5dcd38ed2af
MD5 3e7049934fdeec20e8634a4ce2895597
SHA1 b3f14e935d6c9a5d960162de498927e7bdd8e605
SHA512 4c4655ba9c9cbd1b8c7fa61d3931a02380a859b50cf416063d701be873d1df24a5b7e435839541d50221aba0a13fe04c4a6d21f6f3ea619a3fe62a5c6db08864
TLSH
T1CF217C5C39FA4D3A6D87E2DC7490028EA3548E8F04871C434F52EE8DCE91AD9326E47C
MD5 SHA1 SHA512 TLSH

Submit Download

7b20c40e-429e-4961-9e8b-ce8951af07da

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\7b20c40e-429e-4961-9e8b-ce8951af07da
Size 235B
SHA256 0d78b1da5281515c84a6aee974c0dd2023b2e3dfc14cacf2abf29502869820c1
MD5 ffc120b6867816a533ea12f24996a696
SHA1 e83ee0d2b04a05f3f854fd713650e2d2d8d58d69
SHA512 0666a15503c50f9a511d0fa5bdda7adb00f76d59edac109972b00fd85c3d0bbcf6a7867cf836210ae2692c682524d37397eb451d240f0712fd18c6c7ea12260a
TLSH
T1BED0A7802899A77D48141F1BF1B269D630444C3724B558549A61457C9AF9FC582B7816
MD5 SHA1 SHA512 TLSH

Submit Download

80502ed3-bcbc-4031-bdfe-c95f47500d94

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\80502ed3-bcbc-4031-bdfe-c95f47500d94
Size 871B
SHA256 d9bf95c910e4f108d957d7537e8e802451e974b308e822a403a769f634b6c844
MD5 9bf71e81f040c392f5ca1f8b170fc352
SHA1 d05e7355a2cea835bd90b8a0f5a75a4a51c8c357
SHA512 646d567631c19f71b14950ac49bd80f91f3fc8fc967262523e78e72044baf4e4a5ed96c2049d572517c245aaa04487c0e08c077ee685c01d179fdead05c79da8
TLSH
T104112340C63176B2CC28D34BC9A67711CFF4B51380C644043DF54A184E7E65FA76A347
MD5 SHA1 SHA512 TLSH

Submit Download

8b1f6508-08a4-4812-b39e-d506a4a35f6c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\8b1f6508-08a4-4812-b39e-d506a4a35f6c
Size 2KB
SHA256 1dc2013cee63c121c9c519d9f7a11772835d09562155ab7e63d3ff192df17f11
MD5 e289f180e050a183ddb4f0f95edca9ec
SHA1 a425b0c5dd37ce95f4ff836293a658ca5a75ff79
SHA512 35f04842ebd3bf74cd50b2654836027a5ed99527e078ac7a38a96f53d11a2ee8d2d3497b93f070e92edb9caf072ab8d90fb3fbcf9f719be29cc26aa735411b89
TLSH
T1FA41311C75B85C368CD6F25DA496338A97A19A0344C21C833E51EF0CCE9669E336B42B
MD5 SHA1 SHA512 TLSH

Submit Download

8c92ef4c-5f8b-40fd-8d88-72d639a1f4a8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\8c92ef4c-5f8b-40fd-8d88-72d639a1f4a8
Size 235B
SHA256 3d647263ece2cab4213c0aa63f7bf0a840e18173267dec4264aed0e1573b26f4
MD5 f220d1fddb4acc43dde724ab0bb8fbf5
SHA1 3251fb1fd05173171fd1d288be15d86b59558bdf
SHA512 2b489ec213a6efe3fec3f9a814daf813d252a77b619832500075addd10cbeac8474d3a02d9e0d1f7d76b4cbcaf0a41f4aa0ad1662867677034e9df4a1e3f318d
TLSH
T116D097802498232C18240F03F0B038C6B0488C3310BAA810CAA244B48EB9AC882A2D2B
MD5 SHA1 SHA512 TLSH

Submit Download

e6ea5edf-1506-4a02-9a1a-2acec6615c96

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\e6ea5edf-1506-4a02-9a1a-2acec6615c96
Size 886B
SHA256 4226308bb380f27c9c2ea1f5300fecaf4a9690c94bd61a9eeb840f6f6b3abd93
MD5 887edbd0db9cad400251fe0a103726b6
SHA1 3d8e280e231f2d23551822e7281b135a601805fe
SHA512 8a4e142eb3121c17e205698d0eb206ab296b56e80b8a1b29db0e84e6a86a9f0dd1878f2eab03395a0993bf3c162e1a43a7cefb1da6f067213cac755a6738e517
TLSH
T1D1110040CA7575B3CC28D38BD9E677428FE4B52380C609087D995A184DBA65EA79B20B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\extensions.json
Size 16KB
SHA256 eec51a0e5dc8ee76b95d385d4ecbe84337eddc750cd45fb25a67422235e67df9
MD5 e7e6221f4b7fa74e1599631e7852e0c1
SHA1 2f4483ba27d6ec4537c660f48ef23bc70931611e
SHA512 eee99669fb63a5a398a36e1639baf67af596064aa499a7c7898dae9d930438f25a0fea886cc3ed51cccdf833773f33451440ca3bcbe6fa9b8547b7d3d3b345d4
SSDEEP 384:qkI4v3Umldv/8dhWW94zg96oNL4H1L4PCL4HtL4HCL4HdP4hq:NI4fRfsXH446+4V4Y4N4Q4R4Q
TLSH
T16B72531545048EB8298EA79BAA367E01C37D533B60855C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
Size 6KB
SHA256 9f652cb1dd385887a9a004cdcb9e91f74c58215c36a285c1e450cb02b652f7a8
MD5 6c450cd6a21dc488a0818f9e37e5c043
SHA1 fb8d2122d2fd52e629c578b494e22f092650823c
SHA512 0e82f73e0d01fe65b30bf3e081e85a48dccf990c4148fdc0c3ea6e32910a2df41180c9f6a6c9bdd81b3f913fcec242321168f84e5ae53dcb7855a35be66164a3
SSDEEP 96:xHpUTUWqGqPf2BgG1zS6qzSSlvdv9j2n+cHjCa/Bw88u8L4cnAV7wb:vRRPf2BgGISSWj7/Bw88qU
TLSH
T101E1217894088F7F64B677BCAC688831AAB2413B7BBF68C750B95484055CF3441F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
Size 6KB
SHA256 fc7fa1933c2c1050518ced99d5409174a7383d580d15cc47a990eb6c8632fa6b
MD5 17bc984aadabf753d45970b471c9e0e5
SHA1 3a330f3512632143826c00521fa118c363bda53f
SHA512 2b4dfec33875010fa8f2973824c697169ef42faf08b968b3a45d3b0786bc713afe9a17c5ecdf6bb888af205300e741f077d494b7fa32c62ee0400c483960bf08
SSDEEP 96:xHpUTUWqGqPf2BgGObzS6qzSSlvdv9j/n+cHjCa/Bw88u8L4cnAV7wb:vRRPf2BgG/SSfj7/Bw88qU
TLSH
T1D1E1107894088F7F64B677BCAC688831AAB2013B7BBF68C750B95484015CF3841F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
Size 7KB
SHA256 aa42fe8a98504943e91f2ffd9ab99b2f19b90339680cc63dfe0f71d309ad081f
MD5 0e49962a14435e1a18ff38c036f0f56f
SHA1 125ee00084eb3eb14db9124310e73f823ae1258f
SHA512 d3dd8b5092eec97d82364be8a1ad1a084bd9888ffd12347fe308082767f1fb6dc0f3fc44b79dad7987b9171f1593883083c3145a8546d18606aa6ad51b0b2e97
SSDEEP 96:xHp9TUWqGqPfAgGObzS6qzSSlvdv9j/n+cHjCaCBw88QS8L4cnAV7wb:vwRPfAgG/SSfj7CBw88TU
TLSH
T1D1F110789004CB7F64B676BDAC6848316AB2023BB7BF68C711BA5489015CF7441F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs.js
Size 6KB
SHA256 84ac9e0c481f6a20a8df312b2891a8f8a4ebdbebb77db3178e01bf79ebd0c21c
MD5 bbfd9b035962469c66650bf6650bdbdd
SHA1 0b244be15427d97a1e01ebb40d2d0fcfc98140f6
SHA512 35026290cedf922d5cc13d9ee340b5bd7e65e5e347ce62aecf2a65776f1b40ceefd7c9afd77fb5650dd03e751d69b45a5ae66c850678a4537f6e8b8573efe03c
SSDEEP 96:xHpUTUWqGqPf2BhQ1zSorSSlvdv9j2n+cHjCa/Bw88u8L4cnAV7wb:vRRPf2BhQ/rSSWj7/Bw88qU
TLSH
T192E11F7890088F7F64B6777CAC688831AAB2013B7BBF68C350B95484055CF7842F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 1bde833bb0ca5fcadc6e7e90e5b1edc825fd6964eb072fa688bd8e296c50a20d
MD5 d24fddf6d7725b48041b92a4dc1fc324
SHA1 13a734f291329aa7813e6b7888c3a48034d291ea
SHA512 b6e5bf376d677058c28fd8061812ccb321e9dfd95e7845d1dc32cc47239c7e92b293c7877d6292412bbc11648304000f872964295f1a1a2a4d7f535c69d4269b
SSDEEP 96:dCfRd99jN+ZEeW9jILA0NjoB8kMJttn0YJZQFw:+Rd99JNOnNcB85JttnTZqw
TLSH
T1E8919E45770F2C67FD1B468FEE064CF14460314A968080E890CE2F36B62FB0B7464475
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 a9748ec7bc13a3520dcac7ece3c4c328e3b11333779828502a5fa83687bea22e
MD5 c5864ed214fd46466c3e836cf4b9252c
SHA1 2036b1692971e3480168fa0342f24a132b674ab8
SHA512 95166f0428b34e2bfc853d9d32ad073d05075c372dc429030e21f1ee16536965cd5ff6b50233c5241593542ac9b3c5d09f6cb8e0be4aa995c69110ba453145c5
SSDEEP 96:dCfRd99jN+Z+eW9jILA0NjoB8kMJttn0YJZQF2:+Rd99JPOnNcB85JttnTZq2
TLSH
T171917D86730F2C67BD57468FFF064DF14464304A568584E890CE2F2A765FA0B7864479
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads