bdaejec | b28935f7f595b2b84997109368a57641b9a7766191986cf070758574736c3c5f

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 22:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Size 5.8MB
Sample260905-17lbxstdpa
SHA256 b28935f7f595b2b84997109368a57641b9a7766191986cf070758574736c3c5f
MD5 a95a0e4c2829b612bedc2ba39e230e9c
SHA1 d1b82721b1d0f265bd59121e88c7e862cab4057a
SHA512 79f9e37fc9630d44bc44d74c148b20304c476336c951e4922c5e9b6f963b208d4e7b72a90701d74a5fd6a86578bd83f7b61893a7894811e91e12362ae0d5872f
SSDEEP 98304:W3MjdiFDQKdn95BbP4KCcR8qLf3gbz2FSmaI7dlm:ZiDQKd9bzQbz2FSmaI7dl
TLSH
T172569E52BF4D817AC95A2131472DAF2A502EFCA4773451D3B2743E7EEC763C12839A1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware aspackv2 backdoor defense_evasion discovery execution bdaejec persistence phishing spyware stealer trojan

Malware Config

Extracted

Family

bdaejec

ddos.dnsnb8.net

Signatures

Family: Bdaejec
Bdaejec is a backdoor written in C++.
backdoor bdaejec

Detects Bdaejec Backdoor. 1 IoCs

Bdaejec is backdoor written in C++.

resource	yara_rule
behavioral2/memory/4676-9-0x0000000000B40000-0x0000000000B49000-memory.dmp	family_bdaejec_backdoor

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 3 IoCs

resource	yara_rule
behavioral2/memory/1004-0-0x0000000000B10000-0x00000000010F1000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1004-8-0x0000000000B10000-0x00000000010F1000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/1004-934-0x0000000000B10000-0x00000000010F1000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 3 IoCs

resource	yara_rule
behavioral2/memory/1004-0-0x0000000000B10000-0x00000000010F1000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/1004-8-0x0000000000B10000-0x00000000010F1000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/1004-934-0x0000000000B10000-0x00000000010F1000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables packed with ASPack 3 IoCs

resource	yara_rule
behavioral2/files/0x00080000000068df-4.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4676-5-0x0000000000B40000-0x0000000000B49000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4676-9-0x0000000000B40000-0x0000000000B49000-memory.dmp	INDICATOR_EXE_Packed_ASPack

A potential corporate email address has been identified in the URL 1 IoCs

phishing

description	flow	ioc	pid	Process	stream
Email address	19	[email protected]	4136	firefox.exe	45

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x00080000000068df-4.dat	aspack_v212_v242

Executes dropped EXE 13 IoCs

pid	Process
4676	JFOhoo.exe
2924	firefox.exe
4136	firefox.exe
4612	firefox.exe
5236	firefox.exe
2976	firefox.exe
4860	firefox.exe
2936	firefox.exe
2152	firefox.exe
3156	firefox.exe
2392	firefox.exe
1280	firefox.exe
2112	firefox.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe /onboot"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	firefox.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe	JFOhoo.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Windows Defender\DlpUserAgent.exe	JFOhoo.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Windows Defender\mpextms.exe	JFOhoo.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	JFOhoo.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	JFOhoo.exe
File opened for modification	C:\Program Files\Windows Defender\MpCmdRun.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	JFOhoo.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	JFOhoo.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	JFOhoo.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	JFOhoo.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	JFOhoo.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseImdsCollector.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE	JFOhoo.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	JFOhoo.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	JFOhoo.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_835519922\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_854042914\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_835519922\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2476_1405297594\_locales\lt\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6980	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6908	1004	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JFOhoo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3668	msedge.exe

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Control Panel\Colors	firefox.exe

Modifies Internet Explorer settings 1 TTPs 22 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Low Rights	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134331203107450186"	msedge.exe

Modifies registry class 18 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Therad = "1"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Model = "247"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{A1217157-9E54-4504-A3C2-81DEBE642335}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1004	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
1004	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	1004	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Token: SeDebugPrivilege	4136	firefox.exe
Token: SeDebugPrivilege	4136	firefox.exe
Token: SeDebugPrivilege	4136	firefox.exe
Token: SeDebugPrivilege	4136	firefox.exe
Token: SeDebugPrivilege	4136	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
4136	firefox.exe
4136	firefox.exe
4136	firefox.exe
4136	firefox.exe
4136	firefox.exe
4136	firefox.exe
1004	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
2476	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1004	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
1004	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
1004	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
1004	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
4136	firefox.exe
1004	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
1004	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
1004	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
1004	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
1004	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1004 wrote to memory of 4676	1004	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe	89
PID 1004 wrote to memory of 2780	1004	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe	91
PID 1004 wrote to memory of 2924	1004	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe	92
PID 2924 wrote to memory of 4136	2924	firefox.exe	93
PID 2924 wrote to memory of 4136	2924	firefox.exe	93
PID 4136 wrote to memory of 4612	4136	firefox.exe	94
PID 4136 wrote to memory of 4612	4136	firefox.exe	94
PID 4136 wrote to memory of 4612	4136	firefox.exe	94
PID 4136 wrote to memory of 5236	4136	firefox.exe	95
PID 4136 wrote to memory of 5236	4136	firefox.exe	95
PID 4136 wrote to memory of 5236	4136	firefox.exe	95
PID 4136 wrote to memory of 5236	4136	firefox.exe	95
PID 4136 wrote to memory of 2976	4136	firefox.exe	96
PID 4136 wrote to memory of 2976	4136	firefox.exe	96
PID 4136 wrote to memory of 2976	4136	firefox.exe	96
PID 4136 wrote to memory of 2976	4136	firefox.exe	96
PID 4136 wrote to memory of 4860	4136	firefox.exe	97
PID 4136 wrote to memory of 4860	4136	firefox.exe	97
PID 4136 wrote to memory of 4860	4136	firefox.exe	97
PID 4136 wrote to memory of 2936	4136	firefox.exe	98
PID 4136 wrote to memory of 2936	4136	firefox.exe	98
PID 4136 wrote to memory of 2936	4136	firefox.exe	98
PID 4136 wrote to memory of 2936	4136	firefox.exe	98
PID 4136 wrote to memory of 2152	4136	firefox.exe	99
PID 4136 wrote to memory of 2152	4136	firefox.exe	99
PID 4136 wrote to memory of 2152	4136	firefox.exe	99
PID 4136 wrote to memory of 2152	4136	firefox.exe	99
PID 4136 wrote to memory of 3156	4136	firefox.exe	100
PID 4136 wrote to memory of 3156	4136	firefox.exe	100
PID 4136 wrote to memory of 3156	4136	firefox.exe	100
PID 4136 wrote to memory of 3156	4136	firefox.exe	100
PID 4136 wrote to memory of 2392	4136	firefox.exe	101
PID 4136 wrote to memory of 2392	4136	firefox.exe	101
PID 4136 wrote to memory of 2392	4136	firefox.exe	101
PID 4136 wrote to memory of 2392	4136	firefox.exe	101
PID 4136 wrote to memory of 1280	4136	firefox.exe	102
PID 4136 wrote to memory of 1280	4136	firefox.exe	102
PID 4136 wrote to memory of 1280	4136	firefox.exe	102
PID 4136 wrote to memory of 1280	4136	firefox.exe	102
PID 4136 wrote to memory of 2112	4136	firefox.exe	103
PID 4136 wrote to memory of 2112	4136	firefox.exe	103
PID 4136 wrote to memory of 2112	4136	firefox.exe	103
PID 4136 wrote to memory of 2112	4136	firefox.exe	103
PID 1004 wrote to memory of 3500	1004	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe	106
PID 1004 wrote to memory of 2264	1004	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe	107
PID 1004 wrote to memory of 3192	1004	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe	108
PID 1004 wrote to memory of 4508	1004	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe	109
PID 1004 wrote to memory of 2476	1004	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe	110
PID 2476 wrote to memory of 2564	2476	msedge.exe	111
PID 2476 wrote to memory of 3668	2476	msedge.exe	112
PID 2476 wrote to memory of 2236	2476	msedge.exe	114
PID 2476 wrote to memory of 2236	2476	msedge.exe	114
PID 2476 wrote to memory of 5072	2476	msedge.exe	113
PID 2476 wrote to memory of 5072	2476	msedge.exe	113
PID 2476 wrote to memory of 5072	2476	msedge.exe	113
PID 2476 wrote to memory of 436	2476	msedge.exe	115
PID 2476 wrote to memory of 1224	2476	msedge.exe	116
PID 2476 wrote to memory of 1224	2476	msedge.exe	116
PID 2476 wrote to memory of 1224	2476	msedge.exe	116
PID 2476 wrote to memory of 436	2476	msedge.exe	115
PID 2476 wrote to memory of 436	2476	msedge.exe	115
PID 2476 wrote to memory of 5480	2476	msedge.exe	118
PID 2476 wrote to memory of 5480	2476	msedge.exe	118
PID 2476 wrote to memory of 5480	2476	msedge.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1004
- C:\Users\Admin\AppData\Local\Temp\JFOhoo.exe
  C:\Users\Admin\AppData\Local\Temp\JFOhoo.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4676
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\334221c5.bat" "
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:6980
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2780
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
    3⤵
    - A potential corporate email address has been identified in the URL
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Drops desktop.ini file(s)
    - Checks processor information in registry
    - Modifies Control Panel
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4136
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1972 -prefsLen 27097 -prefMapHandle 1976 -prefMapSize 270279 -ipcHandle 1720 -initialChannelId {f0b2bbf3-3d9e-40f2-9454-d3a4ef8313d7} -parentPid 4136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4136" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      Executes dropped EXE
      PID:4612
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2428 -prefsLen 27133 -prefMapHandle 2432 -prefMapSize 270279 -ipcHandle 2436 -initialChannelId {4ecc3d0f-1aa2-479d-a537-978732429cd9} -parentPid 4136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      Executes dropped EXE
      PID:5236
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3880 -prefsLen 25213 -prefMapHandle 3884 -prefMapSize 270279 -jsInitHandle 3888 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3896 -initialChannelId {04c7d999-4521-4b1f-b150-c2c744ca09b1} -parentPid 4136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Executes dropped EXE
      Checks processor information in registry
      PID:2976
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4068 -prefsLen 27323 -prefMapHandle 4072 -prefMapSize 270279 -ipcHandle 4160 -initialChannelId {8b7c485d-9d3a-49c2-baac-4549009a4be6} -parentPid 4136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4136" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      Executes dropped EXE
      PID:4860
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3180 -prefsLen 34822 -prefMapHandle 3176 -prefMapSize 270279 -jsInitHandle 1408 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4572 -initialChannelId {80e26e17-adc0-4577-bc62-c144d77d2eba} -parentPid 4136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Executes dropped EXE
      Checks processor information in registry
      PID:2936
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5200 -prefsLen 35010 -prefMapHandle 5204 -prefMapSize 270279 -ipcHandle 4576 -initialChannelId {c0e6bd7c-2155-416c-bf45-6abea67a04ce} -parentPid 4136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Executes dropped EXE
      Checks processor information in registry
      PID:2152
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4688 -prefsLen 35062 -prefMapHandle 2776 -prefMapSize 270279 -jsInitHandle 3448 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1628 -initialChannelId {b024f11e-b1c3-4c3f-b7ea-c6ce346a6da0} -parentPid 4136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Executes dropped EXE
      Checks processor information in registry
      PID:3156
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2864 -prefsLen 32952 -prefMapHandle 4984 -prefMapSize 270279 -jsInitHandle 4688 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2952 -initialChannelId {96faf5a7-29c4-4c31-aa64-876e4677b307} -parentPid 4136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Executes dropped EXE
      Checks processor information in registry
      PID:2392
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5900 -prefsLen 32952 -prefMapHandle 5904 -prefMapSize 270279 -jsInitHandle 5908 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4984 -initialChannelId {86c24e5f-a3c4-4109-b988-e2686b886e52} -parentPid 4136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Executes dropped EXE
      Checks processor information in registry
      PID:1280
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6064 -prefsLen 32952 -prefMapHandle 6068 -prefMapSize 270279 -jsInitHandle 6072 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6080 -initialChannelId {aa902627-6e29-41db-9cc0-2af654073840} -parentPid 4136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
      4⤵
      Executes dropped EXE
      Checks processor information in registry
      PID:2112
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3500
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2264
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3192
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.internetdownloadmanager.com/welcome.html?v=642b27
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffa46e5c188,0x7ffa46e5c194,0x7ffa46e5c1a0
    3⤵
    PID:2564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,405697797332740249,2224534802796066576,524288 --field-trial-handle=2268,i,11390142715241736852,13000079794779539053,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,869961907074088959,13239159457151575247,262144 --field-trial-handle=2268,i,11390142715241736852,13000079794779539053,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
    3⤵
    PID:5072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2288,i,6833287730969192835,12499845784511991100,524288 --field-trial-handle=2268,i,11390142715241736852,13000079794779539053,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:13
    3⤵
    PID:2236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,10233780842844673817,4422571968608991196,2097152 --field-trial-handle=2268,i,11390142715241736852,13000079794779539053,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
    3⤵
    PID:436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,17476998237811220984,7800556714756025554,2097152 --field-trial-handle=2268,i,11390142715241736852,13000079794779539053,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
    3⤵
    PID:1224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,12710698204575642293,11563173316216511866,2097152 --field-trial-handle=2268,i,11390142715241736852,13000079794779539053,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
    3⤵
    PID:5480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,18137658572969784797,8308621587105875184,2097152 --field-trial-handle=2268,i,11390142715241736852,13000079794779539053,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:9
    3⤵
    PID:5920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,3293410634293804538,192263132880299516,524288 --field-trial-handle=2268,i,11390142715241736852,13000079794779539053,262144 --variations-seed-version --mojo-platform-channel-handle=3864 /prefetch:14
    3⤵
    PID:6280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3796,i,12802392501209336898,3048331230823833382,524288 --field-trial-handle=2268,i,11390142715241736852,13000079794779539053,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
    3⤵
    PID:6592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3808,i,17831066199981390109,18221072805602987539,524288 --field-trial-handle=2268,i,11390142715241736852,13000079794779539053,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
    3⤵
    PID:6612
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,2530517571209681370,2586012991874942663,524288 --field-trial-handle=2268,i,11390142715241736852,13000079794779539053,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:14
    3⤵
    PID:6736
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,2530517571209681370,2586012991874942663,524288 --field-trial-handle=2268,i,11390142715241736852,13000079794779539053,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:14
    3⤵
    PID:6752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,11913060771259270126,11442556176575850102,524288 --field-trial-handle=2268,i,11390142715241736852,13000079794779539053,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
    3⤵
    PID:7036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,4596808810442469062,14643134796337568871,524288 --field-trial-handle=2268,i,11390142715241736852,13000079794779539053,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:14
    3⤵
    PID:6992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,10061145246881054847,2018323921656623748,524288 --field-trial-handle=2268,i,11390142715241736852,13000079794779539053,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:14
    3⤵
    PID:6700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,5065690563993540183,15674075946115231466,524288 --field-trial-handle=2268,i,11390142715241736852,13000079794779539053,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:14
    3⤵
    PID:6748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=744,i,7880871467502039088,16489670317102428261,524288 --field-trial-handle=2268,i,11390142715241736852,13000079794779539053,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
    3⤵
    PID:5780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,5434291128637121738,6974693016968603065,524288 --field-trial-handle=2268,i,11390142715241736852,13000079794779539053,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
    3⤵
    PID:5732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,5369282284247008737,6445151933705497162,524288 --field-trial-handle=2268,i,11390142715241736852,13000079794779539053,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:14
    3⤵
    PID:4876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,13250867174057121808,15425682638197462007,524288 --field-trial-handle=2268,i,11390142715241736852,13000079794779539053,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:14
    3⤵
    PID:7136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,2732252598086191845,16277016024353330704,524288 --field-trial-handle=2268,i,11390142715241736852,13000079794779539053,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
    3⤵
    PID:6404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=916,i,6662576571492022042,5892421450659036580,524288 --field-trial-handle=2268,i,11390142715241736852,13000079794779539053,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:14
    3⤵
    PID:6916
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1004 -s 1512
  2⤵
  - Program crash
  PID:6908

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1004 -ip 1004
1⤵
PID:6556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

firefox.exe

Path C:\Program Files\Mozilla Firefox\firefox.exe
Size 667KB
SHA256 81a0316cd0efdad79c3f268a0e25a6e7133e9ad6ebf970fe0db36cd4e87ff849
MD5 af7223cf9bf7a64090d631c628eba868
SHA1 7a3f7927c2539bea7a877e1a966304302a093139
SHA512 f33a766daaaf593c22cd3dca277d4a62203280195496e2015ac1e5b7aaade0eb9af67b7f9596c206e04be2aea856b86f70d113ffb9aadeb15517e943daed410c
SSDEEP 12288:sOC854ZTW7EOggJXnJoU7s8oNXhaTWEJX36LW9zwHJem7OzwHJe0Ihf7Ez:sOvG1kQ8oNxaqIn4SwpemIwpelzEz
TLSH
T115E49E03F38516F8E48AD5B49A42D233E5723C840B51A1DB1BE93F2A3E71AD15B7876C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 46a4aeb403b9fb7f6c68d6947939eaaca4f4142a3d5486a6483e2e33a6b56b7a
MD5 e72b5f9fcad6bce570ebc2f9369b032b
SHA1 9ea77e54608af85723dc2ba22d7f05762aeee426
SHA512 3ab852a645107658e1d48ae55b7cf74da914de89622fda8cd4e9b88296ff24f85c7f0940205cfc49e6927547a1b91fd95ff93c7628abb0b92174b7a1c5b0218d
TLSH
T18451A61257B2CAD6DBA244F693D367A9F2F4C4490E17AE31C25CAC316982FE771C0017
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 95979c987bd4056da7cac825905f5e5c94fdd37702b7911f40eeeca603b83454
MD5 9bc62e37aff19c41206e99a16d7ed9e2
SHA1 eecf44546c00c1b75c477f09b533a4dca1b4a621
SHA512 a5fe1677623f9135b1947a6b0ed8bfe0e2f60d0c63c627301ad924a92d221ab6ed8458a7540f004dfa5be86a97810134b28af3f0201d068e773bf70be7391f0b
TLSH
T18641CEF3C3F895AD890156F0AB186E1BCE2D0915436C7C5AC9E4AE2B93E3471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 17f66caabca43d74c1528fa731cc6111ce8edf356852224e2084dafd0b6c99b8
MD5 d1fcdd79fc742027a1b259531d80d0db
SHA1 a1d6875e9fbcfee01ed3fb6cf41e587ef46758af
SHA512 d5f9404201fe723dcdb36001c7c0f843242833fa31e40a51fc549c2e4760d704a2ba75967f66817d9a407bb7c25d5e0637c1c91764befaa332889b339dfd4967
SSDEEP 192:sxRiRGGCY/fcsxIqlBEZIbZwzoA8ppo/g6+WNYBm/YoOf/Y7GfIgDFeoBaJ:sxRiwY/fcsmqr6Ilp+/5r/E1XI
TLSH
T18E42C61A6938A93B9CCBD20DBA55FF53D2FA5032A1D12E48B7FC9A1C04E76DD520740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d65d84decd4a6780ce24dc24496a0b115d877f58d0f0656468da0ca1231411ee
MD5 d159b31438fa1488d98e4868a72f53f0
SHA1 18ea0ea6407bea7fe80dedc1e31b43e4ee9ceca3
SHA512 93ab08f87b506532cf6b47ff89286f931fa7fa5cdd1a100d74ff81551cadd13d514ff2524b4e83e1717f5391efa2465f7fa330e79b557dd3291feb628f7b9089
SSDEEP 192:sxRiRGGCY/fcsxIqlsAEZIbZwzoA8ppo/g6+WNYBm/YoAf/Y7GfIgDfeoBaJ:sxRiwY/fcsmqiA6Ilp+/5r/w1ZI
TLSH
T1EF42C7166938A93B9CC7D20DBA55FF53E2FA5032A1D12E48B7FC9A1C04E76DD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d14e9614f785355d40a7a6da4686c0256ed1d24980e04b847268aca6dd787216
MD5 8c67f89842439db6d09f2b4fc89e7ec6
SHA1 68cf4bc79590df161a416f04cf93861b526bbfc4
SHA512 fda2737f03e62cd7798dc6d7a24eee869f9a2150adc8775faafcde28328c9d1b7711f69345e5c4a2a77d2cf0b8fd2d5542b9ebc5bd9083d5df515e070417f37c
SSDEEP 192:sxRlRGGCY/fcsJqlBEZIbZwzoA8ppo/g6+WNYBm/YoOf/Y7GfIgVeoBaJ:sxRlwY/fcsJqr6Ilp+/5r/E1zI
TLSH
T11A42C61A6938A93B9CCBD20DBA55FF53D2FA5032A1D12E48B7FC9A1C04E76DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 d0a16254fd2ea46e7124fb030d5facf3f39022a51886ece9c01571a5a772dd74
MD5 930f17bb39d68146bf0ea0ade86075d5
SHA1 efd6edd588c22d6303ce14556f5ef5d3fe4b197b
SHA512 70def3ef8293fee20ff91c1cd6f488ecfd3e790e3460bcf9542272b53daf65257e053277df43cdf82ddafa66d594087ec1afacbba9f79a6e1d84936dd5bc7986
SSDEEP 768:j26H5V7pLuLz6RWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVg4BVuwWro9ve0r:j26H5jEz6RWgs2f02u1jaj4B4wty8
TLSH
T133D2DB7B740DCABF4F804ADDDC197E9F6DA802CB9698CD8047FE851C02C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 72e21421678578be9a52678efd7de7a0d240df0199ae4df3d07c8377dcc27ab2
MD5 ad60a166e169bbdb45bb33d247316b4f
SHA1 8c404b2278341fec7c6b57e12dcea38832c5faab
SHA512 7f9374359abb5fdc48e0399e12336d7742bc99a87488ddd19c9cb4bcfe64cb5941709ced82453eccf97cbaaac6d851b64f6e4f900299bd8c2b64540c26eef4bc
SSDEEP 96:KREEEFEwE0EOEyE2EUWESE/EfgE8EUK4ERgE2EUcE0E0E/EuEUEJHGbqGAoouWYX:C3gFB31lERe1JDggH2vHG5FaHGbqGAoh
TLSH
T12DA17854717A0280787D654981F8991F97C17AD33418FA2B3F9841AE0F2BE275EFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

323a0bf9-968b-47b3-86aa-348a6fa373dd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\323a0bf9-968b-47b3-86aa-348a6fa373dd.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 a2bb7121342d754dd8933b57f61f65efc06ac330dc8070b97cc0d9d8e61ec2c3
MD5 8e087158a86f262b365b9b3ba07131aa
SHA1 dbe442bc5e0f88f4496b2bed6f09d6817692cd71
SHA512 99cc8541e3fe1b4657d6e0dc5215f7ff6d0911c800583ef6efcc24f0ad1eef838ef9a31f010637c1085605d71c12b0362bc162e49026d08c7eb7dad1b0552ef4
SSDEEP 768:E83+c/TBOWCuttxONXyer1IRCzni9ccTR3lJ:E831VSIqnzcTR3lJ
TLSH
T117F2BF71A4A5DD234CE6E3C6B2477393BEF9206389C44A50E9EA5F1E0583A9E130F817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 511cc746c36e1349644279e8a134b4f7af720726e1194494ff4e04e91e5c45de
MD5 32656ca6d5b69e574ec1c89a65b92e2f
SHA1 dc2ff1dc68e135fcaf38060994435289bca05bfd
SHA512 0eec1dd5f7bebeadefbb91dc5b695ac76179f8e3d1baabfc63f3f45e183a43979148b7057f5dcc8e8128f85da9745ab2bb71ce261755823923b4f025f09ca383
SSDEEP 768:TyFQt3awgDPpsOWCuttjONXyer1IRCzni9ccTR3lJ:TJt3AySIqnzcTR3lJ
TLSH
T1D91317F594D78937D8AE9387633D6E42ADBCD063B4848990BBD55E4DCC825BFC30A806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 6f3728e92c17136cac92d420bdf30ec44c2625eece131717fd5f87fea42c9b22
MD5 1cf168121b8f4c05f6e202f625364a86
SHA1 cc3a9a905d98bab102b7913d352ce0f36d7c85fd
SHA512 bb4dc1ce86d07512b6b5a604f2645ca5e52ff0543a99134b34d63d167d817c14f645bb47a666ab90306170dc64da697c5824903caa4c3e2b43f8a917c3ff7642
SSDEEP 768:N83zc/TBOWCuttxONXyer1IRCzni9ccTR3lJ:N83QVSIqnzcTR3lJ
TLSH
T1A9F2BF71D4A5DD234CE6E3C6B2077393BEF9206399C44A50E9EA5F1E0583A9E130F81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 72bcacf8fed271d093ecff1ebe4c6d0c4680d7f51543433d477f51efbf08bea7
MD5 7fc0884462def2a85a1f64146eff1ea4
SHA1 2317209b78861c704b59f10859118aef910f8d72
SHA512 c0eaa46fd0af4bc933e06df2dcae126c34b1f6eece13d542cfac6c10d9975c8050589586b4954648958bb378922bc588164a5949167179baece3efd31cdb71fb
SSDEEP 768:hrv+4UNbdz3jz/TBOWCutsONXyer1IRCzniB3eVH1SK7:hbsbV3XySIqn8EH1l
TLSH
T12703CF36A4A89E338DE2A3D6B14773037FB86057C6840790EDDE1F4E069B99D130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 5cf0f5462cff158cfe287c867256f7c00a7d089f9cf8e691241c8aaedc8e2fb1
MD5 b397ea59a6e6915d84456afa4a200e4a
SHA1 d60b4fbe3a2a91169ba7101b472578fa0956539a
SHA512 6a8d555d60f1457420c2a47b9f919d4882f6f6b091f2b5a43178cfef8274f777f614d5aacfd90ceb96548a2f502728c1f0487e97e655364b66ab11af972c8910
SSDEEP 768:3rv+4UNbdP3oc/TBOWCuttxONXyer1IRCzni9ce:3bsbh3TVSIqnze
TLSH
T19603AF31E469DE238DE2E385B14B77537FB8206789C00B54D9DA5F4E05875AE230F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 4a101791c15dcb20fa42b7bee86b25033e92125b5bb6a18f64dc3aaefb603a5b
MD5 9a2d7ddc8f39f9844c97193eec5e67b6
SHA1 9b9ed26d09f10ac205e760468ccb50981ad6358d
SHA512 7eb838838410281aedff21ff2fab4603146a7373b0708ab1d76fd875c4789ef8794de301a01aa4b9a71c7bea1a48211bff96a99da1e136b35b7fe19b97f43432
SSDEEP 768:6rv+4UNbdz3UO/TBOWCuttvONXyer1IRCzniwceVH1SK7:6bsbV31jSIqn4EH1l
TLSH
T1FF03BF31A069DE334DE2E396B147B3537FB8206789800B90EDDA1F5E069759E230F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5E43012191E7B1F510ACD5BF039D8BF1B9A277B2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\cache2\entries\5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
Size 16KB
SHA256 e0b11b037e368153de2fc00c89d5bad8e527494f9b6c5928b6602a2229faedd5
MD5 02857f94e215af5cc7eb7e2d5555ccc9
SHA1 fcff9f0949aa4cd107f5fdcc3587ccb607c5ed81
SHA512 42143891fb92df2f39781329b2dcfecf6be9e616b72551d9d8024987a1aa2d9c0b0cba665e88bc8e3563c6845cbbf51ff0f803426e96767146ed70d39da7d822
SSDEEP 384:HkCjiO024YXDL84KKDL849B7SOEAd9KVRaAcP+AWRMAP:EzZYXDL8lKDL8CB7S/AmVAf+hRMC
TLSH
T100728D795F003CBC1597C0E8C5F9929A8D18B7A7CFE6806D21583D0DCAD8AA9B0F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 d11497f22732984740ec26809c74e5069627f4ed0942bdd8f84c209c3dbd9d80
MD5 fd3e55ef163832467165d1c94e447bb9
SHA1 acf69a2d9d344aec960add3be0b76ae96a4953ca
SHA512 ad5c9e6795265ab6dd891aa071b62cbbb51ce23000f3e988840fcebf3915892b2ed19acb7b2527573601af090d09c6ce28f1856112d28f6f192f2ea77c4d89c8
SSDEEP 1536:jTrliIKeOrDDs9Jc+um807YP4AB31Tu//eDppin5SzPm52F2ChoUUZtRFlAqf5sn:j3lm+um807QV1EapW6m5s2eM3pf5jZne
TLSH
T10AA3BFF6DFA3CD6D55FFD42DAA82883EFD222404B3A73009D813671456C6BB86779248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

334221c5.bat

Path C:\Users\Admin\AppData\Local\Temp\334221c5.bat
Size 187B
SHA256 dada3f0e0bb24982b524b5d368a62cce26ae66a82953501c0507089eb4eab255
MD5 87e4352b93bcaa6d897580dffa59bbf5
SHA1 42d17d154adf8151b03678e5b8e91c5ce5bab64b
SHA512 94b8fe81226c4ceb46b04ee78d81ab14d803504f5b2efa35abac39d6ee591861748f31c771aed6ab081d3acef4e13a61163c85c6b1d8027c058c7327fac8ec9d
TLSH
T1A9C0120282D7CA691454622F06E5624CD0655C5C3B4D2B115B31C47D61A680DB7C7741
MD5 SHA1 SHA512 TLSH

Submit Download

JFOhoo.exe

Path C:\Users\Admin\AppData\Local\Temp\JFOhoo.exe
Size 15KB
SHA256 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
MD5 56b2c3810dba2e939a8bb9fa36d3cf96
SHA1 99ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA512 27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
SSDEEP 384:7XZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:1QGPL4vzZq2o9W7GsxBbPr
TLSH
T10B62BFB34EC098FFC4CD353340823687CB7B4670DABA617F826288372895E19AC55595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f7461554-5875-4d15-93c0-1cdf84aaeca9.tmp

Path C:\Users\Admin\AppData\Local\Temp\f7461554-5875-4d15-93c0-1cdf84aaeca9.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2476_1231274240\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 32KB
SHA256 ffc67864e68cbe1e300a795fd33da1b20c2161649239547950e3839259855a11
MD5 ea7303f0c9cea93ca37cd5b85d513857
SHA1 77c21323f093e14ed1798423266b92ede21639e8
SHA512 6b79e97b83c27c9cded26db9ade1e249f0c6dd32fe1819ec30ff2ea324fd4bc131e3f14228bf0036731c34ac2a985f0a6cbe994b3fafd9c980056df611d647bd
SSDEEP 768:pf9YXj/ztoEID0Gcm+u5pHKRM1/GDbWb5bQ8w7e1/:pf9YXj/hbkpHaU
TLSH
T1F6E21184FB2A913FD41412BBDCA557142F7DB88A58192F5B3A4C64286C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 32KB
SHA256 b114224cf95396b360e08995115144e196f5742b29c0e64f95f928bef2791c99
MD5 a458b636b08aae2310ca0179f5874bba
SHA1 a615b540c9f540f9c5d05c9a347a941622bc51ad
SHA512 dfbeef3fc3158e54ef9e706648e920c84ca7713a0d8ffe2ed6c5d7a9fd6aa5ee59e46c3225ee8e3e65be3715588db0cccaa13013dbafb64045ed7e0dd0547134
SSDEEP 768:57e1sf9YXj/ztoEID0Gcm+u5pHKRM1/GDbWb5bQ8H:lf9YXj/hbkpHaY
TLSH
T1B1E21184FB2A913FD41412BBDCA557142F7DB88A58192F5B3A4C64286C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 22e2a2262264b48934cc31cb5706cb02f87a526e84f8d27f347d75cb06260aa9
MD5 13438aab358a4e597fff350056845f60
SHA1 bde2f6348144894e93cda15f64c90ef037674c17
SHA512 5ae05abdd3c0fe8b1163255d62dcb50cea9c06389dc169a0aa64c5224b0f59e59a2ee1b00125dfb0a3866a7554718faa09792e9b075f89c3cca3367bfd0efe67
SSDEEP 192:mHN1d66JoztdzgCl6mc0drOv5zbo7QJnyjLO+:+d66Joz/zgC1jqbocJnyjj
TLSH
T12BE11EA4E639863FC408027BCCA61B454F39398AD84E3F1935DD650C2D572DE768E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 bbbfaf2e04b10a85c0e394ee1f7a6949847cd1f111cbaa0576034e610c06bb08
MD5 a5f5e7c2e453a775700c412089e5ccf4
SHA1 00b8f8a84b6898eef54cd4006e1b7572a76d8e02
SHA512 f6b597f892411079eb104c0ae87265d2dd8ce0e84ef730afd31073efff5120e975be27d8dd2baafe57b247f1cc56ac9c2a579e86f73d20c61ed6dbea0cca76b6
SSDEEP 192:gOv5zbo7fZJnyjLOzHN1d66JoztdzgCl6mc0dz:LbozZJnyjCd66Joz/zgC1jd
TLSH
T11BE11DA4E639863FC408027BCCA61B454F39398AD84E3F1936DD650C2D572DE768E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\events\events
Size 1KB
SHA256 62c0c1a2bbb1ab1a839240c8969dd6e589c1bfc33b6cb5d6f9a590062440b2f8
MD5 d6b6ba9c4229dbb5b361841ab8edec89
SHA1 6061bb7a86cb47d3c143c43f2db93435507bbd3c
SHA512 3e7d60d21c769e461a00a6afe8366e9e61cfe1eb019a97232fc4dd239ff68e22ce05de883d76e60a331a51a0bbc8485c1d047f438a70f69bc969b51d7d619b5c
TLSH
T190219A5C39B84D6A6AC7F698744002CE53554A0709875C434D62FF8CCFC1ADA326E47E
MD5 SHA1 SHA512 TLSH

Submit Download

02f4b8a8-68c4-432a-9bce-f244e98a96f1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\02f4b8a8-68c4-432a-9bce-f244e98a96f1
Size 886B
SHA256 2c8eba53d2e5a0b72ec3364496a6625eaf38ae1c32f4638470268ae4b7ce190b
MD5 7949898f8d4f96286ad118548e3f8a88
SHA1 e6fed59e5cbc249eb2c0ed11f7a6167eaadc2172
SHA512 80d4e52b78bb667d6f5caa323932a0921d09f3f8f6ecc8a325d89f28f7e532efe1c31957fb469dca38642d04b5b11d7f2a729124b92085a6606ef0f06dfed64e
TLSH
T175112780D6747972CC28D38B99D6B7428FE47913C0C649047D958B184D7A56FA367707
MD5 SHA1 SHA512 TLSH

Submit Download

119352d5-ffbb-4d1b-af04-6156d2e4eb65

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\119352d5-ffbb-4d1b-af04-6156d2e4eb65
Size 235B
SHA256 b9001c48b4ced7da14658af20587f2eee6efe9d96010e087cc9ee4a23b70dc34
MD5 7fafbd2f394f8a5a24df20c444b71736
SHA1 2f9efd5d6bab5ed7d2abb195a51204a513fbec74
SHA512 36eede0e59d720c3c5a7fd2011e03718b96d35144787d7ed1d51e2343f2926637971328a34ceebded0e03cb242fc98d64ecdf89b7c2ac97f5fa1f56996bb42f2
TLSH
T1FBD097842888631D08104F27F0E078C630958C3315649820CB52407899F9EC4922299B
MD5 SHA1 SHA512 TLSH

Submit Download

24745066-1b08-4387-8fc1-be39cefadd87

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\24745066-1b08-4387-8fc1-be39cefadd87
Size 2KB
SHA256 f115b3c3cbd3286ad2383fca8d4966372c4a8ad0bf9a9cd1a9b20e31377c6450
MD5 eee852d99b6e91c5a407f46f3a53737a
SHA1 31b2182591eda02c62a89701f9655d646e04d5be
SHA512 42f6a7288803cbe0161aae1b062f7f6945543726d26e11447edcf0708600c7921435586c37b03754da59305ac214617494d9ae74ebdddd8392439a5112e399c7
TLSH
T19141315C79789C779CCAE29DD482338FD7259A43408218832E12DF0CCE96BDE236A427
MD5 SHA1 SHA512 TLSH

Submit Download

621778e0-9fee-4877-bda2-d6794562ac5d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\621778e0-9fee-4877-bda2-d6794562ac5d
Size 16KB
SHA256 d4d9c9b6cc718793e6d4c8fcfb41ae8c01fe9025a2baac557b2e0200831eeeed
MD5 1441b7d4c05d5be4746fc66003b195d8
SHA1 24db9cf463b0ed3c5d3f0d2e11397fb9d1590c14
SHA512 e0b0cb5ee0f3929a295ea5c5096febf4ea7f9c962573f6451583abb7d86f022aebaee67f1753206fb3c4a5dc2c5c14cf419e52a28e8b426deb7eb4fb8cedf07e
SSDEEP 192:ySvgPYJHQ1zESzxR+qObRJIgg2RqzJZyg3BKJi5cByA1BB99nOyB411biEjy:yJwQ1zESlR+BbRfg20zJ5yH9nRQK
TLSH
T17672EA56586056BA8151E3A9D4FC7FC3E6F528CF4C019FCA97E0BD085DDA0AE112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9c43582a-1bb9-43c3-8a4b-00d594377ebb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\9c43582a-1bb9-43c3-8a4b-00d594377ebb
Size 883B
SHA256 559d3a0bfe7c03d33d738ff4e94947c5f6b7a124f99d06efd6da0ce81d6fa52d
MD5 7cc930c8a0011f1b28aca68410ef1be6
SHA1 0f98a3193ec4c7fd8704bba483635082c2b92a1a
SHA512 24e814f3f443d9b3574ca79b7e5eaa489e1eea7e26aa55c011596921d3de6140826538b967c37c054cea02c2ff7b5144c5d106aef8b161faca5bd6def262706a
TLSH
T1B6110080D23176B2CC28938B89A677569FE8791380C685043EA58E084E7E65FA7A7247
MD5 SHA1 SHA512 TLSH

Submit Download

a652d2a5-47f9-4c35-8c24-54eb740c2414

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\a652d2a5-47f9-4c35-8c24-54eb740c2414
Size 235B
SHA256 4d18c9edb54d8e50ee42ea396615977deec0d4c00ed530bb4ee40b2dd888efef
MD5 3e65fff7f5f8d8142ab163963accfbb0
SHA1 f6b5aaa1204373e6092b090be4ed91f946699724
SHA512 11ed31a538088c2f36d71202ab69f0b2e594c55658dd0d174ab3825fa7ae516c338eed1e3130002be9286c04898f18301284f89ae18fd60659e0dc727c10f751
TLSH
T104D097D12498632D88040F22F0E079C230988C3354A15820C9904134AEBEFC88771D46
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\extensions.json
Size 16KB
SHA256 04926291c7f8f798be87055278db61d3186dad60457c8c338e03ebf989575612
MD5 53670d92898054432a13fec8a33e23ba
SHA1 905bd08904dabeb139d9e544de7b214bc00056a3
SHA512 daa134d7de4f05605cf62319d7b3900cadc6963427baf159f6683c53f551b7223fa0b9047ce210236ea34d102129a052220cfa30da3ea636ecba500e81930b7b
SSDEEP 384:qkI4v3Umldv/8dhWW94zg96oNL4H1L4PCL4HtL4HCL4H7b4h+:NI4fRfsXH446+4V4Y4N4Q4340
TLSH
T1B172521545048EB8298EA78BAA367E01C37D573B60845C78F4DD8FC842FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info.tmp
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
Size 8KB
SHA256 7043befa2961d198d9324923ef619e114dd5dcb9066eb1e44f83ec0329fecdbe
MD5 179648c307dab5ac53a72cbb3152a560
SHA1 04ec382844a86aa961f898c27505a3b1a71af551
SHA512 e56e7319864ecbd77338967b1fd5e9f88ac6859a04764b0634572d1d3a893f44c012450666bdaec46bf06ad4528b03019cac98b86d09620e29a1e4ddb29018e1
SSDEEP 96:xHppHYTNtGTUWqGqPf+Q7ObzSMSSlvdv9jRn+cWRI/CaooBw88ol78L4cnAV7wb:vpHYTNtzRPf+Q7+SS0RE73Bw88K9U
TLSH
T1DA020E3CA004CF7F75B6766CAC6489715AA2023BBBBFA8D710B95485024CF3445F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
Size 6KB
SHA256 cc9bf49b4840b5d216c7bf122260524f39d606bc1e350b3aa6f88325406fdc49
MD5 2ea5b9ec337441b2f7488b33986a100a
SHA1 167e128410331dc2b976d6f38461c76012ad6a29
SHA512 f0b071bb239a8a14745bc4fb916ee21dc014ee2b53e03443dc01be1589173a7fffff7ac1ef880c056fa58e902815694c70be56a1f505fc99c09eca5dad12fb9e
SSDEEP 96:xHpUTUWqGqPf2BQ71zSMSSlvdv9jRn+cHjCa/Bw88u8L4cnAV7wb:vRRPf2BQ7FSSFj7/Bw88qU
TLSH
T193E1207890488F6F74B6777CAC688831AAB2413B7BBF68C750B95485015CF3841F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs.js
Size 6KB
SHA256 7d518acaf2995ce4ba97defcd364cc605e8c7bc36d3ce84f2dfd51fd46b80949
MD5 c22e7fd988d78c30a4d73f95d0a7a70f
SHA1 01c86805c77402e128638c0619960189ad9859f6
SHA512 817a7cd3641a0f291885ca24075da37315c51b93b22543dfe185a7d1f54aa01d6f03690be876ce728834bff745af4e74445f008e6a0565c4d17bad997ea107ad
SSDEEP 96:xHpUTUWqGqPf2Bw21zSxKSSlvdv9jHn+cHjCa/Bw88u8L4cnAV7wb:vRRPf2Bw2SKSSXj7/Bw88qU
TLSH
T1AFE1217890088F6F74B677BCAC688831AAB2013B7BBF68C750B95484055CF7841F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 73ddad7a6c279e37586de3123e6d72d1829e28dfd9046128b026cba749b227cd
MD5 184f69af6421b236d4cb38d6897915c4
SHA1 d401af85d182e887f13b1e7b09eec2d5dc6f4168
SHA512 8978da548d016820430fa09b12ae850effae03b5e64fdbe0222be1570664632d278662f7c7cbdd7e2dac022184903e4a87fe9deceb8cf2fd389462d035b354de
SSDEEP 96:eNfRd99jLzQeW9jILA0NjoB8kMJttn0YJZQBKFN:4Rd99LIOnNcB85JttnTZEKz
TLSH
T1FF916D06360B3867BE5785CFDB5A4CF145B4300B9A8088FC90CF2A26B76BF0B7858479
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 933a335db7596f13135d40b40038669874efbe13dd890961de85934bd4e42438
MD5 4689110e896ff4878ace93a0820c06e5
SHA1 0c047178dd15d2fd336d25a4ef716c7185d0c412
SHA512 0bd943169dc36c8630390367a6f3f69c62d6f394652ad6e98e98cfe0096466d84a86ba4265fe10ce24325965524620a553342a51d97b775825fc16f2a5e3761e
SSDEEP 96:eNfRd99jLRQeW9jILA0NjoB8kMJttn0YJZQBKFJQ:4Rd99pIOnNcB85JttnTZEKrQ
TLSH
T1B3916D06360B2867BE5785CFDB5A4CF145B4300B958088FC90CF6A26B76BB0B7858475
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.0MB
SHA256 8102c3bc2c0d0a40647a15dd31505bceea524563a99fc856c9c7a1fa8f3364f5
MD5 37fe420597edf0e6b81acf8c6651344b
SHA1 bf65a37f5220de480c1d83f22d3e7e95b9173fab
SHA512 94218ab5c63851df445d04257b0d1dc373800c6fa11a4c2201bbbce26da80ec2e5b1346e77845f3893cc5d2b92c6fedefbb20704df36b0d61baf3d4d8a188ef8
SSDEEP 49152:EQZLL7RjjSRvYcO36tnS+fw05p/JNvcui:ZLbKtnS+fw6p/Pcui
TLSH
T14A362AF820D1A257F3814033664593EF21EFD00C6037DA085BA966E9A574CEF9E16B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 7.2MB
SHA256 5b97cc99e2cbce8f8fb08daceec20fd3a10d75fb5a432268c14adcb93fb6c4b4
MD5 77b5783bef534e08831d085c542d97e8
SHA1 8824bddb5a14ad69aed89657b1100ab8408b57ab
SHA512 bde8af945e7ba61cc42012f2b85ccb22b20278012b0dd3bb8e6f0807668f2f3a7de51615541fe9de1c41684823a469b8fd85a0ce398375882f3c40993a2d0d8a
SSDEEP 49152:kxpPqWswSOYHwunzFRVXzcZtyy85u25Yu0vqW1CxWxI5ISlmqXbg02lcr+jbaSZN:4QwunzFRVjcZ385uX
TLSH
T199765CE420E19253F38640B3718993EB21EFC01C6036DE48579497FAA9748EB8E577BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1004-934-0x0000000000B10000-0x00000000010F1000-memory.dmp

Download

memory/1004-0-0x0000000000B10000-0x00000000010F1000-memory.dmp

Download

memory/1004-8-0x0000000000B10000-0x00000000010F1000-memory.dmp

Download

memory/4676-9-0x0000000000B40000-0x0000000000B49000-memory.dmp

Download

memory/4676-5-0x0000000000B40000-0x0000000000B49000-memory.dmp

Download