867446f6c126852befe33e548adda8f8ee04140bc6fa2d9b50bbe56509c81dd9

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/08/2026, 12:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
Size 6.0MB
Sample260830-pkklbstcjb
SHA256 867446f6c126852befe33e548adda8f8ee04140bc6fa2d9b50bbe56509c81dd9
MD5 c90edceaeac52a371ce895ceef07d593
SHA1 762f20de92b053271b185d230f4fb1670ee377e2
SHA512 1fcb39c310d68e0b3f3965f2f07798216ec7c68fb7d04586f7b92b0f5341dad907fbc3cfc362085b624a468d9a8adcbe4725cc9e805072e6675cad22316f42ee
SSDEEP 98304:GQAdm22GGvXupa+P4e18frP3wbzWFimaI7dlougW:+l2GGvXuw9gbzWFimaI7dlKW
TLSH
T1BC569C51BE4D8176D90B117247299F2A112ABD287B3465D3B2B43F7EEC323C26D3960B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware google defense_evasion discovery persistence phishing spyware stealer trojan

Malware Config

Signatures

Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/files/0x001200000001c50a-8.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/files/0x001200000001c50a-8.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Executes dropped EXE 6 IoCs

pid	Process
2968	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
236	icsys.icn.exe
5788	explorer.exe
2980	spoolsv.exe
4664	svchost.exe
4564	spoolsv.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe\u00a0 /onboot"	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe

Detected potential entity reuse from brand GOOGLE. 1 IoCs

phishing google

flow	pid	Process
96	2724	firefox.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1434147608\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\pt_PT\messages.json	msedge.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\page_embed_script.js	msedge.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping832_1046866542\_locales\uk\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6920	2968	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3288	msedge.exe

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 22 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243"	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe\u00a0"	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe"	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3"	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "c:\\users\\admin\\appdata\\local\\temp"	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm"	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Low Rights	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe\u00a0"	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "c:\\users\\admin\\appdata\\local\\temp"	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "c:\\users\\admin\\appdata\\local\\temp"	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3"	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3"	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134325662645487110"	msedge.exe

Modifies registry class 19 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-189034102-168398478-1159367937-1000\{0F12F485-3DB2-4919-B11D-F67994DFFCB8}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\WOW6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter"	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe\u00a0"	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan"	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1"	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User"	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Therad = "1"	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Model = "241"	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5072	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
5072	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
5072	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
5072	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
5072	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
5072	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
5072	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
5072	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
5072	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
5072	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
5072	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
5072	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
5072	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
5072	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
5072	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
5072	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
5072	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
5072	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
5072	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
5072	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
5072	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
5072	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
5072	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
5072	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
5072	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
5072	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
5072	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
5072	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
5072	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
5072	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
5072	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
5072	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
236	icsys.icn.exe
236	icsys.icn.exe
236	icsys.icn.exe
236	icsys.icn.exe
236	icsys.icn.exe
236	icsys.icn.exe
236	icsys.icn.exe
236	icsys.icn.exe
236	icsys.icn.exe
236	icsys.icn.exe
236	icsys.icn.exe
236	icsys.icn.exe
236	icsys.icn.exe
236	icsys.icn.exe
236	icsys.icn.exe
236	icsys.icn.exe
236	icsys.icn.exe
236	icsys.icn.exe
236	icsys.icn.exe
236	icsys.icn.exe
236	icsys.icn.exe
236	icsys.icn.exe
236	icsys.icn.exe
236	icsys.icn.exe
236	icsys.icn.exe
236	icsys.icn.exe
236	icsys.icn.exe
236	icsys.icn.exe
236	icsys.icn.exe
236	icsys.icn.exe
236	icsys.icn.exe
236	icsys.icn.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5788	explorer.exe
4664	svchost.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	2968	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
Token: SeDebugPrivilege	2724	firefox.exe
Token: SeDebugPrivilege	2724	firefox.exe
Token: SeDebugPrivilege	2724	firefox.exe
Token: SeDebugPrivilege	2724	firefox.exe
Token: SeDebugPrivilege	2724	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
2724	firefox.exe
2724	firefox.exe
2724	firefox.exe
2724	firefox.exe
2724	firefox.exe
2724	firefox.exe
2968	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
832	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2968	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe

Suspicious use of SetWindowsHookEx 20 IoCs

pid	Process
5072	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
5072	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
2968	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
2968	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
236	icsys.icn.exe
236	icsys.icn.exe
5788	explorer.exe
5788	explorer.exe
2980	spoolsv.exe
2980	spoolsv.exe
4664	svchost.exe
4664	svchost.exe
4564	spoolsv.exe
4564	spoolsv.exe
2968	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
2724	firefox.exe
2968	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
2968	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
2968	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
2968	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 2968	5072	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe	89
PID 2968 wrote to memory of 4916	2968	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe	90
PID 5072 wrote to memory of 236	5072	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe	91
PID 236 wrote to memory of 5788	236	icsys.icn.exe	92
PID 5788 wrote to memory of 2980	5788	explorer.exe	93
PID 2980 wrote to memory of 4664	2980	spoolsv.exe	94
PID 4664 wrote to memory of 4564	4664	svchost.exe	95
PID 2968 wrote to memory of 5376	2968	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe	98
PID 5376 wrote to memory of 2724	5376	firefox.exe	99
PID 5376 wrote to memory of 2724	5376	firefox.exe	99
PID 2724 wrote to memory of 4608	2724	firefox.exe	100
PID 2724 wrote to memory of 4608	2724	firefox.exe	100
PID 2724 wrote to memory of 4608	2724	firefox.exe	100
PID 2724 wrote to memory of 5516	2724	firefox.exe	101
PID 2724 wrote to memory of 5516	2724	firefox.exe	101
PID 2724 wrote to memory of 5516	2724	firefox.exe	101
PID 2724 wrote to memory of 5516	2724	firefox.exe	101
PID 2724 wrote to memory of 3412	2724	firefox.exe	102
PID 2724 wrote to memory of 3412	2724	firefox.exe	102
PID 2724 wrote to memory of 3412	2724	firefox.exe	102
PID 2724 wrote to memory of 3412	2724	firefox.exe	102
PID 2724 wrote to memory of 3580	2724	firefox.exe	103
PID 2724 wrote to memory of 3580	2724	firefox.exe	103
PID 2724 wrote to memory of 3580	2724	firefox.exe	103
PID 2724 wrote to memory of 4792	2724	firefox.exe	104
PID 2724 wrote to memory of 4792	2724	firefox.exe	104
PID 2724 wrote to memory of 4792	2724	firefox.exe	104
PID 2724 wrote to memory of 4792	2724	firefox.exe	104
PID 2724 wrote to memory of 4552	2724	firefox.exe	105
PID 2724 wrote to memory of 4552	2724	firefox.exe	105
PID 2724 wrote to memory of 4552	2724	firefox.exe	105
PID 2724 wrote to memory of 4552	2724	firefox.exe	105
PID 2724 wrote to memory of 3076	2724	firefox.exe	106
PID 2724 wrote to memory of 3076	2724	firefox.exe	106
PID 2724 wrote to memory of 3076	2724	firefox.exe	106
PID 2724 wrote to memory of 3076	2724	firefox.exe	106
PID 2724 wrote to memory of 1840	2724	firefox.exe	107
PID 2724 wrote to memory of 1840	2724	firefox.exe	107
PID 2724 wrote to memory of 1840	2724	firefox.exe	107
PID 2724 wrote to memory of 1840	2724	firefox.exe	107
PID 2724 wrote to memory of 3268	2724	firefox.exe	108
PID 2724 wrote to memory of 3268	2724	firefox.exe	108
PID 2724 wrote to memory of 3268	2724	firefox.exe	108
PID 2724 wrote to memory of 3268	2724	firefox.exe	108
PID 2724 wrote to memory of 3104	2724	firefox.exe	109
PID 2724 wrote to memory of 3104	2724	firefox.exe	109
PID 2724 wrote to memory of 3104	2724	firefox.exe	109
PID 2724 wrote to memory of 3104	2724	firefox.exe	109
PID 2968 wrote to memory of 2196	2968	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe	112
PID 2968 wrote to memory of 2304	2968	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe	113
PID 2968 wrote to memory of 4512	2968	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe	114
PID 2968 wrote to memory of 3280	2968	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe	115
PID 2968 wrote to memory of 832	2968	2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe	116
PID 832 wrote to memory of 5300	832	msedge.exe	117
PID 832 wrote to memory of 1148	832	msedge.exe	119
PID 832 wrote to memory of 3288	832	msedge.exe	120
PID 832 wrote to memory of 1148	832	msedge.exe	119
PID 832 wrote to memory of 1148	832	msedge.exe	119
PID 832 wrote to memory of 3480	832	msedge.exe	121
PID 832 wrote to memory of 3480	832	msedge.exe	121
PID 832 wrote to memory of 4516	832	msedge.exe	122
PID 832 wrote to memory of 4516	832	msedge.exe	122
PID 832 wrote to memory of 4516	832	msedge.exe	122
PID 832 wrote to memory of 2492	832	msedge.exe	123

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5072
- \??\c:\users\admin\appdata\local\temp\2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
  c:\users\admin\appdata\local\temp\2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\Sysnative\regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
    3⤵
    PID:4916
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5376
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
      4⤵
      Drops desktop.ini file(s)
      Detected potential entity reuse from brand GOOGLE.
      Checks processor information in registry
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2724
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1948 -prefsLen 27097 -prefMapHandle 1952 -prefMapSize 270279 -ipcHandle 2036 -initialChannelId {10c60677-1a9d-4edd-9de2-03dbd4c4e7b1} -parentPid 2724 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2724" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:4608
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2416 -prefsLen 27133 -prefMapHandle 2420 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {47d93bcc-d6fa-4bc2-88b6-16d48501dffa} -parentPid 2724 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2724" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:5516
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3940 -prefsLen 25164 -prefMapHandle 3944 -prefMapSize 270279 -jsInitHandle 3948 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3956 -initialChannelId {4ba1c22a-cfa1-4297-8426-c94068a6e778} -parentPid 2724 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2724" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
        5⤵
        Checks processor information in registry
        
        PID:3412
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4072 -prefsLen 27274 -prefMapHandle 4076 -prefMapSize 270279 -ipcHandle 4180 -initialChannelId {9fa865e3-297f-44f2-b5ce-bd4207e35ea8} -parentPid 2724 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2724" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
        5⤵
        
        PID:3580
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4460 -prefsLen 34773 -prefMapHandle 4464 -prefMapSize 270279 -jsInitHandle 4468 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4476 -initialChannelId {3bf10d0e-1325-460a-9ad3-9a30ca5f3775} -parentPid 2724 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2724" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        5⤵
        Checks processor information in registry
        
        PID:4792
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5100 -prefsLen 35010 -prefMapHandle 5104 -prefMapSize 270279 -jsInitHandle 5108 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5052 -initialChannelId {f5b9da4a-13aa-42fe-ac6d-645ab912a3a1} -parentPid 2724 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2724" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        5⤵
        Checks processor information in registry
        
        PID:4552
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5136 -prefsLen 35010 -prefMapHandle 5140 -prefMapSize 270279 -ipcHandle 5148 -initialChannelId {28835ce2-3779-43a2-bfb0-6bec6a9c016b} -parentPid 2724 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2724" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 utility
        5⤵
        Checks processor information in registry
        
        PID:3076
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5668 -prefsLen 32952 -prefMapHandle 5672 -prefMapSize 270279 -jsInitHandle 5676 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5104 -initialChannelId {edd6f9b2-c091-435d-9dd6-5e0324b687d8} -parentPid 2724 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2724" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        5⤵
        Checks processor information in registry
        
        PID:1840
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5692 -prefsLen 32952 -prefMapHandle 5696 -prefMapSize 270279 -jsInitHandle 5700 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5708 -initialChannelId {6c783459-383d-4e6e-9764-6f511d01d664} -parentPid 2724 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2724" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        5⤵
        Checks processor information in registry
        
        PID:3268
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6000 -prefsLen 32952 -prefMapHandle 6004 -prefMapSize 270279 -jsInitHandle 6008 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6016 -initialChannelId {26c84be1-2826-4a68-bb08-15f1a97a3f77} -parentPid 2724 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2724" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        5⤵
        Checks processor information in registry
        
        PID:3104
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2196
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2304
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4512
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.internetdownloadmanager.com/welcome.html?v=643b10
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffc046ec188,0x7ffc046ec194,0x7ffc046ec1a0
      4⤵
      PID:5300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,14820438767699151811,14216067126657028395,262144 --field-trial-handle=2620,i,12588090149817596026,3174682496795286896,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:2
      4⤵
      PID:1148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,497321625594165614,4168650792820700214,524288 --field-trial-handle=2620,i,12588090149817596026,3174682496795286896,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:11
      4⤵
      System Time Discovery
      PID:3288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2220,i,3184605296819917506,15190313305726419395,524288 --field-trial-handle=2620,i,12588090149817596026,3174682496795286896,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:13
      4⤵
      PID:3480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,6663048879294292637,14112816816179231982,2097152 --field-trial-handle=2620,i,12588090149817596026,3174682496795286896,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
      4⤵
      PID:4516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,2225043694848463356,15409803442024196470,2097152 --field-trial-handle=2620,i,12588090149817596026,3174682496795286896,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
      4⤵
      PID:2492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4140,i,14919832878376497159,12268183820184362235,2097152 --field-trial-handle=2620,i,12588090149817596026,3174682496795286896,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:1
      4⤵
      PID:4060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4152,i,6999161602264200542,15915463922216073271,2097152 --field-trial-handle=2620,i,12588090149817596026,3174682496795286896,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:9
      4⤵
      PID:5400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3612,i,9240982498272191798,13772284743988911366,524288 --field-trial-handle=2620,i,12588090149817596026,3174682496795286896,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:14
      4⤵
      PID:2704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,8972640301265256548,8556895826069934263,524288 --field-trial-handle=2620,i,12588090149817596026,3174682496795286896,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
      4⤵
      PID:6488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,1430577976264005944,4462539537121726828,524288 --field-trial-handle=2620,i,12588090149817596026,3174682496795286896,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:14
      4⤵
      PID:6512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,10770899860858869316,5666055179383679006,524288 --field-trial-handle=2620,i,12588090149817596026,3174682496795286896,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
      4⤵
      PID:6656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,10770899860858869316,5666055179383679006,524288 --field-trial-handle=2620,i,12588090149817596026,3174682496795286896,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
      4⤵
      PID:6664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,9471681085559758467,8162939855566596408,524288 --field-trial-handle=2620,i,12588090149817596026,3174682496795286896,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
      4⤵
      PID:6940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,4132214982189431336,6829029784451012942,524288 --field-trial-handle=2620,i,12588090149817596026,3174682496795286896,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:14
      4⤵
      PID:6340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,9057337849047160721,735694841594734690,524288 --field-trial-handle=2620,i,12588090149817596026,3174682496795286896,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:14
      4⤵
      PID:6772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,1359856698736460900,4698745038301341828,524288 --field-trial-handle=2620,i,12588090149817596026,3174682496795286896,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:14
      4⤵
      PID:6892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,2308901094501068465,3918722569190611409,524288 --field-trial-handle=2620,i,12588090149817596026,3174682496795286896,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:14
      4⤵
      PID:6960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,6558256857730234899,4598372277723680837,524288 --field-trial-handle=2620,i,12588090149817596026,3174682496795286896,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:14
      4⤵
      PID:6288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,1832094804542046870,10890113669135492864,524288 --field-trial-handle=2620,i,12588090149817596026,3174682496795286896,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:14
      4⤵
      PID:5152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3796,i,3240741919183744298,9326206667153370774,524288 --field-trial-handle=2620,i,12588090149817596026,3174682496795286896,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:14
      4⤵
      PID:6248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,2116076437096839831,12589686052890542961,524288 --field-trial-handle=2620,i,12588090149817596026,3174682496795286896,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:14
      4⤵
      PID:7008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,6598162318218066684,15885564791619250011,524288 --field-trial-handle=2620,i,12588090149817596026,3174682496795286896,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
      4⤵
      PID:1320
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 1992
    3⤵
    - Program crash
    PID:6920
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:236
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Modifies visibility of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5788
  - - \??\c:\windows\resources\spoolsv.exe
      c:\windows\resources\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2980
    - - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        5⤵
        Modifies visibility of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4664
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4564

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 2968 -ip 2968
1⤵
PID:6796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 f0ead82c3c8a4cd9959a8cd1cef74705c67e276b4a574243e75c890cb0b0b8fe
MD5 f8a5a8774310485121aa8917052b352c
SHA1 78542cc17bce16f7d0117a4beed6ae29c39c3042
SHA512 94c06ac4086f7321e54c95657a2fc0769092ed3577572d27a9a75f404a57f6b0c02e9bb5c1e8c0c285a577d89a5801c60face4ebf1cee334d6be346c240f09ad
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7C:fwUQC5VwBIiElEd2K57P7C
TLSH
T1D5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ffe13798c5910685872d371e84c30baa9eefaaa5db1419603eb30d473d7b2e37
MD5 03c111f9396889c77f6d9883c5df333f
SHA1 be65300843096dba92c5695fd35e2dffcbb7eb0a
SHA512 a77dfe3b48fcb72648f1adfafbf0d0fcd4d88690dcf41609a03e1d6b645d1336b6e322931b2205673283b920d20ed0225c6aa320a83a2d3a410771f18d120c19
TLSH
T1B1D09BD079145D78C4C1353231A773155A516435865C46481151F3BACD65141667E59D
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7add6572365d752d8c3a090b9a256c43e3c5ff716f29ed7aa3c53dc57a08ba60
MD5 0da70f521ac5aee3489abf6e3eb4e375
SHA1 0f3cd9919820116ecc86bab93f4712c08485dc56
SHA512 a9cddd04863b2ac842fe4f91265c19a41d8b7442be8f07a91747705beca52c1e1d563e3c46cf68e1b73606695624f13ca69a8246653c2535d0684ced42c37d33
TLSH
T182D09BD479045D78C4C1353231A673155A616435DA5C46481051F3AACD65141667F5AD
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7f7b7ca5dce5519c19f6a3a72ddad4342538e974ca69c7114fb277bb07309cd6
MD5 eb0d4079f7b5f60883336290aee1c394
SHA1 b4d41206128a6e4f9642b93e0f9b3bd5844bb9ad
SHA512 e4d86980f12633c045e58f92d0a95d0f0be128ea61efea27e039bfadd3996dc0b07b31f76bae30faae52b5b04ade3c83f841504502db1a7a6f9298df079fac01
TLSH
T16061535A3B319AD3DF24A6F351ED444A36F8FB45E50F2E1808745C382C0AF9858ED163
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 13f9490e227a19539c4c45999ebb22c6966f996d9669b61fe07c9aebdb02f4f3
MD5 fc16d54652e35978cfceda16b2205a8b
SHA1 07c3b3fdad90c6bee519a8f4caa3c3d612a86476
SHA512 c360998fb6d9362373566321bef8fd3672435d27a3e92bde349f17ee773b5c2ab9a6d5e2712cdcb1666b0d907238539266b8476f07c35fd466cd20b1dcbc7b5d
TLSH
T14651BFF3C3F9857E8A0146F0EA186E1FCE2D0515436C7C9A85E0AE2B93E34B1E14599F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 905e80cd6478a068ea56ff613bc0465395f48b363a569e442e692904ffbf1f1f
MD5 9b480a9f8ff032d6460aacf3c6d43131
SHA1 8e00ac586a30b4b6dd833c0aa69b71ca41e52b0b
SHA512 35c8d7113a905d694b841a54bedb8f9ce342a4496b48515a91b9a4b9139f2cc70cf1d3d801e0839b34e1cd0d8a24e6e1461be0d01025557c319956d80932bdc3
SSDEEP 192:sxRlRAyM/jK1Ml8wC1/fTs1YV2ZTtzoA8ppV/g6+WNYTj/Yl2Zrie5G/IgVcwXJ:sxRl281/fTs1QATgD/54/Jh83
TLSH
T14962F715AA34AD77CCDBD20DFA557F53D2F95523A1941E44AAFC8A0C00E6AED320782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 487f87ce9b3f86586a7c4f5690d7d4e79ea24c6ce0cee0dd45cd9016754b34af
MD5 2f37bb9156f5e9dd17b52af9e5215e16
SHA1 2e10f45a8850ea13ca0b124f714b7d5991e7d501
SHA512 0131e8dbfcba609fa183c62dd075226fd41963c43d2855157bc1d9ae6f85ef95d9b1a2f37b8b3730f8050bee404a5e4fa134c99c2857eb24fafd572048b09146
SSDEEP 192:sxRyRAyM/jK1Ml8wC1/fTs+YV2ZTtzoA8ppV/g6+WNYTj/Yl2Zrie5G/IgDncwXJ:sxRy281/fTs+QATgD/54/Jh8d
TLSH
T11562E715AA34AD77CCDBD20DFA557B53D2F95523A1941E44AAFC8A0C00E6AED320782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 38cf1c29bdfe43bff1b9d6bc965b3c12b07c4fc706f1314fa97472022e8b48df
MD5 c084693062554bc5b79b9c4a15dd5dec
SHA1 736b0abce1a49e966a6453b0a61aa10edff1016a
SHA512 8ac20668916dfddfaf3b0e9ef38d960efcf70273a9aecd7ca1d14c293119ebd53639e3501797b2db225986607dc83cdea07a44a2495153e24a547409773c605e
SSDEEP 768:dhRAC77pLuLzmxWgg+fAJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVkVa13fkroPIHS:dhRACNEzmxWgg+fAJu1jaPValfvQHS
TLSH
T1FBE2ED3B680CCB7E4F804A9CEC29BD9F6DA802CF96D8C95447E9481C03C5BEB551A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 5ea7d077dcd2e16332a5c074e2593622e47acc30721873bb49dd909bddf27d59
MD5 9adf1e446cb1e9e2fe8e2e2d36bd883e
SHA1 78711dbd989752e2d244b19dcdd22fe777a7399b
SHA512 75a1be8bfadcf7c5b98f1039c5fd29a31265d5d71b71c729e8ff15e70941223e5ed1fa7ef128d1bd9a8659ac7ec2b4596f6b788c41ec6677510a978887ddeb27
SSDEEP 96:KR6/masMs6WURJgK6K4PgQ6caS5oqzHOxOOOfO7OJOrOvObWOfO8OqgOjObK4OiN:C6/masMsFURaKCPgQBaS5oqzHafG6MsE
TLSH
T12D914791747A4280387E660C81B88C6F87C37465705CA56B7BBCA3A69F67E024DFCCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

383a8356-49b4-456f-95b0-5304a898b3c6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\383a8356-49b4-456f-95b0-5304a898b3c6.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 6f59402a7ffd19ced3b7e43433f901f1d368e9e6c2a1ea33c894865aabce69d4
MD5 864abd3e063823f63b346e3c49a3ae5b
SHA1 1b33d7ee1356b26e24a6468636ddf8468dad29ec
SHA512 c8c65b26b4abe669dba4ee581b19fe081759f7153b87165da1ccb244415d08ed5a9c3fb3cec9d2c3e20d4328e421e2cdd13f8e70d0439f97d711188f6fb78bcc
SSDEEP 384:nPZcIh38NJdeCMA6OJlDczRfY9bY5w32pQPlLJQXmIkdP9IimIMWEfMbc+H89419:Hh3MJ0MYiJawVNHXmTWTbc+HXVyLiug
TLSH
T1B7F2BF71ACB59A37AEF6DAC5A64B7B02AFF8412390DC1984CDD9AB0D118754D070BC3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 1fe3cd2ac817db4364addfad401ef2a1d35c4c1782c1bf0d0a1db69e707e6e54
MD5 7def4dac63d6a94304deb278f9ac76f9
SHA1 cea52f4ce2b70b0f45337c310a8fa6cedc376930
SHA512 9728c0d1f8976d2b993a5f0313e2e4ba448700d8defe8f0ff8c664fc3dab0e6b5c449e78ede35d7ef53c80d74df9ebc04518b13f324c562642bd3b01dcaa97b0
SSDEEP 768:2FQ/3wwgzJ0ANcawzNHXmTWTbc+HXVyLiug:9/3C+eWn13ifg
TLSH
T1951318F198E79637E9AE4B87973D6E069EBCC153B0885484BBC45D0DDC420BFC30A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 421166d872ad1ce629ae952550d42f3846c8886c002c8590487309d2031e18d0
MD5 7164cfdff824a5b3913aa454e75c5a71
SHA1 e57c7ae6231b89266314956d250f282fb8cb388a
SHA512 a8fcf5b41fb448829d43b6f3c9e2147189e625a6dfb0c00e16eaa0ee3a1ac2f194cec1c9eefcbc5ab2e430612e210ef90588c47efab3326e617378f8b56b7aca
SSDEEP 384:ntZcIh38NJCeCMA6OJlDczRfY9bY5w32pQPlLJQXmIkdP9IimIMWEfMbc+H89419:1h3tJ0MYiJawVNHXmTWTbc+HXVyLiug
TLSH
T168F2BE719CB59A37AEF6DAC9A64B7B029FF8412390DC2984CDD9AB0D118754D070BC3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b35451b8b969020f71ed7ddd3c06ec7d00359cc82180115dfe9f614d275ca4a9
MD5 4d737154c8946b00191357de653748c5
SHA1 cbb62c47c655f0630fd44c8799a16d6cabf204af
SHA512 857967bf1b0a5414d734756b14f9b9f25491dc94b4985928edcfdbad840489a1b8de0de109df0eff51ad076aa72e3b4733bcee16759419757af54178d4d6592f
SSDEEP 768:frv+4UNbdy3tJ02YiJawVNHXmTWTbc+HXoaDNU:fbsbA3tGQeWn13oa5U
TLSH
T14A03BF71EC79AA37AEF68AC4B50B7A037FB8116384C806D8CDD96B4D118749D130B93B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 8ed8bdd1c2216d6c0a0fc354ff2ecdafceb978f91d00179248b9101507bdebc1
MD5 200cfbc9982c5745761edc84cdca56d1
SHA1 8b4c100b86e2be95fd9adcde80507021e1e77bf8
SHA512 8e0621cc89b334f9e4c136f7d48f3bda2fabec9513bee0f036559b30900a4a035b775a20504cacdd07a64a099732d0821b67c27e74f8b4489ea7be0e369a9d29
SSDEEP 768:arv+4UNbdM3riWiJawwNHXmTWTbc+/qeVH1SvyZ:absb+3npeWn1SEH1dZ
TLSH
T10A03BF319CBA8E37ADE69688748B76473EB9116399C80BC4C9D96F4D028748D170BD3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 b4f759162893fb374c31e27b759018350cc8d8b3854652b7e7c22440b9d2120a
MD5 c41b04d1f2acc7985b9f5855d8ca30d3
SHA1 7d9eff846d94ed0c84f228ddbf3463a0d8eb6eb0
SHA512 94ea810414a2e95abe875e38b72224eca52d37831f4997c5e560e5658caa962c3ddedb836a50c0620021b618339a59ae708fdd248cb84463a6981c175f41b034
SSDEEP 768:Drv+4UNbdM3wgmiJawANHXmTWTbc+eXeVH1SvyZ:Dbsb+3IReWn1gEH1dZ
TLSH
T19B03BF319CB99A37AEF69EC9B44B7A037FB9116385980AD4CCD96B4D028744D030BD3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

5E43012191E7B1F510ACD5BF039D8BF1B9A277B2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\cache2\entries\5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
Size 16KB
SHA256 40d4dbf0283b6ff1f1a2ed9a5f806752dc8343b45273242e6a0b3cff2ebb53a9
MD5 4eb502595042039c80f1727146749c4d
SHA1 d16985bcfcaff00a0169fa98b022158cde73a18e
SHA512 59d37b1b9753d1b47e5457ea8f62ba44070e360cb0692c752a805ef2d9d8a8be843d4e04c7196a009c4aa352e2fa0bbb0d98114decb1eb8a4901fc29c09d397c
SSDEEP 384:HkCjiO024YkDL84KKDL849B7SOEAd9KVRaAcP+AWRMAN:EzZYkDL8lKDL8CB7S/AmVAf+hRMY
TLSH
T16E728D7D5F013CBC1597C0E8C5F5929A8D18B7A7CFE6806D21583D0DC698AA9A0F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 b62ab174dff0c6b32dae5b676428322c3ff8d88cab7d10e489df9c1f0a3de317
MD5 2932d71d60db87dc054eec0dff1b598b
SHA1 1e9199500bac878157c1e24b2a5fce5eab643a76
SHA512 f472ff1d456c68d41a0732df03fc57534920072c2d63520948036a352f73ac54a1c0b19583398c780f79d817c5f1989aa22d029f26823f17bc93cc299285f11d
SSDEEP 384:HXkRyiO024YaDL84KKDL849B7SOEAd9KVRaAcP+AWRMAH:3mZYaDL8lKDL8CB7S/AmVAf+hRMK
TLSH
T12E727E394F003CAC25A7C0E8C5F992AA4D18B7A7DFE6C06D21583D0DC798969B5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6leyazu9.default-release\startupCache\webext.sc.lz4.tmp
Size 105KB
SHA256 395c817677749fadf903ed8301ca32caa6ffbaf6668a3b411e2391af94cb9365
MD5 36ee25b564e4766de4c975075a752d52
SHA1 07fbff62f25b856f9af2e3db59b4f6578800d0a1
SHA512 c6890bbd55c6611af134084549bf76cebc6d3d3b84b5e8b0dae726335ef362ece8eeb380bae1ef8c068491a5337637b8aef321cb44308ea429051930e2dfdb68
SSDEEP 1536:jTrlib7+yEF7s75HcQiO5bcqlrw6nShGdNrtFhklY1CBw3h+98lDdVuxlepqYErn:j3l+1Hc6b5CIctoh+99lxJdpNk8XWRs
TLSH
T1C9B3AEF6DBA28D7D95FFD42C9A82853EFD222810B3E33405C963375056C6FB86679608
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-30_c90edceaeac52a371ce895ceef07d593_darkgate_elex_glassworm_remcos_stealc_stop_swisyn.exe
Size 5.9MB
SHA256 e893b11f4273a527e2dced12c5a3a062fbfa20f5bfa3d38bf240cf507a4ee08f
MD5 77f2a080ccadd145b7bf688ff163ba6e
SHA1 736149f44aa57bdc879a8d1459c4d97399ae57a1
SHA512 2ec4548e1cf261f87d8a83003875379632602e84c621c17427c4d1457bcc66484fc85a641b5fb72d1c561344c909acb3fa2e095ef02118fe826763eff7745cb9
SSDEEP 98304:2QAdm22GGvXupa+P4e18frP3wbzWFimaI7dloug:ul2GGvXuw9gbzWFimaI7dlK
TLSH
T19F569D51BE4D8176D90B117247299F2A102ABD287B3865D3B2B43F7EEC323C16D3961B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7ad00f94-3747-4a86-a3c6-26b8c29eebaf.tmp

Path C:\Users\Admin\AppData\Local\Temp\7ad00f94-3747-4a86-a3c6-26b8c29eebaf.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir832_1569148345\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\db\data.safe.tmp
Size 32KB
SHA256 8c90e18b9554ada52221f0fe44aef83063b8f91ade3bb6c44cb2761b16456426
MD5 8a0bd3ce222ac5db18eeaec51868ebf4
SHA1 3969834b06959175ce33809240369ca7a1478050
SHA512 788cdac342cabd4c7557193a9273952768180f72aba3abb0347b86c91fb0a7b2ba0cace47d002a478a9b4f072d62a255eed2040033bea9d9b932f315c6fac9fd
SSDEEP 768:B1eyPMuFr1GlpD0Gcm+u7XCjRKRAVIjNlbvbLbvbpbH:vMuFr1GpXCjRgr
TLSH
T1C2E20F44FB2A913FC41512BBDCA55B042F79F88958192F9B3A4C64686C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\db\data.safe.tmp
Size 32KB
SHA256 2bae5af45504b3e14eab9aee59e9c14a1d91783d471944ba454714d2d23bd55f
MD5 f60ee938c44f0c218a854a0c620b52fb
SHA1 e8221002d6389ece122ddaf4761f5089e02613ce
SHA512 7a8f8cf317c94260913c74b084e695fa7c5f51a7b4962137235e99e90de888fee4303c7ee875836def84b7ef5b2c37eb1a787f3ce9ceaa97f184cd0bbd371e56
SSDEEP 768:B1SMuFr1GlpD0Gcm+u7XCjRKRAVIjNlbvbLbvbpb2yq:eMuFr1GpXCjRgK
TLSH
T113E20F44FB2A913FC41512BBDCA55B042F79F88958192F9B3A4C64686C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\db\data.safe.tmp
Size 32KB
SHA256 22e98de71235e3001030165498f96cc4ae888cbb6df3e7d12f946cc3d759afcd
MD5 892f8409fe392a7ed98d32794712d9e4
SHA1 ba6b504d7e7d39b0260f51b36123dd16b7d8f8a9
SHA512 0966f44dc133642417f75aaada11eee0bf92d786c1370bc7448f4fab3ede68d6d646f2e1a872b21904c92a23ca2a5e278a2309e069164d51b3daf08f27f19ccf
SSDEEP 768:3MuFr1GlpD0Gcm+u7XCjRKRAVIjNlbvbLbvbpbC1eyq:3MuFr1GpXCjRg1
TLSH
T196E20F44FB2A913FC41512BBDCA55B042F79F88958192F9B3A4C64686C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 4c3ad9efb3e100eb431ead7b75c36c11d74c06d012e75319e40ac6f5606a584a
MD5 4d790d00e7c7da431fcc5ad42d87d6db
SHA1 68c08b723fbc42a297e1a7e579158df388147335
SHA512 883d234b98bf6909df38993c7d99a3a161db610f9b3c84ff8242398c5e571be91fe966c8a885d12ce51e97cac9bc8e88bd8d6f0b0b83919a71a0ef844ac66eec
SSDEEP 192:1bR1d66JoztdzgCl6mc0dEOv5zbo8M5myjscD:Vd66Joz/zgC1jRbo8M5myjR
TLSH
T1BDD12F68EA28463BC405537BCCA56F400F35389A9C4E3F2936ED25082D572DE768E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\db\data.safe.tmp
Size 32KB
SHA256 d3c90b1277e8ce371320ba94ccb92a73a4c7c6bc60dded9c2b3e35121c2bf826
MD5 eb653e67ac685392c80ca9f5e579405c
SHA1 71bfb3894dc35230b986295e150100ca0f0d67ce
SHA512 5ebf07ce5e3f5a5624bf96414338669f292739abef2208e0ac1e3cdc905dfabd365ccf83cbf54f7186bee533a5930ec589af20ad349dd0c6ea001d2bb417ad62
SSDEEP 768:/y51SMuFr1GlpD0Gcm+u7XCjRKRAVIjNlbvbLbvbpbH:FMuFr1GpXCjRgr
TLSH
T1F2E20F44FB2A913FC41512BBDCA55B042F79F88958192F9B3A4C64686C872DC3E9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 a5c7bfcea51e6b1f77468aadd31e96891fd447822fafea66288c98e345a6bc66
MD5 e0cca28f5a621d1a7c6a82898a416f5d
SHA1 ce14613d9503c0097e9e534e65049505d56a0000
SHA512 7f9351b3db27e5b3f0f6b5733d03f20efad108428bc597065a0131d3810cf825b78741b12818fa46305cc6b6444a96e14e9f8a141baf2919e044e28b5165ad77
SSDEEP 192:fOv5zboqZ5myjscpbR1d66JoztdzgCl6mc0d:QboqZ5myjrd66Joz/zgC1j
TLSH
T177E11F68E628463BC405137BCCA56F400F39389A984E3F2976ED241C2D572DE369E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\events\events
Size 1KB
SHA256 b867d963909d518060c6a525d788ba28ee28e83d62255e530a141e8506910e7f
MD5 fbb573a340ad8e375de819ed27eca91d
SHA1 f9ef8069df27dfdffab08ffda9847909904330be
SHA512 0ae98afdec0824af0404e830b10f5c11ceb50b818be760fd205d9e3f2b0523e269ddded715c858dd831fa08e284757d6fe97382971be9d19a1215a529fe15c09
TLSH
T150214C5C39B88EAA5E87E25C7851118E53554E0705871C434D13EF8DDED1ADD327E43C
MD5 SHA1 SHA512 TLSH

Submit Download

0652b744-3929-47b2-aa78-4c4b17943294

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\pending_pings\0652b744-3929-47b2-aa78-4c4b17943294
Size 235B
SHA256 81c2154422e365dd5f503e904c3efaf72879ba5ce16d7c1729b0b029c2adc639
MD5 943f1c75dbdbdb5adccba4f7990323e8
SHA1 e306ba26205051d0be89301a8d06d3816df98e5d
SHA512 40dc8a99338629d4166e9f7ef431cc5979549a82eeeda267e238f0c79ca03bb3da74f2ef70fc1a20909b7dbfafb1226edb932d9de72be75258649c1f30c03839
TLSH
T1D4D0978028DC275E08008F17F0A029C2B1448C332061E820DA61C53899B9FC40292D1B
MD5 SHA1 SHA512 TLSH

Submit Download

155bac99-24e0-4648-ac18-7578289a824f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\pending_pings\155bac99-24e0-4648-ac18-7578289a824f
Size 235B
SHA256 444e5865fe61ff041de8f72faaa904e61fb839b3a069d217bcc3fb6bc3c788b1
MD5 d549c12734a6945ed29e1f3595d97f0f
SHA1 d43aea72db49cffc685598225bafe0c174bf5277
SHA512 84a5d7462dff4df4451419199ba49c1965ebcf9e8c46d9cc09431802172fc888885d97c89d8acaa934db765827e224c6d7375880c06d5f99de43d2f1a0a5e150
TLSH
T13AD097C42888A32C0D080F02B0A02DC230488C3315A2AC10DA6065748FBCEF50261827
MD5 SHA1 SHA512 TLSH

Submit Download

aa8b75e8-9348-402d-bd21-62755623c169

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\pending_pings\aa8b75e8-9348-402d-bd21-62755623c169
Size 16KB
SHA256 bfe23f1f55b56c84a3bae1ccc5a46e88f9531433da068cf8fba27f73526a58da
MD5 29cb5d9dedee232a398dc7a6d729ae98
SHA1 7118f51e766d25983fd8682793a034eee5ec496c
SHA512 a6125baf664da2d363c466b55decb315c872cc56a45ae863cb4eab7a0d9380194044eb8ccc1863bffe6c95a4ace5508b171c44ded7797eada83ef4bd43ad6440
SSDEEP 192:QOVnjRJDeQbPckNY4isgAv+ZOmU/AvTUTImhLQ6xTR+j7TRyzxGT1LK+4wBAOCB:TbPDNZz0OZcm9RN+j7TRylzPwuOCB
TLSH
T1A972B956586045BAC591E3A894F87FC3E2F528CF4C419FCE9BE4BE085DDA0AE112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b489bc56-123c-435b-be98-ab9bb0eb8af0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\pending_pings\b489bc56-123c-435b-be98-ab9bb0eb8af0
Size 886B
SHA256 0a885d1b263a7ffb8bc6c4eae952f3e48ae2561eeb592e5fcfc9915408c29e6b
MD5 51f078f972037f556b01fa2befa1598a
SHA1 af17b0377f638ed7f27cd1c3d08ed4330ae4eb48
SHA512 38f8f9435169c271e7794be8f36473b283fa8d743361970b61cfff6e517a87b6d1c9420a74d2591562ab8dd47e13798d4d4e5728310cc41719e585f926f15e27
TLSH
T12511238195757972CC7CA29FD4E2B7424BE4B463C0CA59203EA05F180EBB51FA76B70B
MD5 SHA1 SHA512 TLSH

Submit Download

c29cc46c-6941-445d-81a2-009aca4dce2d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\pending_pings\c29cc46c-6941-445d-81a2-009aca4dce2d
Size 883B
SHA256 11016d15f92b1f1191181811835540d920d8d31fe01126adc75c87c5fc352881
MD5 45ac37a488033525cb20a276b1cdae40
SHA1 1208839e0d1a07dbbfd4682e36d1afae9c3eb920
SHA512 2a335410d4758d90bde7a90ad7c57437ce8bc21c27cae25a0d744a43c3df58eba7bea76c5dc6eb45cee7f1701650294eaac832892ecb16153e944a44a6faca1d
TLSH
T1E4112384963475B1CD7CA38BC89577414BF4B523C0CB94203DE15F184E7A90F976674B
MD5 SHA1 SHA512 TLSH

Submit Download

e663b80d-9bc9-4408-866c-c97f25c8febe

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\datareporting\glean\pending_pings\e663b80d-9bc9-4408-866c-c97f25c8febe
Size 2KB
SHA256 9acd89b1cc773ecbc0e1a1a237f77b5ccff12c78068136fbea7b856084caeec9
MD5 1d789d00cc1126ba21916e480bb16725
SHA1 e24a4b1da0f4d58715efe83fd688176f075c0135
SHA512 1c988ca2b6cb946746fe498bee818e67819c3e6c77855dca59fa94c97a5eaee93a9b10bb9cb2b4e9da6e33fff2a9fa5660a0dc9655684de4ba8e2e4fa58e24ac
TLSH
T1A541445C36784D769CCBF59CD49232CE8360DA5344C228932E51EF0CCD9269F33AA567
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\extensions.json
Size 16KB
SHA256 90eefb2e5c66e41d503b24483b899c5a346175db5b1dff2995b35cfa2baf4771
MD5 4b98cf4904926c0206fdc0a89b3377c0
SHA1 10a598404789bdedadee356e59003a0ef3618e21
SHA512 efd47d9f40c92008bdf361506f611ea71000023316a21b8233aab87de9bfc2c03c68877f5812a314d310e9603e443cc05491b0f201d5b720bc1eb00796f6aea5
SSDEEP 384:XkI4vjUmldvi8dhW794z+96oCL4HN9WL4P36L4HLL4HoL4HiY4hn:0I4rRfHXS4u634jc4fI434K4T4l
TLSH
T12272441545449EB8294EA78BAA36BE01C37D433B60845C78F5DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\prefs-1.js
Size 6KB
SHA256 9032150b98d95926377fa73cb0aca2eb45749cb21d0647bb7c400d8ecbd22881
MD5 ad5ee45a7403e808f8a022cf9bd0ed0c
SHA1 5a9095d062bc3a7210d5122be754c0987a6d10fa
SHA512 470a005276672e9e7fa152fa22e03ddb13755da9fb20eafe861019168d441884f5cbcaad5f92d451d4ddd840cf25024a8dae0bbe3e685a7fc8b64f364c32f5bd
SSDEEP 96:xHVUTUOvqGqZCfSoo1zSvNSSlvdv9jLEnlFHvqRBw88u8L4cnQVywS:DPRAfSoogNSS6yRBw88Ce
TLSH
T18DE11F7894088B7F74B6776CAC6888716AB2013B7BBF68D650B694C4050CF3841F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\prefs-1.js
Size 7KB
SHA256 b26f43ea360e05ca9a9dcfef8284f32cc3c3ce20e883d7219c14c55044f43ea7
MD5 d357e0728a6406cd91347f9fa1f174c9
SHA1 6e7f129da6563f32cd62203093e0b7bbe3337005
SHA512 69625874a8cbce278df21e1edb401d44c609ab52ff8b66e34c20faf442a06e469e13801aaef9d23e891540dbca0a319d1b0d189cf10c5c09cf38672f6368d55f
SSDEEP 96:xHVFTUOvqGqZCfTooObzSvNSSlvdv9jLEnlFWR6Hjq2Bw88QB8L4cnQVywS:D+RAfToodNSSPR6+2Bw88Ce
TLSH
T1D9F11E399408CF7F75B2766CAC688C705A62023B77BF68D610BA4485010CF3841F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\prefs.js
Size 6KB
SHA256 ce80b9681488401ea73e3b59692a25972f797bcbb0f593fbf908c6fbca9927a3
MD5 55932430e4c96ce74c3aef387ef706b9
SHA1 269030a4a0119f481335037626377f1a1e90b7be
SHA512 cadcfd4533b90e0eedcc7cb983f2dd7bd3d872bc953acc994690cbef52d1e5c6ed64826bc82ccd835635e441316ee2adc33988afc16e2eecdf8533c990712f39
SSDEEP 96:xHVUTUOvqGqZCfSup1zSZSSlvdv9jynnlFHvqRBw88u8L4cnQVywS:DPRAfSupoSSg/yRBw88Ce
TLSH
T163E1207894088F7F74B6776C6C6888716AB2013BBBBF68D650B554C4050CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 fd827d109aa71f4b909d0f49e241229338f8b52e2ad61257b9cf68d582ace46c
MD5 208d61436023b1d76b2d923c10e12e24
SHA1 6ea3e9926c6fc33271f3f08613095fde4bce495b
SHA512 eedf8cc2d16d5f38a644dd4392490f486524abab5af0410fb56a68f5fe466c098eb098765c925db807465c6cd16a2b92df32267ab51b9ba085186c243f711102
SSDEEP 96:ddfh9tDC8seW9jILA0NjoB8kMJttn0YJZQU:Xh9aOnNcB85JttnTZv
TLSH
T1BC919D026B2F28B7FD2789DFFE468CF201A03406548144E890CF7B26721BB477969076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 aa1ee5bbe3663dc0127db428d20c8266e727ac939686b56e12e8f616e93b9529
MD5 7226220806a75d01453ce1ef82e72da9
SHA1 26168823d249e8295889b2d69330bc6dcbad268c
SHA512 e91741e3f2346d26fe46ed8289d200c2b2e4aad22c9ed463d4255780d069c18447ffc16e720a7493faadc2417fc11e42a5fe8ec4ac07dc16d30f708fefd99698
SSDEEP 96:ddfh9tDCOeW9jILA0NjoB8kMJttn0YJZQO:Xh9ROnNcB85JttnTZB
TLSH
T19E918E027A2F28B7FD5B85DFFE868CF241A13406158144E850CF7F26721BB477959475
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6leyazu9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 7.2MB
SHA256 c9ef0b6e88b92d5c136446b27a2382d07ac28049ec34e7d39c75f1a74371d5fd
MD5 21f713d7b6f7a79e151caad9b9076e67
SHA1 c07444de646a526339378cf4e7a7c40768fbb6e4
SHA512 3e24569ef6bc8c1a6f38a64382ed2dd3d9bbf4f81e46906a1c87e1c687af5eb74f27ab67395aa177a99b25d5d6d323ceb98af3100cc308c64c010f828cc43e80
SSDEEP 49152:4tG2OHYnIYU+bPEnOEQs1D6YtCQVppA24ocmWqW1CxWxH5ISl6qXbg0ilcr+j0aT:8EeeOEQwD6YQ8pt5
TLSH
T187765CE460E19253F38640B3718993EB21EFC01C6036CE48579497FAA9748EB8E577BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

explorer.exe

Path C:\Windows\Resources\Themes\explorer.exe
Size 135KB
SHA256 299267fb6ecab7ff7f981795f00ba4f9837992d2b195b324182a5f300aa9d2b4
MD5 4c3f84a54e32cba8688f3f929cdb62a3
SHA1 e2878ea07637d46017ce1963cf8a589df8a325d2
SHA512 64c520ae12c826d2f712dd2a8868d84e2473e7c2336f69a0995b5fb7d30dc51ebf5ba49cdbde67d7707f6b3424008728f98e18bfece57b72b8ca793f3268cf12
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVBS:UVqoCl/YgjxEufVU0TbTyDDalrS
TLSH
T11DD31A236F50503ED82786F169E4D65EBA621E3A0BD1BD0B3696BF402972503B6F130F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icsys.icn.exe

Path C:\Windows\Resources\Themes\icsys.icn.exe
Size 135KB
SHA256 3dba2a70effa05a80179b5279d1d18b24e2bf8b64b61078205a80c865546fc86
MD5 a3a834d45262e95a8bbda7b05e64d58d
SHA1 bdaed4c3585fc20d0cf44240081c072b8bdbcdd7
SHA512 04378e657d1b8587874a127ea0d77e0e91d79d18d8584d03ee7e0f514cb63d92d6c69620cf551498a809ecd68d77cb10a0c78ee4181277493b78a874337ef686
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVBf:UVqoCl/YgjxEufVU0TbTyDDalrf
TLSH
T14FD3F923BE20202FD852C6F22869EA3EBA161E391BD05D5B73977B442572207B5F531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spoolsv.exe

Path C:\Windows\Resources\spoolsv.exe
Size 135KB
SHA256 a02790c56246a121ad05b767cfc82c36c4e0a031ee88acf1096fa1cfc20360f9
MD5 00a84b20c64b93f5446455acb0ff503d
SHA1 82838c6d6bab91624dec5d57b07ecefed4f95ae1
SHA512 ec63060f57e987f9dbd82e8b28165817d5154acb8a9aa4cf22a4127e3e9f404cf895772de93d0e5b61d76abd8f22d1bf82c231e8a8e793b0ff9c3725fdcfcc0d
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVB5:UVqoCl/YgjxEufVU0TbTyDDalr5
TLSH
T15ED3E927AE10406FE9124AF17895DE7EBA221D791BE1AD4B3393B74129B5243B5F030F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Windows\Resources\svchost.exe
Size 135KB
SHA256 98ae1320650d015404a7ee2beee8b40cb0422a60d8798cb886ee5e4ec9a79a0f
MD5 8c84606281aa44d443c2726c8c76d624
SHA1 e28e5a91dc04ba1d9a61dc00fecb3733f027ead1
SHA512 79c74940ac9dc02099dc725c28b6ce5cf108fd130594ba0a3c3dd2edfa17c2cd219248b2205ff9fcdad52fe47666790111fefce0e1c2572e36712e9097a0a2bd
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVBE:UVqoCl/YgjxEufVU0TbTyDDalrE
TLSH
T15ED33A237D24501ED852C9F168BDD76DBE261E350BA0AD0733A2BB086676583B5F231F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/236-50-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/2980-49-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4564-48-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4664-1253-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5072-51-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5072-0-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5788-1252-0x0000000000400000-0x000000000041F000-memory.dmp

Download