18f812937e3f6babd95a79fc6a6778173eddbe9ffa8f985bf9b3662941c74c8a

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 06:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
Size 5.9MB
Sample260824-g2p85stdnh
SHA256 18f812937e3f6babd95a79fc6a6778173eddbe9ffa8f985bf9b3662941c74c8a
MD5 8b65f93dcb6a1ca434853bcd812f5e6d
SHA1 c9a61a253a809a3531d992d5ca36e6eee89cc633
SHA512 ee3219a06c08785567ecda5c1f8c3b26460fe5ff7a7908a9cf3527c3798226e3fc7ac4b707445ff6441f308a0c94520b07008c3014d3bc918c16761e26bd0e8e
SSDEEP 98304:zpMrRpuY+p0aOzP4BR8qLf3gbz2FSmaI7dlJuX:cRpuY+ptPQbz2FSmaI7dl
TLSH
T1FD569D51BE8D8176D90B117247299F2A1029BD247B3865D3B2B43F7EEC323C16D3A61B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery persistence spyware stealer trojan

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe /onboot"	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1261122877\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_2784_299341805\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_109_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1261122877\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2784_1035174381\service_worker_bin_prod.js	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6340	4144	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4472	msedge.exe

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 22 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243"	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Low Rights	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe"	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3"	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3"	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe"	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm"	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe"	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3"	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134320259516690214"	msedge.exe

Modifies registry class 19 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan"	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3986082593-3624157295-3514260330-1000\{42AEA23C-B29A-41F9-8186-318367673B41}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter"	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1"	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe"	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User"	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Model = "235"	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Therad = "1"	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\WOW6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	4144	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
Token: SeDebugPrivilege	4492	firefox.exe
Token: SeDebugPrivilege	4492	firefox.exe
Token: SeDebugPrivilege	4492	firefox.exe
Token: SeDebugPrivilege	4492	firefox.exe
Token: SeDebugPrivilege	4492	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
4492	firefox.exe
4492	firefox.exe
4492	firefox.exe
4492	firefox.exe
4492	firefox.exe
4492	firefox.exe
4144	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
2784	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4144	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4144	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
4144	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
4144	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
4492	firefox.exe
4144	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
4144	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
4144	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
4144	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 1540	4144	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe	89
PID 4144 wrote to memory of 4716	4144	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe	90
PID 4716 wrote to memory of 4492	4716	firefox.exe	91
PID 4716 wrote to memory of 4492	4716	firefox.exe	91
PID 4492 wrote to memory of 3772	4492	firefox.exe	92
PID 4492 wrote to memory of 3772	4492	firefox.exe	92
PID 4492 wrote to memory of 3772	4492	firefox.exe	92
PID 4492 wrote to memory of 1916	4492	firefox.exe	93
PID 4492 wrote to memory of 1916	4492	firefox.exe	93
PID 4492 wrote to memory of 1916	4492	firefox.exe	93
PID 4492 wrote to memory of 1916	4492	firefox.exe	93
PID 4492 wrote to memory of 3516	4492	firefox.exe	94
PID 4492 wrote to memory of 3516	4492	firefox.exe	94
PID 4492 wrote to memory of 3516	4492	firefox.exe	94
PID 4492 wrote to memory of 3516	4492	firefox.exe	94
PID 4492 wrote to memory of 5624	4492	firefox.exe	95
PID 4492 wrote to memory of 5624	4492	firefox.exe	95
PID 4492 wrote to memory of 5624	4492	firefox.exe	95
PID 4492 wrote to memory of 5052	4492	firefox.exe	96
PID 4492 wrote to memory of 5052	4492	firefox.exe	96
PID 4492 wrote to memory of 5052	4492	firefox.exe	96
PID 4492 wrote to memory of 5052	4492	firefox.exe	96
PID 4492 wrote to memory of 4384	4492	firefox.exe	97
PID 4492 wrote to memory of 4384	4492	firefox.exe	97
PID 4492 wrote to memory of 4384	4492	firefox.exe	97
PID 4492 wrote to memory of 4384	4492	firefox.exe	97
PID 4492 wrote to memory of 4964	4492	firefox.exe	98
PID 4492 wrote to memory of 4964	4492	firefox.exe	98
PID 4492 wrote to memory of 4964	4492	firefox.exe	98
PID 4492 wrote to memory of 4964	4492	firefox.exe	98
PID 4492 wrote to memory of 2772	4492	firefox.exe	99
PID 4492 wrote to memory of 2772	4492	firefox.exe	99
PID 4492 wrote to memory of 2772	4492	firefox.exe	99
PID 4492 wrote to memory of 2772	4492	firefox.exe	99
PID 4492 wrote to memory of 5456	4492	firefox.exe	100
PID 4492 wrote to memory of 5456	4492	firefox.exe	100
PID 4492 wrote to memory of 5456	4492	firefox.exe	100
PID 4492 wrote to memory of 5456	4492	firefox.exe	100
PID 4492 wrote to memory of 1372	4492	firefox.exe	101
PID 4492 wrote to memory of 1372	4492	firefox.exe	101
PID 4492 wrote to memory of 1372	4492	firefox.exe	101
PID 4492 wrote to memory of 1372	4492	firefox.exe	101
PID 4144 wrote to memory of 1276	4144	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe	102
PID 4144 wrote to memory of 2612	4144	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe	103
PID 4144 wrote to memory of 5464	4144	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe	104
PID 4144 wrote to memory of 1640	4144	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe	105
PID 4144 wrote to memory of 2784	4144	2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe	108
PID 2784 wrote to memory of 1460	2784	msedge.exe	109
PID 2784 wrote to memory of 1860	2784	msedge.exe	110
PID 2784 wrote to memory of 4472	2784	msedge.exe	111
PID 2784 wrote to memory of 1860	2784	msedge.exe	110
PID 2784 wrote to memory of 1860	2784	msedge.exe	110
PID 2784 wrote to memory of 1244	2784	msedge.exe	112
PID 2784 wrote to memory of 1244	2784	msedge.exe	112
PID 2784 wrote to memory of 2036	2784	msedge.exe	119
PID 2784 wrote to memory of 2036	2784	msedge.exe	119
PID 2784 wrote to memory of 2036	2784	msedge.exe	119
PID 2784 wrote to memory of 4652	2784	msedge.exe	115
PID 2784 wrote to memory of 4652	2784	msedge.exe	115
PID 2784 wrote to memory of 4652	2784	msedge.exe	115
PID 2784 wrote to memory of 6120	2784	msedge.exe	116
PID 2784 wrote to memory of 6120	2784	msedge.exe	116
PID 2784 wrote to memory of 6120	2784	msedge.exe	116
PID 2784 wrote to memory of 4188	2784	msedge.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_8b65f93dcb6a1ca434853bcd812f5e6d_darkgate_elex_glassworm_remcos_stealc_stop.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Windows\system32\regsvr32.exe
  C:\Windows\Sysnative\regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  PID:1540
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
    3⤵
    - Drops desktop.ini file(s)
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4492
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1952 -prefsLen 27097 -prefMapHandle 1956 -prefMapSize 270279 -ipcHandle 2016 -initialChannelId {ba5c3b93-6be5-4bc9-8d09-04e721c1dcd5} -parentPid 4492 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4492" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:3772
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2424 -prefsLen 27133 -prefMapHandle 2428 -prefMapSize 270279 -ipcHandle 2436 -initialChannelId {fb8e920d-d328-406b-84e1-ef5c979e2737} -parentPid 4492 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4492" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:1916
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3900 -prefsLen 25213 -prefMapHandle 3904 -prefMapSize 270279 -jsInitHandle 3908 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3916 -initialChannelId {3e1a204b-9c84-4e80-802d-325eb9a235a7} -parentPid 4492 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4492" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:3516
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4112 -prefsLen 27323 -prefMapHandle 4116 -prefMapSize 270279 -ipcHandle 4200 -initialChannelId {d7ee81d3-99ce-4d9d-996d-4bd179dd2cc1} -parentPid 4492 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4492" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:5624
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2988 -prefsLen 34822 -prefMapHandle 2624 -prefMapSize 270279 -jsInitHandle 2844 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3104 -initialChannelId {1c18b5a6-d398-4ec5-9f9a-4a977e7138fd} -parentPid 4492 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4492" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:5052
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3188 -prefsLen 34903 -prefMapHandle 2724 -prefMapSize 270279 -ipcHandle 3164 -initialChannelId {b24b674d-259c-4488-bc16-05fbd480b008} -parentPid 4492 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4492" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:4384
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5528 -prefsLen 32952 -prefMapHandle 5532 -prefMapSize 270279 -jsInitHandle 5536 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5544 -initialChannelId {a4c86d0a-e147-4fa1-89f8-20ca4cab2488} -parentPid 4492 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4492" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:4964
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2568 -prefsLen 32952 -prefMapHandle 1112 -prefMapSize 270279 -jsInitHandle 3444 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1100 -initialChannelId {4ea66825-fc1c-4f36-81a6-755748961ed5} -parentPid 4492 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4492" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:2772
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5864 -prefsLen 32952 -prefMapHandle 5868 -prefMapSize 270279 -jsInitHandle 5872 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5880 -initialChannelId {3b1dc773-8c7e-4ea7-a800-dc2255353398} -parentPid 4492 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4492" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:5456
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2868 -prefsLen 32952 -prefMapHandle 3248 -prefMapSize 270279 -jsInitHandle 5864 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5808 -initialChannelId {24218f32-97ec-4de0-8e82-77cb0eda3d7e} -parentPid 4492 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4492" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
      4⤵
      Checks processor information in registry
      PID:1372
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1276
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2612
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5464
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.internetdownloadmanager.com/welcome.html?v=643b09
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7fff1bd5c188,0x7fff1bd5c194,0x7fff1bd5c1a0
    3⤵
    PID:1460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1572,i,15592349364968945604,12654042018180163986,262144 --field-trial-handle=2300,i,6485761139689091620,6554498665098769673,262144 --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:2
    3⤵
    PID:1860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,14722977432747199347,2166233830580570021,524288 --field-trial-handle=2300,i,6485761139689091620,6554498665098769673,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2544,i,8063301601633726976,11271663867051482074,524288 --field-trial-handle=2300,i,6485761139689091620,6554498665098769673,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:13
    3⤵
    PID:1244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,8112032066542891598,10955649619020832872,2097152 --field-trial-handle=2300,i,6485761139689091620,6554498665098769673,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
    3⤵
    PID:2036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3552,i,14769895083598022107,2940775837754270475,2097152 --field-trial-handle=2300,i,6485761139689091620,6554498665098769673,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
    3⤵
    PID:4652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,11122880378234852470,18072282604928400352,2097152 --field-trial-handle=2300,i,6485761139689091620,6554498665098769673,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:1
    3⤵
    PID:6120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,14392453170437488916,11209621686959947019,2097152 --field-trial-handle=2300,i,6485761139689091620,6554498665098769673,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:9
    3⤵
    PID:4188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,2325322533340574029,11390931058040759236,524288 --field-trial-handle=2300,i,6485761139689091620,6554498665098769673,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:14
    3⤵
    PID:2036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3532,i,5373621985982636465,12627343979509438780,524288 --field-trial-handle=2300,i,6485761139689091620,6554498665098769673,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
    3⤵
    PID:4356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,23935110461265245,3102140572880780853,524288 --field-trial-handle=2300,i,6485761139689091620,6554498665098769673,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
    3⤵
    PID:5008
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,7852261741354510647,9834650776827049515,524288 --field-trial-handle=2300,i,6485761139689091620,6554498665098769673,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
    3⤵
    PID:6172
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,7852261741354510647,9834650776827049515,524288 --field-trial-handle=2300,i,6485761139689091620,6554498665098769673,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
    3⤵
    PID:6220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,4350383773231076795,1392434602488750995,524288 --field-trial-handle=2300,i,6485761139689091620,6554498665098769673,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
    3⤵
    PID:6468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,10816517554037514496,8738835595775852776,524288 --field-trial-handle=2300,i,6485761139689091620,6554498665098769673,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:14
    3⤵
    PID:6484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,182622937696537743,6526015054295215990,524288 --field-trial-handle=2300,i,6485761139689091620,6554498665098769673,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:14
    3⤵
    PID:7092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,3366935662589316819,1459154881300123330,524288 --field-trial-handle=2300,i,6485761139689091620,6554498665098769673,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:14
    3⤵
    PID:6364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,17002903212997701676,12555685353604112396,524288 --field-trial-handle=2300,i,6485761139689091620,6554498665098769673,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:14
    3⤵
    PID:6840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,3631567067640591573,6480741979088271031,524288 --field-trial-handle=2300,i,6485761139689091620,6554498665098769673,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:14
    3⤵
    PID:6848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,11931182583975441221,11992464214235382232,524288 --field-trial-handle=2300,i,6485761139689091620,6554498665098769673,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:14
    3⤵
    PID:6852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,9242434452959019091,18168652372320081033,524288 --field-trial-handle=2300,i,6485761139689091620,6554498665098769673,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:14
    3⤵
    PID:3248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,2728476187176855143,11711194038928245444,524288 --field-trial-handle=2300,i,6485761139689091620,6554498665098769673,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
    3⤵
    PID:6452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=948,i,14883131892830330760,5530127134955135219,524288 --field-trial-handle=2300,i,6485761139689091620,6554498665098769673,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
    3⤵
    PID:7120
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 1980
  2⤵
  - Program crash
  PID:6340

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:7152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4144 -ip 4144
1⤵
PID:6312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18a644ba613d5b4137dabc346f57eca622b6888922eaec751025ab3c0a002fd5
MD5 5eddc74c05def624cfd47ea0a7e304a5
SHA1 b5f795fcc3846bb781e66e0373fce119975b2659
SHA512 1c777d774c154e89b80817ce7344495d83eecf133c36e0ad7c60dd14d76e628697535cc3fc379ca4eeb776f3bea5096f94d0fd76a2394ecd2e52f5ca8dc0053f
TLSH
T133D09B5672455C4CD641343224E55217E3008821654546194353F0768DD668717ABD9A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da739d58d61b2ac7b5d9bb7ad60982cb15b364d9c7c9297fd0c9719c271cd985
MD5 2d2e0ac0da9a175b4b6a8be7c9d51cce
SHA1 ff15c8a5ff11faefae3f7491c7968a2163702b81
SHA512 0ae78f15909f04e1a81109917b8eeb5b8062a49558d8a40f15c02076b087f36e82b88b329e9d984fc68c62cb15408123b9db7f705f2745bfefc30b5aa2e164e6
TLSH
T1EAD09B5A72455D4CD641343224E55217E3108821754546194253F0768DD668717ABD9E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 24da0d0103c93e7090f74a97d6aca2c0fd0202469873436316ab16b5b651696f
MD5 437e361f527464b6d31da47b3f332552
SHA1 ff003019c57dafed01ec1f0c17cac5a17f1e2dd0
SHA512 6e0240e6026d142e78db2c2adb4fb53a6bd8afd9db276ea4fe584788fd9c39e1a62eb7748bb78174799d4efceb2024bcf6187d5209f3246b378e58325a750355
TLSH
T1386163A78325CFE9D71585B371E1588C36F084B933476E13A04BAEB69966F1C72E1133
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a2abb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a2abb.TMP
Size 3KB
SHA256 c688ecd85e7e3fa27a3773d24a01f74ce96a02b2eb1767a592545c3090e8378b
MD5 b2e127954d051a61325ae3e1e5b10bd4
SHA1 b6df1555972bc90b36b2effd5a5913ff394622f0
SHA512 f9b7c06cd397fb00db6700b803ddfc1454cd546b36a8dc0d3564411ab5bbda1b3f6afe0d9e496b11754cef3120ae8976ef9518946d54dc98c06718f05db52d25
TLSH
T17D5162A38325CFE9D71584B375E1588C36F484B523476E13A04BAEB69966F1C72D1133
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 831ff1dfd057d482071905596459cbdff803f8b20ca2078294491635439a465d
MD5 13b12dc6b512a1b6fdf46bf49b67dddf
SHA1 26d6e2dc5e2fd3a7020aa96e689ea5ba904b8c7b
SHA512 d93c1f4dd9547065731b73f5e3daa8c389a681c34e938d55757f4fd007066a17c540288ab6b3debeb71b6f7610e376b84c2288cef6a68dfefb6c970190cb3f24
TLSH
T15641CEF783F5952DC90156F0AB18AE2BCE2D0915432C7C5AC9E4AF1B93E34B1E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 fce77e6905ba0d3ee18bb0e13509aaf4e9478b2e1fab4063e2624cae939b3f4b
MD5 caf0d9606efbd24822cf5f931c800186
SHA1 ae70417ec5ff1c2b0a9337a9e253b295d3ba5627
SHA512 534356e8e5c87a6a81f86597b5516eca70cedc7c77d0e8b00cf088bb4e46754aca19672934ffdb20c9e35aeb2668c5f6d96b4d1b048afa4a3ce30b653c5c654a
SSDEEP 192:sxR+PRNCo/f4sjGEAjYZ7apXrzoA8ppWy/g6+WNYnl/YEpL31GxXIgDRgc7J:sxRgeo/f4sjGEem7jMy/5q/FKH
TLSH
T1C842C9166A28A93B8CCBD21DFB657F53D6F91032A1945E48B6FC8B1C04EB6DD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 1483851e9dca04742cc77d935be31286d4749dbe13215dccf3a41ae82e098eb1
MD5 ef039df8f60316696086acbd96177c99
SHA1 715175a3aa1d8015a13fe2f665242cabd2562e49
SHA512 e7564d5598b2e2b85424220ef2a08c40c9911f4205b51b9bcba2b896e9a373492e2bedc425e158e549905ecd856b5e4d1dbbaa7eb96aa41e0143858a30471dd9
SSDEEP 192:sxR+PRNCo/f4sjGEAsYZ7apXrzoA8ppWy/g6+WNYnl/YEzL31GxXIgD7gc7J:sxRgeo/f4sjGElm7jMy/5q/bKF
TLSH
T15442C8166A29A93B9CCBD21DFB55BF53D2F95032A0945E48B6FC8B1C00EB6DD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b6aeba25404d7116ed1aea206ccb3075d3d6d342fc360d5bca8b743c6f2bfcff
MD5 e29ecec1d1a082d5e07696115cccc8bf
SHA1 8c6baa674202d1d94131e742299cd2731aee96d3
SHA512 a9d5f6cf301f6d0a845ce90f846e44b7a3cf4d3cc97adb4a952590adeb234c47b8790ea776e1b6d106889e70e2a7402d4687fd8051c52a4fb81db19db862c96e
SSDEEP 192:sxR+wRNCo/f4sIGEAjYZ7apXrzoA8ppWy/g6+WNYnl/YEpL31GxXIgVgc7J:sxR/eo/f4sIGEem7jMy/5q/FKv
TLSH
T16842C9166A29A93B8CCBD21DFB657F53D6F91032A0945E48F6FC8A1C04EB6DD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 c2b299818ce6ba8d49de115a22dbf8570661cef299534b6cda907c2980dad64b
MD5 345759054cdf6e83236833a4e5217033
SHA1 2474ef4057d92da74127d26c7dfb7434a275fb32
SHA512 7846d58f2971e36c7f515feaa6955c1fab116e0fa5b75deaae1803b40794bb7300e3020bf02d3dc2534cf5ba11d71acf7e2dd3395c9d75ccdc3339280cfc3ae0
SSDEEP 768:40Dk6DJQD86W7pLuLzn0DbWgQ6DjfIQDF8F1+UoAYDCx9Tuqh0VfUC9xbog/OVer:40Dk6DJQD862Ezn0DbWgQ6DjfIQDFu1w
TLSH
T155D2DA7B640CCB7F4F804ADDAC197A9E6D6802CB96D8C98047FA991C02C77EE511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c1f15ec8ef67876c093a73a3555103cd219be6d4241341d2ad1b091f19bcac7b
MD5 f2ad9267c7d80d4f65faf63ac32e31bb
SHA1 2e8fa2b66e96a08fdfd012acff80f52cbc9db992
SHA512 812ef693f9ed41b671390c4e780eba807f13ed60deb359b63d906e6644fda55dde6eee05d07c53e3ce6d7b79c104148093a163db7fca1b9abaaeaf45d955bef2
SSDEEP 96:KRgRkQiOCYWm7LgYYK49gKYcY4rKQ1HfItpfd9xWJmsgRxK44g/xcnvORcJGKyU/:CgRkQiOCPm7UY89gK3Y4rKQ1HfItpfdq
TLSH
T14B91DC80317B03813C7F690C85F598AA52C2B861305CE52B7B6A42D50FA7E165DFE9CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5ac3fd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5ac3fd.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 faec6585df9072f7545a7c5bc0a8df8b40be1a8bd836327a053208db3995d83f
MD5 5d4a9fcafda5fb1fee172fdf079dd67b
SHA1 cd5369fb647910bd9bdf4dba371029d34c8df06f
SHA512 7d41b2fd90a5842c5fd6985c4b5e6361cd71df227416a31110f521c9be169e163fc5940afa182b7d834c85669adcff2dd3b2bbafeb87f0cd0b76a330d0e55f98
SSDEEP 768:W130BQspDTd+Z/+l1tAeX6+qTko0u229a4vsTHbMP:W130+HkvVTVKa4mQP
TLSH
T135F2CF31F8669C6788EAD784754739839EB911B3CAC84E40D9EDEB1C014716D1B0FC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 99c87f8e86d6bf8ad492bcd915612e8a27b48d1d2731eb4b533e754ee824ae7b
MD5 3ee27cd5ba74d7a91f81e5ad2c1eb2cd
SHA1 216805206ea6848f399de56c3f4ec6fa9fea7073
SHA512 706e425f14d60490345e2aa2bc23bbed5960dec37386b81cb87f1b101c7a865f036103518556e34c8e383adadeced9bd54ba1c2814e3e0a5a3487403cfb7105a
SSDEEP 768:jFQe34wgFBQtinZ/+l1tQeX6+qTko0u229a4vsTHbMP:Ge36+64vVTVKa4mQP
TLSH
T14F1338F198D38937D8AE8783673D6D469EBCD163B5885980BBD85D0CCC821BFC70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 3417ddc1f47a1f388b35a46b67677d95611a6a911d08c45cfcf366676768e525
MD5 8724d6087c5cc818dd52c681838441e5
SHA1 37aa583f49f5b2ff7e7405aa494fc2b4183c4d72
SHA512 4c607019334ddb85036ff4382ffb182ac54477ee597847511ca98d00283a959b8b0ec7ec45b4edf608902eba3fc002b1afd3cc3c6c728af4c73a8f3bba051fbd
SSDEEP 768:z13PBQspDTd+Z/+l1tAeX6+qTko0u229a4vsTHbMP:z13P+HkvVTVKa4mQP
TLSH
T1FDF2BF31F8669C6788EAD78475473A83AEB911B3CAC84E44D9EDEB1C114716D1B0F82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 bc0d72041823bcd46caabe96fe3145e06821701d0674e9125e1349343c86d319
MD5 35302acfaa693ac43b2c1df9289ffdc9
SHA1 5271965c277a4ad93ee69a161ff751b40c048f45
SHA512 21043bdca7090a2f9b3629e1bb369863e83451053aab94900c5e10c8d98041b5c53af40a30de6e7acb6c7843746c2b9e16609c8026e43f8a00d9ccd9e77ba7a5
SSDEEP 768:prv+4UNbdG30RNDTd+Z/+keX6+qTko0u229a4vsDjeVH1SdW:pbsbU3FevVTVKa4GEH1h
TLSH
T15D03CF32E8698A778CE69784724775472FB92163C7C80B90D8ED6F4D025B5AC270BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 4e14fa7c7cae392644d6d8cd4b3622a448f1767b982b3e15348bd8620dd12293
MD5 61b24fd62b754f15b8bce9a27db597b9
SHA1 14c2a4d76f26cb1f8559b760e728a0297fbd4c8d
SHA512 227e6995b085feb72a134ce11ec66caf518229f13aaaa362d112796d13b49da641ce45eaaced2a1e716d9e51e0ed3b6c0f09ec714204fb5501ecbd2946be7c04
SSDEEP 768:drv+4UNbdO3gBzspDTd+Z/+l1t1eX6+qTko0u229a4vsTHbMi:dbsbc3gVHlvVTVKa4mQi
TLSH
T12413CF31F4699D3789EBD684B14779836F7811B3C9C90B44D9EDAB4C054B0AD2B0F92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 cb28be5e76887c03e8c21731301d32d52adf658723ce544620e91a2268dc092a
MD5 70d2d58f1c540f271ede9858fa3ea464
SHA1 c2340c4fdab2bb68ab799cc9ff44f3714e45fc7e
SHA512 b7ab6e0cd42b0d9542a7994b5880d57d6cf44d6e3708265b19c7d3a12e484f2dd65c128143cd14a16bc7a9b89f1d6ebf46153e5e6d3a7943d6f00d19b2ad70e2
SSDEEP 768:Crv+4UNbdG3i3HDDTd+Z/+l1tSeX6+qTko0u229a4vsSHeVH1SdW:CbsbU34YavVTVKa4BEH1h
TLSH
T15403CF31E4698D7389E69784714776876FB821B38AC40F94D8EDAB4D064B19C2B0F93B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 accf5c3a6e2c6274779bcfb341897cc9da7840a522c67d88f3777366fe8e9e05
MD5 c05ec2dd11e2ab1ccd55d7e16a3d472a
SHA1 d535eb3c53d714db2b11c9ef8bf46d13243ee61c
SHA512 6376b4d7d6316a526dcf67b59a66c09cc1b20ff3962677d7a39136f5b93020dc3ccdb1ff963b84e6bab2f825f31497a7ebaae5a3d56f2805de39726e8023ab3a
SSDEEP 384:HXkRyiO024Y9DL84KKDL849B7SOEAd9KVRaAcP+AWRMAtEe:3mZY9DL8lKDL8CB7S/AmVAf+hRMk
TLSH
T19B728F3D5F003CAC15A780FCC5E992A94D1877A7CEDAC06D21183D0DC798969B5F558F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zatx2150.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 85e618a85cf5a6b0523a95ed6c05af9afbcbba9ebad133bd713892cec8a24376
MD5 450a53ee6650cb6bb993a98b82d798bc
SHA1 46e3482e006a8f37bafc91da04eb7333cb953f1f
SHA512 df9287e3efdf875c82024bb181634bdd86853bf396a86bec8b5af53a58c057e8e9048eeb96a240578421d375e697aa3fa2c271f517e260532092e79ae85eed4e
SSDEEP 1536:jTrliiUmuPciCnA2uRU2xgInc0Wsaq+AQB2ZybRDuvZA5WOzpoc5lt2twmyI4hsl:j3lKmk2uRUEhje21uzbzEFqmd
TLSH
T159A3AFF6DFA2CD3D64FFD41D6AC2883EF9276400B3A32009C963665096C6F74A379648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2e6bfda6-3a2b-4b8e-b57c-3fedb3dcc87c.tmp

Path C:\Users\Admin\AppData\Local\Temp\2e6bfda6-3a2b-4b8e-b57c-3fedb3dcc87c.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2784_667508500\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\db\data.safe.tmp
Size 36KB
SHA256 e566359491013c6e9f98b2e78d13f8d97b17ea126df35e1b2951f19935ef520c
MD5 9aa1082d2e676d775301eafb654137c7
SHA1 3d94a81f779a7ddb5a5a32e1abd7c4e3576309d9
SHA512 9eb1862ea8ebbf353391f7ba7e202e88b6f04a41572f5f8de47047b6433c67f7a5ccc28978a4f450c2660c41e0998707dcfb6f217b84655bfa5a342cff596b4b
SSDEEP 768:ZfG15+CykzUT1XubD0Gcm+uR4fmKstACfDqVbtbAbKbubmxH:S+CykzUTpE4fmqR
TLSH
T11FF21184EB2E953FD42812BBDCA51B002F79F88959192F973A4C64686C872DC3D5E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\db\data.safe.tmp
Size 36KB
SHA256 af9b604448a0dff83fa9703c7b283c3200311e0aa2e8517fabc03207a01e6de3
MD5 5980c4e1c429d4dbffb9892f7a8c98ec
SHA1 810dc61ae52aecdb8be23100c699c482734c1755
SHA512 5319db6d577c1c3aca6005a797873723843575ef62174bfd008a189db15572da8d94cd796fc2f1ba6cccf24bbf182aa5b70ae1dadedc4d6770182fc7106edc27
SSDEEP 768:p1Yf1+CykzUT1XubD0Gcm+uR4fmKstACfDqVbtbAbKbubmxH:O+CykzUTpE4fmqR
TLSH
T1CAF21184EB2E953FD42812BBDCA51B002F79F88959192F973A4C64686C872DC3D5E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\db\data.safe.tmp
Size 36KB
SHA256 91fe50ab6401205d17097d437c9a04081c62f8cd80eb6d15fe2e7526521e1735
MD5 e7f222d9db3df54da17fc4957444ff8b
SHA1 ec46935d3059dcf3dd7d51d910f9150bac4f8ea9
SHA512 df1d7b5df2f4d774b0488f0227a3b964c334c82858c282c9f44fd037f760fc36d25e234c8c88515c01fe00bb9fbeaaa33d97a4d91f91f99edc3a3cead944f789
SSDEEP 768:W+CykzUT1XubD0Gcm+uR4fmKstACfDqVbtbAbKbubmxQfG1/:W+CykzUTpE4fmqt
TLSH
T1E0F21184EB2E953FD42812BBDCA51B002F79F88959192F973A4C64686C872DC3D5E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 c566181d2fc50063109414b35848b3ddeb4e82f056dcc62104dc66fd9c6c9aee
MD5 f12d0d44de0635ac695ce4b73c4dbf1e
SHA1 b256d93e3d8a260dfb371e8d1b2a92aa95cf52d6
SHA512 f15a28e28ea5f37673163df9e38c9369ee9bf696e68513d242e7eb67564508e404d05c72be77d9a74ad1867bab4c37ad6981f4e5ab243a292888f1440325ac58
SSDEEP 768:WUWylZcU2jGcm+uxeRzUf/A7bzbObubxz1V2n:WUWgZD9e/w
TLSH
T1E3D20144EB2E953FD41912BBDCA54B002F79B88958192FA73A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 79677de7b1aa2f82f7249bce04ed3888f4147d7f3b6a5c5f8c0cd3d8beea4478
MD5 79f854a15ffeda57ac0ad4c2bdb3d820
SHA1 b55f683a7b1f17c1a2ac05ee930ca5cc90953e5f
SHA512 f6f7e7855196e704e6862a1027888f15edbfe3522f036395026e99adc76f49205e8ff88823cce4cc6016c4c4a189e80d832c053b739fa5ee5913dd66c978c49f
SSDEEP 768:r2bUWylZcU2jGcm+uxeRzUf/A7bzbObubxz1/:UUWgZD9e/x
TLSH
T1ABD2F144EB2E953FD41912BBDCA54B002F79B88958192FA73A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\events\events
Size 1KB
SHA256 aed2a29322bd0e3277ddcf91cb361e2b5702546a83256aa1398904d96ba07790
MD5 f68748a90b1f35be3b981a93120d42db
SHA1 bc541c443878dd12ac9ddb0e1a23f79eb7338987
SHA512 96760087f819fa722fc5a76fd75989284db9fb687b7889c27a8c54d09b2c2bc12d4ac01c4b9818e61d2f3525a7502c35bd7840bc517efe2d594533bd661dada1
TLSH
T17D214CDC79F88D6BADC7E29CB481028E53554E47048B2C434E12FF8DCE91ADA326A53D
MD5 SHA1 SHA512 TLSH

Submit Download

4c1d76ba-66d7-4892-aaf8-1b7d3e25b421

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\pending_pings\4c1d76ba-66d7-4892-aaf8-1b7d3e25b421
Size 235B
SHA256 5aba769996a248bb6221f36d356d08a1d72b9550a901ca9bd4dddb5bf1a65c43
MD5 e0faf87629c1486a7615222e4ee7628c
SHA1 fd48c6753bd9b217dafde6e12d72d1e55e5c32af
SHA512 d3ac90a4f4582b3e9734abfef86f585d8c47cdd6ae16c1e4148e3bd5e2989c250b262b77e56a10da3bb80d63d2bb9478bdf128ec489722fa553859e96beb9e2c
TLSH
T137D097C428986BAC49081F0BB0A1A9CAB0848C3310A0B8A0A9914038AEBAAC8115281B
MD5 SHA1 SHA512 TLSH

Submit Download

5993d5f6-ce26-4e17-af68-81ae1ebe845b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\pending_pings\5993d5f6-ce26-4e17-af68-81ae1ebe845b
Size 2KB
SHA256 d02f55efbf2955e22fd2a40d09450ae63dd2dbcb0c7c06c42dcd94b6cb8482de
MD5 848dd3ff9c7c54b25aef19f8f5ad0c1b
SHA1 f31863d61f72dbb077e0148c25007c0c1752744b
SHA512 49098f1dcc50bfc49ac24b7864a5d175a613f264cae699236fcfd905cdc55a8991d50353b26f4f897c362de7c6e2e9549cf5037a3dfbcf5d10039f7bcf748fbe
TLSH
T15C41755C36B84C7A9CDAE55D9081238F83E1894300C22C931E91EF0CCED679E73AA52B
MD5 SHA1 SHA512 TLSH

Submit Download

678f3557-f589-4da4-9c27-42a64934d46f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\pending_pings\678f3557-f589-4da4-9c27-42a64934d46f
Size 235B
SHA256 30b7e1dcdd33578ce560b79423d802773d4a981a944454cd6a784e41124b144b
MD5 874a71f7497a6b43933d44d3f12a95e1
SHA1 6faca5c49b1304bd494568995e7d66983ec0f5c8
SHA512 915087dcde096855d5d97c6492f107a2e161fd3a9093c3c33e3507af7dd6f424fd237b8f42cb887902829e93ded359e71a1f4a61fb0eb3d2683ab8eff5640298
TLSH
T179D097802CECBB2D08140F17B0B06AE330848C3314B0A820D6A2467C9EB99C581A2C07
MD5 SHA1 SHA512 TLSH

Submit Download

755adbea-660c-45af-8882-41fba28256a6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\pending_pings\755adbea-660c-45af-8882-41fba28256a6
Size 886B
SHA256 23229d964752def38893464a8e7be6306f99148b9031d629542e1f913f4d7a5e
MD5 0e98e523109842512be056ef5b36d750
SHA1 df5e2d675c46b80f8cdb9be8ab03a0da4fb0af1e
SHA512 b8e5f2ea15f3e4cb87605ea911f7f430afb89ee62060d13cb45a822bae63a1faea88f499dedbbd56ddadc338475c6d468b62292e68ff5ce03fdc8ca0e4d154c2
TLSH
T1E5110081897875F2CC68828B85A077434FE4B523C0C618147DA49F180EEE51AE7AB60B
MD5 SHA1 SHA512 TLSH

Submit Download

f477dd6a-24de-4ad5-b110-03fbccb31250

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\datareporting\glean\pending_pings\f477dd6a-24de-4ad5-b110-03fbccb31250
Size 871B
SHA256 c1ef9fd62634b20d387639a4869eb9f7cc6098ff2988a3cc4d06e6fcddcdfccf
MD5 894e52706a7f4eefe4fa739c42e19b37
SHA1 9d4dd3037ccdb22e53fd003ac0a6662ea286b0ef
SHA512 172e4bf25af5dc9ff4fe08d4ca7aa1cb295d6f48bad74f587154af354670c9296ebfcab3bfd7b7ab10d825ac63754606364a413a3acc96a5d670adf9ce379a06
TLSH
T1FA110081C67475B6DC68828B88D13B0647E4B91380C954147DA05F180EEE12BE7AF607
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\extensions.json
Size 16KB
SHA256 44e757c54309306bfd59a97dd5bb7b20f02e2500dbe062eb741f9427acc2f160
MD5 bc92fe311603d1a2fca52dd15bfc60f8
SHA1 8d95c2874b253e4554879107f678c125660764f8
SHA512 b914e63c7912c2b33fa2e011b52d8782b83711f45fdeed2bf7bf8a81edbb744379c3aa2a230b3ebac297e903343e09f8fe2828be45e67d433dff0af2de969bbd
SSDEEP 384:fkI4v/Umldv+8dhWn94zc96o/AL4H4L4PmL4H4L4H+L4HhD+4hQU:sI4nRfzXa4c6wi464U464k4o43
TLSH
T18972531545049EB8298FA79AAA367E01C37D533B60845C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\prefs-1.js
Size 6KB
SHA256 4ddcb461f878734dd926c7fa74f3873f2603dc7f4b1fae2ed21216be5b6a3c51
MD5 6b000879177ece3009f14e3d05cbb73c
SHA1 27466a4e9b6667b69e31448b10b4cbad0efff8b1
SHA512 5d003366b2159a327b2a3bb8aed67919dd9ad5a52ba321423c004628c77fc714abcb6fd71bc1227f68994a5aa7b8dddd0a42b7a9ce0cde1a4272b338382c8ce7
SSDEEP 96:xHYUTUmDqGqmfO7T1zSESSlvdv9j/ynKH5OVAqvqa7Bw88u8L4cnZFs:2WORmfO7TdSSVR5Bkqa7Bw88W
TLSH
T1C8E12F789508CF7F74B6776CAC6888316AB2013BBBBF28C650B95484055CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\prefs-1.js
Size 8KB
SHA256 64c74ab93b9c2c6c9433fd181dbc99d1d0fc2376614653a77ec01ebf9884ee15
MD5 ca33cbf18281bba65057f141ec2a5962
SHA1 d311af799000a2593c8a57455300e0389aa9e6df
SHA512 5655cb36a94e46079221d63c7f6411247118b5cee79116088ae7924186cc731b9f2e85797c72af2240ffb03cac07c8fd7ab4bd3a0c81e746fd13ae7ad1be2050
SSDEEP 96:xHYlTUmDqGqmf4uB7TObzSESSlvdv9j/ynKWRI9OVAqvqaOKBw88+kqp8L4cnZSs:2LORmf4uB7TuSSVYRWBkqaOKBw88ww
TLSH
T187022F789104CF7F65B6336CAC2849716AA2023BB6BF6CC611B95484015CF3445FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\prefs.js
Size 6KB
SHA256 7f2e43846c28cbc18f30a243f50925d88263781944b3ccfe89d93e1249459cff
MD5 8a405e3b847a4b69f791db750ef86fb2
SHA1 033dcc020b5a6bede3e4268afe279041fd683955
SHA512 93eea10e6f16a0eb0b7a7220da5612772ad2bbc030519df43e5938f9562d0716cda159cf557ae9735972919e65ddd479879d6ef0a0de3438deb49f24384837b9
SSDEEP 96:xHYUTUmDqGqmfOCs1zSLSSlvdv9jYnKH5OVAqvqa7Bw88u8L4cnZFs:2WORmfOCsuSS95Bkqa7Bw88W
TLSH
T1C0E11F789508CF7F74B676ACAC688C316AB2013BBBBF28D650B55484055CF3442F9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 45ce413861a977887dcfdc2aa9c2778163081d4c91b06e8f182dd82be8fabec3
MD5 dc97e50e28d556ff6532355f6a66a725
SHA1 5ee169b2a25e5ccec268f046600fc1e1ff0095ed
SHA512 2bbf44b8be0a1c4046e43ef0abfd7645059e566fbdca2c1cf662a6e9f15fbeffbbbc599f81198ac82ae1880530006f41c4c851965bd91227e3303143c2acc65f
SSDEEP 96:e8fh9rbjrsCQeW9jILA0NjoB8kMJttn0YJZQBD8:/h9XDIOnNcB85JttnTZEY
TLSH
T148917C023A0B3853FE5781CFAB5D8CF145B0300A498184EC90CF7B26677BB0B7499476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 9753ddf4b4332ed74a5e36df3554c0ff0d40adb6f88591a11c367f416693728e
MD5 a875a958f9383ece7ae7823288e5c2d3
SHA1 153cb94948fc4029636727c32b599d4a5577cd22
SHA512 1d6d6143c31325d7bb18beb75579e16f50641c3ba21bba349249475b4cc2d5167296566e17aff0639731e4cc4325ec3c3bde7c29f48847488c079458c9a475e2
SSDEEP 96:e8fh9rbjrs5QeW9jILA0NjoB8kMJttn0YJZQBA2:/h9XkIOnNcB85JttnTZEr
TLSH
T115916B023A1B3953FE5B81CFEB5D8CE145A1300A498184EC90CF7B26676BA4B7599476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 7.3MB
SHA256 f42646f68e802eba9b9f61c07a60a5868a8d1e2bc4dc8cee0cb332174361ccb7
MD5 43f73df29e97609a804497a123b6a7ca
SHA1 b0861c0229ec3efca3cd8dc34778e70001ce48d5
SHA512 add4b8bcefbabe5a432a1e24e424e5a3cdc738744ccc9c5dfec4e046fce76e0f4e5cea0dc7efd42587ed3a4492ca97ac5f206461cf304afa40809a532a168f04
SSDEEP 49152:V9yWkyn/X1Ce4y2D3/YAIev0DTlCXLzbAfGOyfQsNVBcpqx8TeHXBBSHFdPmyzyB:KZkhcicDpaD/5gh
TLSH
T141765CE420E19253F38644B3719993FB20EFC01C6036CE44579496FAA9748EB8E977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zatx2150.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.0MB
SHA256 bdbeadc1bcfaeb68e6cd4184128fa9e02a17f0923aba127715faa04752caf93f
MD5 70b7aaaaaf143ba995632c66c053299d
SHA1 b8297e0807afe2fa421e1b062b54ea37c196f25b
SHA512 b1a4b52d6f76e0207edfc9350c054212a20756abe75ac178ca8695256d6dec71c695adf014936a24bb07ccf6732b675480f9ee5e89948cd397398bdca518e3b9
SSDEEP 49152:/8ZvnRPV8+B/XYcl4uWs1kv0kRCQqSJP:EyAgs1mFRCQqSJP
TLSH
T1F9362AF820D1A257F3814033664593EF21EFD00C6037DA085BA966E9A574CEF9E16B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads