5de79f898831a7a1abfb50e4936d3339af22d18e0bc204893785ca93dadb9361

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 00:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
Size 5.9MB
Sample260910-a3afrashnh
SHA256 5de79f898831a7a1abfb50e4936d3339af22d18e0bc204893785ca93dadb9361
MD5 0902dac0f7a0b49171940660715e2a61
SHA1 e70e2d4dfa5b39eb069c1f63404c53dc2698d38c
SHA512 f3743804b3af620e1fdd2d0792b2bf2ff56e879479b257ae401c1d313ba08ae5916984e229dc5b662738beae95cc7559f7fe008e0bab3a056dbdf33c292ee79e
SSDEEP 98304:vQxdm22GGvXupa+P4GR8qLf3gbz2FSmaI7dlJfg:+l2GGvXuwKQbz2FSmaI7dlu
TLSH
T112569C51BE4D8176D90B117247299F2A112ABD287B3865D3B2B43F7EEC323C16D3960B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery persistence spyware stealer trojan

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe /onboot"	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6072_1302777113\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6072_1302777113\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6072_1246463600\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7076	3308	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1480	msedge.exe

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 22 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm"	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3"	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe"	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3"	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Low Rights	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe"	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243"	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe"	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3"	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134334746746418244"	msedge.exe

Modifies registry class 19 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Model = "252"	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe"	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan"	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User"	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1"	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\WOW6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter"	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Therad = "1"	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{4BCB7134-D039-4FB5-A465-180610210C84}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe
6072	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	3308	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
Token: SeDebugPrivilege	6120	firefox.exe
Token: SeDebugPrivilege	6120	firefox.exe
Token: SeDebugPrivilege	6120	firefox.exe
Token: SeDebugPrivilege	6120	firefox.exe
Token: SeDebugPrivilege	6120	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
6120	firefox.exe
6120	firefox.exe
6120	firefox.exe
6120	firefox.exe
6120	firefox.exe
6120	firefox.exe
3308	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
6072	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3308	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3308	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
3308	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
3308	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
6120	firefox.exe
3308	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
3308	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
3308	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
3308	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3308 wrote to memory of 1388	3308	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe	89
PID 3308 wrote to memory of 4248	3308	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe	90
PID 4248 wrote to memory of 6120	4248	firefox.exe	91
PID 4248 wrote to memory of 6120	4248	firefox.exe	91
PID 6120 wrote to memory of 5072	6120	firefox.exe	92
PID 6120 wrote to memory of 5072	6120	firefox.exe	92
PID 6120 wrote to memory of 5072	6120	firefox.exe	92
PID 6120 wrote to memory of 1192	6120	firefox.exe	93
PID 6120 wrote to memory of 1192	6120	firefox.exe	93
PID 6120 wrote to memory of 1192	6120	firefox.exe	93
PID 6120 wrote to memory of 1192	6120	firefox.exe	93
PID 6120 wrote to memory of 5792	6120	firefox.exe	94
PID 6120 wrote to memory of 5792	6120	firefox.exe	94
PID 6120 wrote to memory of 5792	6120	firefox.exe	94
PID 6120 wrote to memory of 5792	6120	firefox.exe	94
PID 6120 wrote to memory of 1288	6120	firefox.exe	95
PID 6120 wrote to memory of 1288	6120	firefox.exe	95
PID 6120 wrote to memory of 1288	6120	firefox.exe	95
PID 6120 wrote to memory of 4284	6120	firefox.exe	96
PID 6120 wrote to memory of 4284	6120	firefox.exe	96
PID 6120 wrote to memory of 4284	6120	firefox.exe	96
PID 6120 wrote to memory of 4284	6120	firefox.exe	96
PID 6120 wrote to memory of 4628	6120	firefox.exe	97
PID 6120 wrote to memory of 4628	6120	firefox.exe	97
PID 6120 wrote to memory of 4628	6120	firefox.exe	97
PID 6120 wrote to memory of 4628	6120	firefox.exe	97
PID 6120 wrote to memory of 1260	6120	firefox.exe	98
PID 6120 wrote to memory of 1260	6120	firefox.exe	98
PID 6120 wrote to memory of 1260	6120	firefox.exe	98
PID 6120 wrote to memory of 1260	6120	firefox.exe	98
PID 6120 wrote to memory of 3008	6120	firefox.exe	99
PID 6120 wrote to memory of 3008	6120	firefox.exe	99
PID 6120 wrote to memory of 3008	6120	firefox.exe	99
PID 6120 wrote to memory of 3008	6120	firefox.exe	99
PID 6120 wrote to memory of 3980	6120	firefox.exe	100
PID 6120 wrote to memory of 3980	6120	firefox.exe	100
PID 6120 wrote to memory of 3980	6120	firefox.exe	100
PID 6120 wrote to memory of 3980	6120	firefox.exe	100
PID 6120 wrote to memory of 3564	6120	firefox.exe	101
PID 6120 wrote to memory of 3564	6120	firefox.exe	101
PID 6120 wrote to memory of 3564	6120	firefox.exe	101
PID 6120 wrote to memory of 3564	6120	firefox.exe	101
PID 3308 wrote to memory of 4356	3308	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe	103
PID 3308 wrote to memory of 2476	3308	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe	104
PID 3308 wrote to memory of 2412	3308	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe	105
PID 3308 wrote to memory of 5980	3308	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe	106
PID 3308 wrote to memory of 6072	3308	2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe	108
PID 6072 wrote to memory of 3996	6072	msedge.exe	109
PID 6072 wrote to memory of 5360	6072	msedge.exe	111
PID 6072 wrote to memory of 1480	6072	msedge.exe	112
PID 6072 wrote to memory of 5360	6072	msedge.exe	111
PID 6072 wrote to memory of 5360	6072	msedge.exe	111
PID 6072 wrote to memory of 4312	6072	msedge.exe	113
PID 6072 wrote to memory of 4312	6072	msedge.exe	113
PID 6072 wrote to memory of 5796	6072	msedge.exe	114
PID 6072 wrote to memory of 5796	6072	msedge.exe	114
PID 6072 wrote to memory of 4696	6072	msedge.exe	115
PID 6072 wrote to memory of 5796	6072	msedge.exe	114
PID 6072 wrote to memory of 4696	6072	msedge.exe	115
PID 6072 wrote to memory of 4696	6072	msedge.exe	115
PID 6072 wrote to memory of 2124	6072	msedge.exe	116
PID 6072 wrote to memory of 2124	6072	msedge.exe	116
PID 6072 wrote to memory of 2124	6072	msedge.exe	116
PID 6072 wrote to memory of 5188	6072	msedge.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-09_0902dac0f7a0b49171940660715e2a61_darkgate_elex_glassworm_remcos_stealc_stop.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Windows\system32\regsvr32.exe
  C:\Windows\Sysnative\regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  PID:1388
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4248
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
    3⤵
    - Drops desktop.ini file(s)
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:6120
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1948 -prefsLen 27098 -prefMapHandle 1952 -prefMapSize 270279 -ipcHandle 2012 -initialChannelId {d70c69dd-7502-4ef7-9672-19aa2990ccec} -parentPid 6120 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6120" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:5072
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2412 -prefsLen 27134 -prefMapHandle 2416 -prefMapSize 270279 -ipcHandle 2432 -initialChannelId {f956cd33-ce10-4a63-9a25-5c9f9ae61caf} -parentPid 6120 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6120" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:1192
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3828 -prefsLen 25164 -prefMapHandle 3832 -prefMapSize 270279 -jsInitHandle 3836 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3844 -initialChannelId {8c2e6dc4-bda2-4f1a-9dae-105150fffa50} -parentPid 6120 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6120" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:5792
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3992 -prefsLen 27274 -prefMapHandle 3996 -prefMapSize 270279 -ipcHandle 4080 -initialChannelId {4de22280-89c5-4b76-bf33-4d0a8ed784f6} -parentPid 6120 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6120" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:1288
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4468 -prefsLen 34773 -prefMapHandle 4464 -prefMapSize 270279 -jsInitHandle 4472 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4480 -initialChannelId {6de43c8f-f190-484d-bd82-e841461cfa3b} -parentPid 6120 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6120" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:4284
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4992 -prefsLen 35010 -prefMapHandle 4948 -prefMapSize 270279 -ipcHandle 2872 -initialChannelId {0249cf55-7789-4a05-b217-e5546cace190} -parentPid 6120 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6120" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:4628
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5532 -prefsLen 35062 -prefMapHandle 5536 -prefMapSize 270279 -jsInitHandle 5540 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5544 -initialChannelId {3d0d4980-14f6-4356-99fb-58ecdf187cc5} -parentPid 6120 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6120" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:1260
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3844 -prefsLen 32952 -prefMapHandle 4004 -prefMapSize 270279 -jsInitHandle 4224 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4212 -initialChannelId {4bf362fb-ca1e-4244-bc15-36be4a5731cd} -parentPid 6120 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6120" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:3008
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5892 -prefsLen 32952 -prefMapHandle 5896 -prefMapSize 270279 -jsInitHandle 5900 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4004 -initialChannelId {03ec4dab-eb50-42c0-867e-e77ebc363045} -parentPid 6120 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6120" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:3980
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6056 -prefsLen 32952 -prefMapHandle 6060 -prefMapSize 270279 -jsInitHandle 6064 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6072 -initialChannelId {413548aa-3c2c-484d-9176-e6eaa98ced1c} -parentPid 6120 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6120" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
      4⤵
      Checks processor information in registry
      PID:3564
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4356
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2476
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2412
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.internetdownloadmanager.com/welcome.html?v=643b10
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:6072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x35c,0x7ffe5f39c188,0x7ffe5f39c194,0x7ffe5f39c1a0
    3⤵
    PID:3996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1532,i,13198103339769950237,8614065683725810606,262144 --field-trial-handle=2820,i,13327022124509663975,1499881704361657937,262144 --variations-seed-version --mojo-platform-channel-handle=2816 /prefetch:2
    3⤵
    PID:5360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,5751876805823089017,17672111157185419465,524288 --field-trial-handle=2820,i,13327022124509663975,1499881704361657937,262144 --variations-seed-version --mojo-platform-channel-handle=2848 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2220,i,13941408215208123075,16947186624039476723,524288 --field-trial-handle=2820,i,13327022124509663975,1499881704361657937,262144 --variations-seed-version --mojo-platform-channel-handle=3328 /prefetch:13
    3⤵
    PID:4312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3252,i,2464779575569245929,17618195465264328243,2097152 --field-trial-handle=2820,i,13327022124509663975,1499881704361657937,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
    3⤵
    PID:5796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3276,i,17856488382534960869,13157537061434114195,2097152 --field-trial-handle=2820,i,13327022124509663975,1499881704361657937,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
    3⤵
    PID:4696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4136,i,2463269190134055864,5461515090964707931,2097152 --field-trial-handle=2820,i,13327022124509663975,1499881704361657937,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:1
    3⤵
    PID:2124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4148,i,5279004685667557959,3029136358320561882,2097152 --field-trial-handle=2820,i,13327022124509663975,1499881704361657937,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:9
    3⤵
    PID:5188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,14419664554511574506,7402339582690401932,524288 --field-trial-handle=2820,i,13327022124509663975,1499881704361657937,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:14
    3⤵
    PID:5296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,3501823440151486862,7771066686362206731,524288 --field-trial-handle=2820,i,13327022124509663975,1499881704361657937,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:14
    3⤵
    PID:6600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,1531909954344921622,14290844830795654132,524288 --field-trial-handle=2820,i,13327022124509663975,1499881704361657937,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
    3⤵
    PID:6608
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,18022938169537543472,11660844864791313995,524288 --field-trial-handle=2820,i,13327022124509663975,1499881704361657937,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:14
    3⤵
    PID:6784
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,18022938169537543472,11660844864791313995,524288 --field-trial-handle=2820,i,13327022124509663975,1499881704361657937,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:14
    3⤵
    PID:6804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,1959058029877678903,9268828476598450901,524288 --field-trial-handle=2820,i,13327022124509663975,1499881704361657937,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
    3⤵
    PID:6248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,12966708027666989642,10933120849041587373,524288 --field-trial-handle=2820,i,13327022124509663975,1499881704361657937,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:14
    3⤵
    PID:6568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,14956406392152989301,13605033237864772039,524288 --field-trial-handle=2820,i,13327022124509663975,1499881704361657937,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
    3⤵
    PID:5100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,5740736650724380506,7270906163729167598,524288 --field-trial-handle=2820,i,13327022124509663975,1499881704361657937,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:14
    3⤵
    PID:1748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,6523296461346525679,5710519877515702023,524288 --field-trial-handle=2820,i,13327022124509663975,1499881704361657937,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
    3⤵
    PID:4320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,6149762381208796959,17011008915273659056,524288 --field-trial-handle=2820,i,13327022124509663975,1499881704361657937,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
    3⤵
    PID:6224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,6339737810677486847,5564629525555703354,524288 --field-trial-handle=2820,i,13327022124509663975,1499881704361657937,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
    3⤵
    PID:2828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=944,i,4703314428565737425,4189578522003404135,524288 --field-trial-handle=2820,i,13327022124509663975,1499881704361657937,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
    3⤵
    PID:6880
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3308 -s 1776
  2⤵
  - Program crash
  PID:7076

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3308 -ip 3308
1⤵
PID:7024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 3c6130528f6e46e86ea12abf4ac73783b5220ec3e81f31db80483dadfce392da
MD5 5e3b36ba6e0d448bee4439e552eff279
SHA1 99cdbd9582c29f32a7b2d4719d5ed03a4c9fce65
SHA512 662406a0837be1290434476f0ee5fd0cd3bbc1f36030aafccf6575f98092c140164649c57efe401f569f64a03cf3cfea5359ad1652dbfb95b7c4c16df3a83d50
TLSH
T19A4165BC23AD28CAD755ACF324F74598B2F0A60A650F7F42C9692DB9CDD5F1410C0053
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a379c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a379c.TMP
Size 1KB
SHA256 e6d0cf62f0f26f3fd326542eb7293a2a7ec0ed214769975015511f0cb2f016dd
MD5 11e425e4754ddbab49cbedca41be9200
SHA1 6f9b49ea25482bcef9286712cf6e05ab60840451
SHA512 e5a9e474729544f9dd51099f808f890cd9349606dd9a49ed2f0d1000c8ca3e6a531400d77586116fd591c9f1ba5735eaef3212fe6b8357eebbf0927d4638c05c
TLSH
T1684143BC23AD28CAD766ACF324F74598B2F1A64A650F7F42C9692DB9CDD5F1410C0153
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

30101232-274a-41fc-8952-b5f9ed9a9f0a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\30101232-274a-41fc-8952-b5f9ed9a9f0a.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c34414a3a866f4adc04c29413cf188025fca32d3e2dcc048b8f55a6fdd832d47
MD5 906d866b395fdc61c62844984297a5e8
SHA1 a2d815b211d3e70ac4cc83eb121d3b9009d90a60
SHA512 6c7c49493c99a5488067f0245039cf672fb03b6ad5ecc5e44906a8188617f906330d9d665ef46f2b856e4ef977dfe6c864c8ddf33a41c8d7a7d2d20feb68038c
TLSH
T17341D1F383F4856ECA1186F0BB186E2FCE2D0515436C7D9685E0AE2B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f09c7c04cb19e7eda668b5d7cb871fc134a678f1b3a16a32b84a5c397553c6fb
MD5 647e9e675c62a21f5e7834a8747d6224
SHA1 c446921488a0c8b258e2892927783391a6c89e47
SHA512 3e1e1ce6fcbd9ca1d0f01553bb9f9c042b3f7cb1f9473da34dcb30bfa2ddf9800532c5cf68e66127ac268064c8b41cf14f64012ae189c91ae15f3af28260fc9b
SSDEEP 192:sxRkRHCc/fDsKUZczoD8pp4/g6+WNYnU/YCMPkOJGkIgDFKJ:sxRkAc/fDsKq06/5r/iH8
TLSH
T1B042D716AD28AD3B8CD7D30DBB55BF53D2F95033A1901E48A6FC8A1C14EA6DD620781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 782966cd81604f015e6f78eb57fb8220a773d471d6aa569c3dc0f5e4eb4d1f83
MD5 b46ac341864393f823bcd41ad407e285
SHA1 4a2e55a9904dd35db1020cd7b32bfa03611f08f5
SHA512 6f2c2d64504c0cc4368aad06dd3fa62bbec3fdc6722d85e9a1cb44f4fa5c983be70915a0d90cff04ef6d484dcdd26d3f67ffafb106d07defa7a8441e3d500869
SSDEEP 192:sxRfRHCc/fDsWUZczoD8pp4/g6+WNYnU/YCk9kOJGkIgVKJ:sxRfAc/fDsWq06/5r/GHI
TLSH
T1E742D7166D28A93B8CC7D30DBB55BF63D2F91133A1D05E48B6FC8A1C14EA6DD620781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6e065e4b2d9152e11e06f9e548d02aef494d08637e585ad715cf2c8413ab1e96
MD5 5fd54d4daf5be5ae62952ddcf9275ab6
SHA1 33e54296502d7665fdaa3ebe3c222e6f2b266b2e
SHA512 e1400c529cbd1ab1d2a298f6d8ce02c58e5ba7546f22167cd6d53eaebefc6b221c4e4ddd2f6d3af492be349cfbc110c9c078a2951fd7990e1760ca0472bc1dfe
SSDEEP 192:sxRkRHCc/fDsdUZczoD8pp4/g6+WNYnU/YCk9kOJGkIgDHKJ:sxRkAc/fDsdq06/5r/GHq
TLSH
T1EB42D8166D28A93B8CC7D30DBB55BF53D2F91133A1D05E48B6FC8A1C14EA6DD620781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 7e286d43dbeaa075455877d800300a6e6a0f807b79c799cce2c1e926b60af3f9
MD5 ef442a2a4f3d5f4f4e08efc5532952f9
SHA1 fd98e3180f0dd95239024f311bdb66e3f17cfbd3
SHA512 7437264f2566031e02fd82bb32fecf146bf01feb3fac3c8b34f5c1c9bccc755f3a7baecd3ddb8be62dc3b66bf1a5f9c4c4a6a21c75d3f06f25e07af910b1a382
SSDEEP 768:jC+vHrN7pLuL7JQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVERDQqcyroZn:jC+vHr7E7JQWgQ+f4+u1jaDRDVcpl
TLSH
T170D2EA7B640DCB7F4F804A9DAC197E9F6DA802CB9698CD5047FE841C02C67EB521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4a61af7cc81ec964c5f6c8f1f65e0373557e28d7e96a2b77d9e4ba4e03c2246a
MD5 333a1e1e7b4d783ac4073d0b7582b02a
SHA1 d385d26f1f79f92884491170a114e3e5c6b5c6e8
SHA512 6f450baaec34d5c22b2abee55249167ce91dc5e790dc72032de997fb314b0185b6626d5d20539ef1a7c9387b1e0883674afe8f4f8780edea863600e86ff8091e
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHLURlTp5FWtC4gNFK40gjFcrz8fnAHRu/v:CbEBVj5JAdSp9/EgTK7j6dJOHLURlTp5
TLSH
T16EB13010313A4241383D690C81B8992EA6C270B3746DE66F3BA905B65F2BE47DDFDDC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5aca56.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5aca56.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 1055692bddd4e87cd5a6bcefc7b263c662689789be8287c1cfcc10a05d1ac910
MD5 cd16392585f68ce89e1abe00510245ee
SHA1 27eea6434a1825335f081a82bb34a458edb67cd5
SHA512 82b60fff6530cb6369fb48f5ac773388c0c5876f3399c5480e0ac15864759ae98e854a9e3dda9a0a2122a9ea380dff2e833ad1e8f9e7cd1f8d1ebdf40b8365aa
SSDEEP 768:e/3Pfy3kYWp8+p3bd66j+4BRv86aLIWYD184pkCp:e/34A8+p3Z6n4yWWNCp
TLSH
T1A5F2AEB1E899DC739CF9D344B6463743AEF410A399C44E94D8DDAB1E104229E1B0B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 7a72332b1bef71bf4416ab2ec06427cebcb52ab59626c641451c333cf2b36e9c
MD5 28eeed4157daa048d98fdf21594fe695
SHA1 0e44a3622c1534a933ebed4226f81ab6883595e0
SHA512 64c74f7baa9a2efcb74fa4cfc887327dc1a3b2432ecd2d7e56867158123200bd07eda60c9469bccd89b95682075e59bc7275a1c27ef24b2d45776b84df9160f3
SSDEEP 768:Orv+4UNbd03zfN3kYWp8+p3bd66j+4BRv86aLIWY2bwClP:Obsbi3hA8+p3Z6n4yW0w6
TLSH
T18D13BE72E4A9DD739CF6D604B1467B837FB811A389C00ED4E5DD6B4E405A19E270F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6abc46f8eda7a8018f32c774ecfc5bc4af3c5ea867b17e139b095550f84e8f99
MD5 0020f539db6e1323dc38b98f6ad2c168
SHA1 2908f5515500c9e67fccd1fe16e85b05dbb6ef86
SHA512 bc8c2dcdafac41f3d5eeb73eba1a78931ed2b5fb66e838aae5f9375e39a176b4b266430b2f4fe267ca1c9ddfa37aa0dda02c5fac167bf83042774cf0b88994fc
SSDEEP 768:Irv+4UNbdD3pcnNp8+p3bd66j+4BRv86aLIiF2bwCl1:Ibsbp3cL8+p3Z6n4yX0ww
TLSH
T13F03CE73F9A899339CF6C648B2467B437FF851A396C10AC4D4DD2B4E419A19E630BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 137e7cd41a120d3c19e5bdd6969b072d0b7f8425817fc494a18f22eb47eb2e83
MD5 a0319915a9d7d7329fe3343e237dc182
SHA1 ec18fea9f1bcbacd3cc9e3574d97a977e08c71d6
SHA512 e4646576e70f9ebc5b526dfb495962deabf2bcad483a63869436039d6649a9ecb063ae5eb38f02807fff0a368cde66cf6a0e59fa32e0bfba796e46c3ea88c17b
SSDEEP 768:lrv+4UNbdD3AhkYNp8+p3bd66j+4BRv86aLITY2bwCl1:lbsbp3kL8+p3Z6n4yV0ww
TLSH
T1EF03BE72E499ED339CF6C644B1867B837FF811A399C10ED4E4DD6B4E015A19E270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 a9bbd7a752cb529a652ef75df84e4c609c695ba7de476b7d3ad4353f5368755a
MD5 7e53e1216c9649368d5af810078c4dff
SHA1 9f8931d32ab8baf70846bfad309960da15e0b114
SHA512 04bd9a790e4c4e1c858363a25d0ceee9d0a0aeb33596156b31ee211fb130030d472126ee5f17f5ce3be21fdd4c05156f27a4b584a16d94955ab007602cfdb528
SSDEEP 768:dFQN32wgmfP41Gp8+p3bd66j+4BRv86aLIWYD184pkCp:sN3j8+p3Z6n4yWWNCp
TLSH
T1181317F198D79976D8AE8747A77D6E429EBCC063B5844880F7C85E0DCC421BFD70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

d7c5bc0d-1d9d-454a-ae9e-891ada281a32.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d7c5bc0d-1d9d-454a-ae9e-891ada281a32.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5E43012191E7B1F510ACD5BF039D8BF1B9A277B2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fu4ot18b.default-release\cache2\entries\5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
Size 16KB
SHA256 55a746c3485070a481a5d742bcae479f0a0c74266c36020df57c5ba0fea2dd7e
MD5 8c9596eebc46210e441468e0e8092cd4
SHA1 5071ed328587f43d02375346490436dd2c4c7651
SHA512 b6a1e6aef60b816e2c5921ebd306e46479186e77f133d4b9d0e4b9da16243696c900ed7aa5f8441ec59bdc32f1f8a67033739ab63a3be944c25cc7887b09568f
SSDEEP 384:HkCjiO024Y2DL84KKDL849B7SOEAd9KVRaAcP+AWRMAhrj:EzZY2DL8lKDL8CB7S/AmVAf+hRME
TLSH
T1C0729E395F003CBC1597C0E8C5F9929A8D18B7A7DFE680AD21583D0DCAD8A69B4F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3709dfd8-4354-4e0f-be81-afe4e7ea4659.zip

Path C:\Users\Admin\AppData\Local\Temp\3709dfd8-4354-4e0f-be81-afe4e7ea4659.zip
Size 3.8MB
SHA256 0f26d820b4bbdca26b02e76d6c0647153ad7e1839222f15361fd2ee9016c8e25
MD5 332c58722feca58fafa164c84a73e390
SHA1 35a1dcd7a2c185c3d3cdd600fbe744a544d43b51
SHA512 50624e3b7b2e378e97551e2c725457ee9e4e45464ebf4f6161a23789cfd91dbf5435b28bf00e88ec468de5e47357ca5639d54a2bc935beee12aeed8e316dbbec
SSDEEP 49152:DnLfvscTV1Dwlboyf+y95De31Jmaj4qj9aSy+lEbmZ+s6FWsxcOeqsRTY+AgHIk3:7LfGo3MU1J7gQlEbW+sMxvUBHIkVJ
TLSH
T11106E07DDE5C1F0DC9CF83BBC50D2FC2984C4FAE8054A9EB6A6A9971DCA31E61B44844
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6072_1306337657\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\db\data.safe.tmp
Size 35KB
SHA256 7bba387a7817235e4434ea249e5c957241843abb2dab5372e8d0c677b0f4fce5
MD5 a979d4c3842a5d797ee6a3a745f990d6
SHA1 76fcd5a5bc3d7352589a9ceec6adccc0dceef3a0
SHA512 b5d435a86e5663ae6d1cc54184d4fd9a8936d424dea0d6cb0160958138e88835f12cf3d55deebf3368fb9f0147a4cbad51ded0c991adf7d30e32bde53c5f310c
SSDEEP 768:21KSPXfoSzfD0Gcm+ubz+Kl+52ZqjMbSbhb7b/bZ1H:GXfoShz+fl
TLSH
T18FF21184FB2A953FD42812BADCE50B042F79F88959192F573A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\db\data.safe.tmp
Size 35KB
SHA256 08f750e47a62f12a98a4c911174afcb24c1cab26e3a5b43c48543746775a0715
MD5 41e761fd7e93f13fd43b5ddbb0a79216
SHA1 3ea64c856d064972caf1f9925f026f1c1f33707c
SHA512 ebbaa9dfc6a598fe1f5d2fb142f70f5e7d67c4abd9b0c1a517ca04b95eda146e45962c2f703e706e4377764734bff8e441c2c5a7559f16fe161b4085be949dad
SSDEEP 768:/SPXfoSzfD0Gcm+ubz+Kl+52ZqjMbSbhb7b/bZ1R1/:UXfoShz+fl
TLSH
T186F21184FB2A953FD42812BADCE50B042F79F88959192F573A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\db\data.safe.tmp
Size 27KB
SHA256 c91d90bd9d2b7d74f893b9c8060e2771bc9e2dca947b96270bf63ffae7f4ae8d
MD5 c1ba33223a6702d11ee4bf5b73066a89
SHA1 8a97aa588e9a6b8a1241738890ebd67092af8210
SHA512 c9d6fd14e33a08c0e6df59f7fce6e072185d3f5e72c8a1a76144ed6336d9ce2a43053ffd93fa97c347dfbaffc9038ce783ee598cdf0de1855abe919805eba3d3
SSDEEP 768:21R+DFMMpGcm+u4djRsIZDEObwbkb/bAPvg:0+DFprdjYg
TLSH
T119C20184FB2A953FD42513BBDCA51B042F79B88998092F573A4D64682C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\db\data.safe.tmp
Size 35KB
SHA256 35054a87dc689e6a9c848c9787d01a89161640cfcc4b03309880db0f2e65dd97
MD5 9ebb8a1b837f001e21c588cdbe84eaf7
SHA1 ba861f233cc24b4b957e76ed8b6641600a38ecc5
SHA512 104488a5b36df5c765d884d252d6a20beae4617e607c71622a938f23a936a59d17325c98a95a1b3f16ab0e0839addabe15076cefc1547584f72c6595b87491aa
SSDEEP 768:VXfoSzfD0Gcm+ubz+Kl+52ZqjMbSbhb7b/bZ1R1KSg:VXfoShz+f+
TLSH
T14DF21184FB2A953FD42812BADCE50B042F79F88959192F573A4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\events\events
Size 1KB
SHA256 0a09bf7129d2cd455c28bfc51f28b1afb07ea49ae16e644497f4619f621182dd
MD5 2b69601e26e6d220d95af4802ab58c9a
SHA1 d310bdf38c4d229b6614f4d7da6975f02147d340
SHA512 cf569e04a5aa3cabe0daf67406980fb3d9c59c4e12c6ec04ee8292adafd3c7e4f340c04770dd647699e25ab59cc282c9c237239ee7fcfc5d3bc864ff5cea7854
TLSH
T18A21499C39F84EAAD8C7F29C7440128E53954E0706871C575E13EF8CCE91ED9327A438
MD5 SHA1 SHA512 TLSH

Submit Download

0494faf8-9941-48c3-805f-7f7e6cd08d71

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\0494faf8-9941-48c3-805f-7f7e6cd08d71
Size 235B
SHA256 ae3a55a6643eb018deceefbb54558107381e998252c15ff3a212c79e4c90e123
MD5 317b564e3460286fc89333edd440a843
SHA1 31914aafc77ec89bcf78ea56eef65dec39e75bab
SHA512 df26a0c029df82fd455190f25961706a22ad0c2a8c3dc412cf7adf8620da4a8bcf0e625687784e700c33b62487abc193e3a23d67a9954a0f16124f4806826376
TLSH
T174D097A02CA823BC08280F07F0E068D230494C3330B4982089A1047489B8AC84312D2A
MD5 SHA1 SHA512 TLSH

Submit Download

22fbbd39-1598-413c-8360-236814c91844

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\22fbbd39-1598-413c-8360-236814c91844
Size 2KB
SHA256 65ba0791ccc17aad9207fedd2b5b5046631754ed3cd4dc4b191e0e6039cb622d
MD5 daf18ea458895d6e90ceebbad7b3df16
SHA1 4a9286e93ec332e2afe456db74a2df064370d5fa
SHA512 535923c0fb1eed75b785a8236e8d420ccfd38b50d2da0af1974a2aaa6fc03dc74a27a6e35e2d1705e8683febfd794f85acfe9474dc3ca70868c682374ecfa261
TLSH
T1B841426C35749D779CDAE55C8091338A93E19D4304C21C836951EF4C8ED3A9E736A42B
MD5 SHA1 SHA512 TLSH

Submit Download

512f8f3c-5d09-4766-b013-d2f7e5ce0775

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\512f8f3c-5d09-4766-b013-d2f7e5ce0775
Size 886B
SHA256 1c9ea48869f0ebb50880d6a8392d831dd3e3d1c431f98391fe8e91303e79d56d
MD5 521787cb4eb095dfaeccd5bc28dcf75d
SHA1 2456711d905341743468a79b24f2657f7ce4ac69
SHA512 1e990b55cc83b2ca43e95d9869dc39abe53b8d6a2e90b6eac7fd7d4d21977963bcf5706035f111fefdc6fd68b385ed9d2cef9c6ced4a7c9a582ed166121989e5
TLSH
T120110090EA35B6F3DC7C8297D5D13B0247E4B423C0C64A047D991E180EFB50EEB6A20B
MD5 SHA1 SHA512 TLSH

Submit Download

7da6cbc3-f14c-48be-b7e6-9ad4fff27575

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\7da6cbc3-f14c-48be-b7e6-9ad4fff27575
Size 871B
SHA256 69c71936c5822a366013b31921cb7911deb52e58d835e84850118be41c1a2952
MD5 50b93dd22ea4390dbbc080e7f1a2ab22
SHA1 257fc2a4db9215a0f21f306f1e35ec67e0063783
SHA512 75db839224751ccfa254029efac582e57b7677b3106e181cd6d0fd4ee68f7c4ff29c29e8247a8c52a56262c63c521155e056c451141e634881773a78b559eb51
TLSH
T125110094E631B6F3CC78825BC5A13B054BE4B52380C645043DA51E140EBA20BEB6E64B
MD5 SHA1 SHA512 TLSH

Submit Download

93dc302e-2a4b-42d7-be3d-e9048fc19934

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\93dc302e-2a4b-42d7-be3d-e9048fc19934
Size 235B
SHA256 b91b285be88ea35d66dfa44361e8000f37a1275b9ebb976c4e7c81204ac10d59
MD5 46b8c067f7568295ad7a77ba4313c583
SHA1 74af811455b90f0239f371a86aa35a2ec88edef5
SHA512 7bd74cd849e747dd8024f6df879376bd3497c8bcace5d348757ad2dd120a5add53cef25aded134d4a4a80eed2c59fbf40a90fa1adc3288b04ee19cb98439fa3a
TLSH
T17ED097A0289827BD48000F9AB0E128C230444C3720A1A83099D29238D9BAAC82122917
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\extensions.json
Size 16KB
SHA256 45035ee4bcab7fab62bb32f4da044005e7545516d7670fffa2b4e5ade437afdd
MD5 d4c68695a61e506327b805956597e9e8
SHA1 42818cd2a578fae9bfc036408153e2bb86eae068
SHA512 51e0228918c3d369338fb9a04f87839bb86b2951c528f51f2169dca4bd894131c125108977bdd5bc05561ac51524546ba924d842bbe085b47c31f5904016df77
SSDEEP 384:9kI4vcUmldvD8dhWr94zS96oJL4HZL4PGL4H7L4HML4Hyf4hu:+I4kRfQXC4q6+4x404H4m4I4w
TLSH
T1C372421545049EB8298FA78AAA367E01C37D473B60845C78F4DD8FC842FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs-1.js
Size 6KB
SHA256 1f35764bced33cd730726f50560e721119499b2183e80e4cdd2d40db26bcdf3b
MD5 b47ffff9000185429cc845b05b6f48dd
SHA1 1a699560ffbf9f46f38badb36e1c26ac5e9a081e
SHA512 6747ba5ac94bf7483734f790ab39899bba1f634373f8879d69e1d7271a3a46942847c4e33d2cb33d61a676c06864a84395195cf1a435b9f17ad3597436c04623
SSDEEP 96:xH+UTUQqGqsfOGe1zSQSSlvdv9jcnAHdA0ScSqBw88u8L4cnEVgR:ArRsfOGe9SSDdA0ScDBw88e+
TLSH
T155E11F789408CBBF64B6776CAC6888316AB2413B7BBF68D750A554C4054CF3842F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs-1.js
Size 8KB
SHA256 34b65506083cb00e455226bfea51f3f01cd6dc238dddaafa82c387b6d284b258
MD5 15aedd55796d1c906466f72b78e4c15e
SHA1 5e7a425ba244253e87a8cc8e5407a109c622364d
SHA512 8234318bb9d5c13a00088f5ae629d5f5f18bbc4c40792816e389281993573ebacc5a1572ec3c75fc546fa4bcaeee2ea6e3dc2517f9c0bd8fe77dd4cb9c1f0217
SSDEEP 96:xH+tTUQqGqsf1GeObzSQSSlvdv9jcnAWRPhA0ScSeBw88dYf8L4cnEVgR:AGRsf1GeSSSKRpA0ScTBw88w+
TLSH
T128020E386044CBBFA4F6766CAC6489315AB2023BB7BF68D711B95485054CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs-1.js
Size 12KB
SHA256 f68b1905278d093436463f8f0ded80eb6d318a7edf33394492a1eee72c7ad573
MD5 649e78498ce8d8c2d3f82be47340a897
SHA1 6f7671f1c98f0d22935095b51a4d29a9f3fbb212
SHA512 0e04039b12c32e133133ad698fcaf40a85b35266cf98faada3b56d7e271f2475234e580aa713fbd0d31ef5324e618277072a9fe86094c299c11b0c3352e9feb3
SSDEEP 192:GGRsf1GeSSSFLRpA0ScKOBw88w3JqTU3er:w2Rp1wgVc
TLSH
T1F042BB3860408B7F60F6327DAC654EB01AA14627B7BFBCD705BC9481085CF6542F6AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs.js
Size 6KB
SHA256 36cca942cb38c4eaaf54801542b24e2d0a457f473801fe84a78f9f5db1e4d184
MD5 0ad4a069168ef90194c310569f47dd96
SHA1 1d692ac4afd140f275c9ad8e163e365621778c56
SHA512 fa94fef8680dd54195bc2a8df943b4e187e8298f41088f7fe5737b11b369874d6e6f42b5638d5858f6e5080e4c498235a3ec0729fe624168952efd648bc5dfa1
SSDEEP 96:xH+UTUQqGqsfOGeObzSQSSlvdv9jcnAHdA0ScSqBw88u8L4cnEVgR:ArRsfOGeSSSDdA0ScDBw88e+
TLSH
T1ABE12F789408CBBF64B6776CAC6888316AB2413BBBBF68D750A554C4014CF3842F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs.js
Size 6KB
SHA256 9e744570d1576f17852aa3f30b26dc84335b0ba13e9aaa69e1f050bb442c3f9c
MD5 dd17cbd134b0e032ed2e582846617837
SHA1 c4808a0aca615cfa4641e061d4da9abe188e573e
SHA512 d02319225178a68d54f498711a335f9f525a96506a1b4631462f19d6a1ac2bf783b80c66f95576076de4db34e89478955fb4a950e447555cee4f0bbce7fdc81a
SSDEEP 96:xH+UTUQqGqsfOu591zSBSSlvdv9jDnAHdA0ScSqBw88u8L4cnEVgR:ArRsfOu59QSSIdA0ScDBw88e+
TLSH
T1C2E120789508CB7F64B6776CAC6888715AB2413BBBBF68C750B554C4014CF3841F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 9b548433c310baa6cd9a14561ac8a384d55c760cd1d681cc7f8bcdec9e3b2332
MD5 385efeabb1e47027671c5bfa2e771c25
SHA1 e8b852c4e920b45694acc6fb9086f79be5810b9d
SHA512 4ae7ff6d26c5a5964014c1c77c0d633bd9b8a569d10f6dd6c4104f8412d553abd6966fa1f1f4ce98a01c00bb071e59fbfe8f089081386240bad986d7353f7db2
SSDEEP 96:dyf/f9eE7eW9jILA0NjoB8kMJttn0YJZQX:6/f9hOnNcB85JttnTZQ
TLSH
T17C917D463B1B2867FD5BC68FEE094CF241B0324A558144FC90CFAB2A772BB4B7465474
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 438d46d4786616b7c8609dd8b75cf836c2dda516b9c2462f772d2fad1dc9ce60
MD5 e76867bbab4d9799c50f8bee0ff7ba86
SHA1 7aa6e4e1c634437fa1a45a1914dce97bd82225d5
SHA512 6e569c684ec06c372dbfadbf666987022675aa8f31b553a7688c34ed0fb2566da28a409517ac234fc81b21c7b74d90f50c3607d57d0932a191b7598665d1471e
SSDEEP 96:dyf/f9eEdeW9jILA0NjoB8kMJttn0YJZQJ:6/f9nOnNcB85JttnTZq
TLSH
T10B917D46371B2867FD5BC68FEE1A4CF241B0324A458244FC90CFAB2AB72BE4B7465474
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.0MB
SHA256 40f7c725329e6ebe82a48b59c8ffc2fc3ce6414fab829cb24c0b5f3eb7f7a0ff
MD5 e77b83450d335e4cd065f0759a41563d
SHA1 a442431b127db8cdb1f09aeff30efa658c84fc45
SHA512 acd4457d66c3969e7f1d44fbb2a335b0112324cf33d796dcb32621bf6ce34928b69b3bf61a976c9a59403b27d0b38142675b97d4e22cf4f80c6ee75f4e4bd75c
SSDEEP 49152:KYpKA0vv22ZYJt3HERU3UlgN5IQYVhNmc:r6cXERUkM5IQYVh7
TLSH
T10C363AF820D1A257F3814033664593EF21EFD00C6027DE085BA966E9A574CEF9E16B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 7.3MB
SHA256 f05a0b58b1aad700061c221e231b5725ad3fb14bf978f779d262498d9e27842b
MD5 c50e858742ee599994088994259a8a38
SHA1 a278dcc8504adcf80eb099ca0b5a75bd3b7aa388
SHA512 5fb34ed0e65face2e7a2a5b28e4282045f5107066a828649de3447ad81cc5be845f885ad13ba1fc24e9ba3db9d03d1382edb8f1eb1f841c307e50618af2f4a2b
SSDEEP 49152:x9yWk9n/X13e4y2D3/Yn7B6vTltxkofj3/hIRRJrko/widPhk4pyYTsYn20Z/i+o:0Y20Z/BT8AF6qqLbSs3
TLSH
T10A765CE420E19253F38644B3719993EB20EFC01C6036CF44579496FAA9748EB8E977BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads