338c8275fdbadb6dbaeceadff0a5b77563e598a19edf206e9a653a1deb64ea16

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 09:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
Size 5.9MB
Sample261011-lc4sfsfc85
SHA256 338c8275fdbadb6dbaeceadff0a5b77563e598a19edf206e9a653a1deb64ea16
MD5 86608d8f8d65144d9e4f9ea005db3495
SHA1 777665bd5a9e8c0eb923d6bf90f67993230dcee9
SHA512 1ec02e70d1bcb1d2f38af47470f2f088bbdcec501ec48cc7f151492064aae63027f22c850dee7a0206d5a0bd64862727f4dc46a60f5b9aabd6360afd57516c76
SSDEEP 98304:uTyCZX3j8uLeP4h18frP3wbzWFimaI7dlo:SZX3jFogbzWFimaI7dl
TLSH
T1BB569C51BE8D817AD91B113607399F2A1029BC243B3855D3B2B43E7EEC723D26D3661B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery persistence spyware stealer trojan

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe /onboot"	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1436_890685818\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1436_192030479\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1436_192030479\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1436_1304121169\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1436_890685818\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6260	1336	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6140	msedge.exe

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 22 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm"	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Internet Explorer\Low Rights	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3"	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3"	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243"	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3"	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe"	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe"	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe"	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe

Modifies registry class 19 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter"	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\WOW6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe"	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Model = "283"	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-560646293-820748483-2532804640-1000\{C4CD2D99-395C-4251-B744-7DE7749FA6A0}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan"	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User"	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1"	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Therad = "1"	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	1336	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
Token: SeDebugPrivilege	2948	firefox.exe
Token: SeDebugPrivilege	2948	firefox.exe
Token: SeDebugPrivilege	2948	firefox.exe
Token: SeDebugPrivilege	2948	firefox.exe
Token: SeDebugPrivilege	2948	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
2948	firefox.exe
2948	firefox.exe
2948	firefox.exe
2948	firefox.exe
2948	firefox.exe
2948	firefox.exe
1336	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
1436	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1336	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1336	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
1336	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
1336	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
2948	firefox.exe
1336	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
1336	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
1336	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
1336	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 4956	1336	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe	89
PID 1336 wrote to memory of 3176	1336	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe	90
PID 3176 wrote to memory of 2948	3176	firefox.exe	91
PID 3176 wrote to memory of 2948	3176	firefox.exe	91
PID 2948 wrote to memory of 4888	2948	firefox.exe	92
PID 2948 wrote to memory of 4888	2948	firefox.exe	92
PID 2948 wrote to memory of 4888	2948	firefox.exe	92
PID 2948 wrote to memory of 1472	2948	firefox.exe	93
PID 2948 wrote to memory of 1472	2948	firefox.exe	93
PID 2948 wrote to memory of 1472	2948	firefox.exe	93
PID 2948 wrote to memory of 1472	2948	firefox.exe	93
PID 2948 wrote to memory of 5724	2948	firefox.exe	94
PID 2948 wrote to memory of 5724	2948	firefox.exe	94
PID 2948 wrote to memory of 5724	2948	firefox.exe	94
PID 2948 wrote to memory of 5724	2948	firefox.exe	94
PID 2948 wrote to memory of 1484	2948	firefox.exe	95
PID 2948 wrote to memory of 1484	2948	firefox.exe	95
PID 2948 wrote to memory of 1484	2948	firefox.exe	95
PID 2948 wrote to memory of 5288	2948	firefox.exe	96
PID 2948 wrote to memory of 5288	2948	firefox.exe	96
PID 2948 wrote to memory of 5288	2948	firefox.exe	96
PID 2948 wrote to memory of 5288	2948	firefox.exe	96
PID 2948 wrote to memory of 444	2948	firefox.exe	97
PID 2948 wrote to memory of 444	2948	firefox.exe	97
PID 2948 wrote to memory of 444	2948	firefox.exe	97
PID 2948 wrote to memory of 444	2948	firefox.exe	97
PID 2948 wrote to memory of 1860	2948	firefox.exe	98
PID 2948 wrote to memory of 1860	2948	firefox.exe	98
PID 2948 wrote to memory of 1860	2948	firefox.exe	98
PID 2948 wrote to memory of 1860	2948	firefox.exe	98
PID 2948 wrote to memory of 2560	2948	firefox.exe	99
PID 2948 wrote to memory of 2560	2948	firefox.exe	99
PID 2948 wrote to memory of 2560	2948	firefox.exe	99
PID 2948 wrote to memory of 2560	2948	firefox.exe	99
PID 2948 wrote to memory of 6136	2948	firefox.exe	100
PID 2948 wrote to memory of 6136	2948	firefox.exe	100
PID 2948 wrote to memory of 6136	2948	firefox.exe	100
PID 2948 wrote to memory of 6136	2948	firefox.exe	100
PID 2948 wrote to memory of 2804	2948	firefox.exe	101
PID 2948 wrote to memory of 2804	2948	firefox.exe	101
PID 2948 wrote to memory of 2804	2948	firefox.exe	101
PID 2948 wrote to memory of 2804	2948	firefox.exe	101
PID 1336 wrote to memory of 4512	1336	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe	103
PID 1336 wrote to memory of 4300	1336	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe	104
PID 1336 wrote to memory of 252	1336	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe	105
PID 1336 wrote to memory of 3200	1336	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe	106
PID 1336 wrote to memory of 1436	1336	2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe	108
PID 1436 wrote to memory of 4452	1436	msedge.exe	109
PID 1436 wrote to memory of 124	1436	msedge.exe	110
PID 1436 wrote to memory of 6140	1436	msedge.exe	111
PID 1436 wrote to memory of 124	1436	msedge.exe	110
PID 1436 wrote to memory of 124	1436	msedge.exe	110
PID 1436 wrote to memory of 5492	1436	msedge.exe	112
PID 1436 wrote to memory of 5492	1436	msedge.exe	112
PID 1436 wrote to memory of 1220	1436	msedge.exe	114
PID 1436 wrote to memory of 1220	1436	msedge.exe	114
PID 1436 wrote to memory of 1220	1436	msedge.exe	114
PID 1436 wrote to memory of 2960	1436	msedge.exe	115
PID 1436 wrote to memory of 2960	1436	msedge.exe	115
PID 1436 wrote to memory of 2960	1436	msedge.exe	115
PID 1436 wrote to memory of 1440	1436	msedge.exe	116
PID 1436 wrote to memory of 2876	1436	msedge.exe	117
PID 1436 wrote to memory of 1440	1436	msedge.exe	116
PID 1436 wrote to memory of 1440	1436	msedge.exe	116

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-10_86608d8f8d65144d9e4f9ea005db3495_darkgate_elex_glassworm_remcos_stop.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Windows\system32\regsvr32.exe
  C:\Windows\Sysnative\regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  PID:4956
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3176
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2948
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1944 -prefsLen 27097 -prefMapHandle 1948 -prefMapSize 270279 -ipcHandle 1760 -initialChannelId {cd8f212a-e9a2-4eee-b50b-451d87cd9f37} -parentPid 2948 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2948" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:4888
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2420 -prefsLen 27133 -prefMapHandle 2424 -prefMapSize 270279 -ipcHandle 2432 -initialChannelId {a02ed19d-68f8-4e32-86f1-3127cba616b2} -parentPid 2948 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2948" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:1472
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3836 -prefsLen 25164 -prefMapHandle 3840 -prefMapSize 270279 -jsInitHandle 3844 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3852 -initialChannelId {fda8f5bb-1767-403e-828b-a1c67aa5ea02} -parentPid 2948 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2948" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:5724
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4004 -prefsLen 27274 -prefMapHandle 4008 -prefMapSize 270279 -ipcHandle 4076 -initialChannelId {228716e9-a936-495d-98b3-5924b6b3f60a} -parentPid 2948 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2948" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:1484
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4452 -prefsLen 34773 -prefMapHandle 4444 -prefMapSize 270279 -jsInitHandle 4448 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4464 -initialChannelId {a044f2f9-eabc-4c31-9261-792d84570a68} -parentPid 2948 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2948" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:5288
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2748 -prefsLen 35010 -prefMapHandle 3012 -prefMapSize 270279 -ipcHandle 5088 -initialChannelId {92d4db45-45d7-4e56-8c79-d7f73bcaf44a} -parentPid 2948 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2948" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:444
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5460 -prefsLen 35062 -prefMapHandle 5464 -prefMapSize 270279 -jsInitHandle 5468 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5476 -initialChannelId {e304e8de-901a-4ae2-8526-86f1c72d3a7b} -parentPid 2948 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2948" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:1860
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5592 -prefsLen 32952 -prefMapHandle 5604 -prefMapSize 270279 -jsInitHandle 2932 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5044 -initialChannelId {e10e5fc5-549b-495e-96d1-101a766b6909} -parentPid 2948 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2948" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:2560
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5700 -prefsLen 32952 -prefMapHandle 5028 -prefMapSize 270279 -jsInitHandle 5032 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3280 -initialChannelId {31b357df-b6f3-42c3-b5d8-42e78be8bdf1} -parentPid 2948 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2948" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:6136
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5980 -prefsLen 32952 -prefMapHandle 5984 -prefMapSize 270279 -jsInitHandle 5988 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5996 -initialChannelId {6a5ff277-3de9-45a9-bd73-096db1a5e02f} -parentPid 2948 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2948" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
      4⤵
      Checks processor information in registry
      PID:2804
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4512
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4300
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:252
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.internetdownloadmanager.com/welcome.html?v=643b14
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x30c,0x7ff88b9bc188,0x7ff88b9bc194,0x7ff88b9bc1a0
    3⤵
    PID:4452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,16175653153424316923,9678290639019774761,262144 --field-trial-handle=2328,i,9995770434901772622,10318530677563780855,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
    3⤵
    PID:124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,1047313607124362270,7057553154709775772,524288 --field-trial-handle=2328,i,9995770434901772622,10318530677563780855,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:11
    3⤵
    - System Time Discovery
    PID:6140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,1991914546347706293,13093491048514697012,524288 --field-trial-handle=2328,i,9995770434901772622,10318530677563780855,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:13
    3⤵
    PID:5492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3624,i,13949412881804562926,3153620698220434281,2097152 --field-trial-handle=2328,i,9995770434901772622,10318530677563780855,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
    3⤵
    PID:1220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3632,i,17997621976931606276,10761969212168436173,2097152 --field-trial-handle=2328,i,9995770434901772622,10318530677563780855,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
    3⤵
    PID:2960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4340,i,8451764194338619211,9287145126522056725,2097152 --field-trial-handle=2328,i,9995770434901772622,10318530677563780855,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:1
    3⤵
    PID:1440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4388,i,13261919949596222891,3083149744751373866,2097152 --field-trial-handle=2328,i,9995770434901772622,10318530677563780855,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:9
    3⤵
    PID:2876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3844,i,4317103372271065076,7896835516345150209,524288 --field-trial-handle=2328,i,9995770434901772622,10318530677563780855,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:14
    3⤵
    PID:4924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,4379410683512174569,1587942168462362011,524288 --field-trial-handle=2328,i,9995770434901772622,10318530677563780855,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
    3⤵
    PID:6320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,17231036192994149181,17894588391662185650,524288 --field-trial-handle=2328,i,9995770434901772622,10318530677563780855,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:14
    3⤵
    PID:6328
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,458211706709374908,14740863776593835557,524288 --field-trial-handle=2328,i,9995770434901772622,10318530677563780855,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
    3⤵
    PID:6520
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,458211706709374908,14740863776593835557,524288 --field-trial-handle=2328,i,9995770434901772622,10318530677563780855,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
    3⤵
    PID:6528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,2341356706238323703,17437610401740875990,524288 --field-trial-handle=2328,i,9995770434901772622,10318530677563780855,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
    3⤵
    PID:6744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,10460804881412213459,934314765625416512,524288 --field-trial-handle=2328,i,9995770434901772622,10318530677563780855,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:14
    3⤵
    PID:6960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,404259358011715782,16334043370786670511,524288 --field-trial-handle=2328,i,9995770434901772622,10318530677563780855,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:14
    3⤵
    PID:7012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4932,i,3479332202851427463,11439022358123323055,524288 --field-trial-handle=2328,i,9995770434901772622,10318530677563780855,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
    3⤵
    PID:6912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,653032431404538793,13198864720878083795,524288 --field-trial-handle=2328,i,9995770434901772622,10318530677563780855,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:14
    3⤵
    PID:7060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2168,i,4218477231285094416,17973091945980895240,524288 --field-trial-handle=2328,i,9995770434901772622,10318530677563780855,262144 --variations-seed-version --mojo-platform-channel-handle=3208 /prefetch:14
    3⤵
    PID:6596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,12578249929806928560,6813284357871095836,524288 --field-trial-handle=2328,i,9995770434901772622,10318530677563780855,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:14
    3⤵
    PID:6816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,15197373543283783928,12492054497577406984,524288 --field-trial-handle=2328,i,9995770434901772622,10318530677563780855,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:14
    3⤵
    PID:6276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,685979398397622836,15565881201385142184,524288 --field-trial-handle=2328,i,9995770434901772622,10318530677563780855,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:14
    3⤵
    PID:6544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,9917137293237621159,8718569698020871321,524288 --field-trial-handle=2328,i,9995770434901772622,10318530677563780855,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
    3⤵
    PID:956
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 1792
  2⤵
  - Program crash
  PID:6260

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1336 -ip 1336
1⤵
PID:6016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

571c11cc-b967-4b43-9263-79096e02f5e8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\571c11cc-b967-4b43-9263-79096e02f5e8.tmp
Size 42KB
SHA256 aeca180dbceccd29b7d3f061b6d36e850b3d17ac6ff0c8f9e03d15fc5d5f1918
MD5 34617ffcd868555f00c42de7d8a5d32c
SHA1 9d8dbb1257a4481d9021a397e1d22dc98dbca36d
SHA512 a8a102ed8b4a00ec3b2f35f2b90db47450f7d8a3992078524bccffd3b3e4995045c9ac787a46ed8b856763e8dc386828fc688d110248b78b93452fa014b7692a
SSDEEP 768:/FQ13Kwgoy0fIOE+3t/9OA9at01j0iq00+IaiJ1xTl:C13DyMCCHq00NaY1X
TLSH
T1CE1329F198E38A77E8AE5787633D6E468EBCC153B5885980B7C95D0DCC461BFC706822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7cd839de-2c1e-4ffe-af01-22f6ac372243.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7cd839de-2c1e-4ffe-af01-22f6ac372243.tmp
Size 34KB
SHA256 98e92871cde7738f5ee7bd6cd54ba9258282a46f9cd4509a9e320e325f403a5c
MD5 b0362b49efd519056bc4fd3fc83fc0d8
SHA1 e5114c6b88ce90042245e8a8fd7bd4fff01c35b9
SHA512 e0c35821c4dcf9f3d3c315f611ee17d8e16761eb400f6e3200b7babbd317687c673d2c705a79674c412b563f2cdc6956930a21357cceb18062366306ac82402a
SSDEEP 768:yY3IyUOOE+3o/9OA9at01j0iq00+IaiJ1xTl:yY3IyExCHq00NaY1X
TLSH
T14DF2AF70ACB1DE73ACEAF645B21673869FE41523D5C94E84C5DEAA0E00076AE170BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fc0a38b9bd67def6f8a6da7a4a5956bc201e5aac4ba6f906946e52f5b14e13c2
MD5 1f96c275206494cbaa7386b7e675b940
SHA1 e11ab12226c05e6b54c67a266c2f75cfeb24b04a
SHA512 a117c9e9ceb3447431daa46611f5c54ed75796456b4251af5e1ed3f62b5c6cbe9ebccf949569237178ca2ca7feba8c9acb69940a8457c36a9156ef8fd98eb09c
TLSH
T188D02B3671684D13E0805278007111613882F405DF0601C01322982609902483010180
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0d0352bb5f4b47f3d1ca8042212dfbae37957031d48d7789bd6cd7b4b6cbbe31
MD5 32b3e4b238ee2f76e0152ca1b1ff9944
SHA1 78d56bdababf57c069ac4ad713ad9cdc3e3f04a0
SHA512 3e7b72969f35c769b07f0760fb1a06022e37e68e88be1bff45e02463b5358a671e4f84f6bad11b043a01370573d062084b864866961ee86cb12eceb980874f69
TLSH
T178D02B3A71584E13E0805274007011613892F405EF0601C01322581609902483011184
MD5 SHA1 SHA512 TLSH

Submit Download

81bd888c-e495-421d-a3b5-08cfddaff753.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\81bd888c-e495-421d-a3b5-08cfddaff753.tmp
Size 11KB
SHA256 ff4a375f4e1ac130258123b2c33956c73b173d5d68b8470e4fe8edadd578086f
MD5 f942f89139c055ff0eb5809b05c13316
SHA1 ddc3e3ed040a7e55ad73d4d03f2ef4fc5c1bf8e5
SHA512 7a7bda3efcb2c7a32fc88a5d9262f3c1f78cffd4eb5c5eadb385205922f1d60b62b9812c376f34b950f379ddeda71c846f1af9590c303e7c47b7f164b7900a5a
SSDEEP 192:sxRZRMC1/fYsluZSWzoA8ppi/g6+WNYeG1/Yot8WGM+IgDpAJ:sxRZR1/fYslImE/5jy/Jv26
TLSH
T14B42C815AE28A93B4CCBD21DBB55BF53D2F9103261D11E48FAFC8A1C14EB6DD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

87a8fe36-fa5c-43ac-a5c8-f86aaa07f76c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\87a8fe36-fa5c-43ac-a5c8-f86aaa07f76c.tmp
Size 11KB
SHA256 272630a3a97d90051cab742bedde8e188113cd14e7fc1f00185e8fb30a99536b
MD5 8190fc9d3a7f9675e21ce66dcc9d9e78
SHA1 ff6fda0e38d3dc5ef08ae361aada157274a53f54
SHA512 e09641474512a0043bae2c174826b3c9ea4621a7e2b4df261a1a47a0ccf8a9dd7f0448677e7537bf81a80b11a05aba3f32a91621348946af3430ff6e0feffb54
SSDEEP 192:sxR6RMC1/fYsXuZSWzoA8ppi/g6+WNYeG1/Yot8WGM+IgVAJ:sxR6R1/fYsXImE/5jy/Jv2C
TLSH
T10532C815AE28A93B4CCBD21DBB55BF53D2F9143261D11E48FAFC8A1C14EB6DD120781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 a2d9c974111771f18ca41ed72f686a32e2310b15ca706afc26ca9efb9c19f4ea
MD5 fcfbb1f6b2578b4752539a5844d00c61
SHA1 65fe90749bc882ac1aa043c75ff2e38501c2457f
SHA512 d8ea07cfa623e6cfd55e3377a566e388ffa2e19b9b6475f51b86698d069180ac0d51d36994fc554f598f4e3054a11f3e8b36c62486cb89b25d0dbc88f2756f01
TLSH
T17FE026C417C8C22EB30864C743B8634C8B90262A96C0799E1B40C9C8B505A48A69BAE0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 334fe8bd9e223175ed3de39dcf0437035fc5b4b054552e26dd0edbd9f73df2ed
MD5 e11ceaa8ff18e0ac3dfe888b6d27b999
SHA1 570b59850d1ebd8d1bbc24bd61c321a6f44e939e
SHA512 fd31775e3cf3ffc5601b8023234a5c500605a0c241c811a5792171ab5e55ccab89e6c90a82722322b9fbc41235e421a5a1a8b6ba803a49cc4920cda901ca4c3a
TLSH
T1EF711E4EA759C059E7AC4938FAD0108B3B3083B2AD4F1F22179BDA75F476BD84AD0C55
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8c65f8618e7791c858e9f50b6259532f88e73d91e8ebe80eb967507fecc42417
MD5 c8e9f94d8c99367bb01a8d5a77f7b85b
SHA1 c58d1bf7a55c9bf3821284a657019e71872761a9
SHA512 2632913896a52e076bf3c494088de506f8980a3b2f07b9b8516cf0a72931fba67ef249b1df2782e28e9df9c8ce17e50f0602a91037565ea5092841c15cc9801d
TLSH
T134712D4EA759C049E7AC0938FAD0108B3B3083B2AD8F1F12179BDA75F476BD84AD0C55
MD5 SHA1 SHA512 TLSH

Submit Download

4a2f803e-0d97-413f-bb7b-b4ddc6dc0eae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\4a2f803e-0d97-413f-bb7b-b4ddc6dc0eae.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

0b51b584-fec4-4b6e-9c63-de0f292d9ab7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0b51b584-fec4-4b6e-9c63-de0f292d9ab7.tmp
Size 2KB
SHA256 85044806fd24166502e7c88b8369b606a69e6686187edd62128a705a590d1212
MD5 eb4665e03ea14779146fb2e244334e19
SHA1 10e289cd3a62326f0aad1d738f0909c4f0b7bb84
SHA512 73ea70eca44b7c74059eb3889ed6efe0cca7cf597dc21f9938877e69c8ddc4d83fe2e89b62001927f8e31ba9409be76bcbfce5b65b9c820b507bdf15ea2a7120
TLSH
T16251BEF3C3E8862D891196F0AA186E2BDE2D0914932C7D5A89E49F1B93F34B1D14195F
MD5 SHA1 SHA512 TLSH

Submit Download

95bdf30f-2e7b-45a1-8d43-6b579e158747.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\95bdf30f-2e7b-45a1-8d43-6b579e158747.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

f823e561-2fdc-4cd5-83db-e0aea18d5d0d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f823e561-2fdc-4cd5-83db-e0aea18d5d0d.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

b823cff9-818e-40d2-804f-da6a684f569d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b823cff9-818e-40d2-804f-da6a684f569d.tmp
Size 29KB
SHA256 683ead9eea6c1da29c30e7633ae17d579593965de6e99fe214fa47d811cabd96
MD5 951660f04e4a4ea4ca2d2296436515e2
SHA1 616a6ec420ac43f548ce6be441999244678d7c34
SHA512 c08f1711290086d90f4beebdbb1b464e3f86bc294857ac9150e2aad0be2dfe8ccfd64fb445e6a89f5f2a7638371a7041a0fa2197e3d9c0049eec125c12efb7aa
SSDEEP 768:p/wWZO7pLuLbOnWg/Xf1p8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjXXH3ILroZ7j7:p/wWZOEbOnWg/Xf1pu1jaUXXXI4Z7j7
TLSH
T1EFD2DA7B740CCA7F4F804ADDDC197E9F6DA802CB9698CD8047FA985C02C67EA52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d6bab440-772e-421c-b64c-964ba38b7cc9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d6bab440-772e-421c-b64c-964ba38b7cc9.tmp
Size 12KB
SHA256 104c1716aefbd6d9fc0f92714d20c5a209fb51b8ebf27e94401b971213765514
MD5 844e7bdbfed4c456c03b23e0cc0a3da3
SHA1 a203ac521251e0b9895b5cc3ee427370485d2d05
SHA512 ef74f4c8c1a2b7f155fba11c074b41f6cbe5f2610f5e250946e133a4d694c67a9e62230d9c3bfb2f90b90fc9d4ce5a2ec90f205ed0ce6c020a185ce53222e255
SSDEEP 192:sxRZRMC1/fYsduZSWzoA8ppi/g6+WNYeG1/YotLSWGM+IgDDAJ:sxRZR1/fYsdImE/5jy/JZ20
TLSH
T19B42B815AE28A93B8CCBD21DBB55BF53E2F9103261D51E44B6FCCA1C14EB6DD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f34cf22a-c931-4f3a-a986-40fa136b8c60.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f34cf22a-c931-4f3a-a986-40fa136b8c60.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

78b79ebe-b681-4c4d-82b7-3980443566d1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\78b79ebe-b681-4c4d-82b7-3980443566d1.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c37c7e9d-0b25-4e0c-9cbb-09cf3a6b5e87.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c37c7e9d-0b25-4e0c-9cbb-09cf3a6b5e87.tmp
Size 34KB
SHA256 03cec51d814199d5a0043a3d13e353b5eddb707c2279fd1b13495218a5823d68
MD5 52ef4fdd56c67be77b2b048b1a594cad
SHA1 aa45bb7a11d640893b596943e03ed0cfec6e6c53
SHA512 fcbbf77e07fcc8e08c2bb05176cc7d1e3febc6b22c0a386ad185d5cb1493f9c2e23b290858b3c6abee7ae2297c818009d272b83a1c029870b27f93762337c1db
SSDEEP 768:AY3FyAOOE+35/9OA9at01j0iq00+IaiJ1xTl:AY3FyYmCHq00NaY1X
TLSH
T148F2AF70ACB19E73ACEAF645B21673869FF41523D5C94E94C5DEAA0E00076AE170BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

942383cf-2693-4722-acc5-3ddd790e197e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\942383cf-2693-4722-acc5-3ddd790e197e.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

dfcfe1fb-e5b1-4186-9df7-99f5e17eddcf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\dfcfe1fb-e5b1-4186-9df7-99f5e17eddcf.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

fae145be-5e72-4fcb-928b-539562a4ca5c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\fae145be-5e72-4fcb-928b-539562a4ca5c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f794bd71-ad6c-4842-9c42-03b5bc43dc40.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f794bd71-ad6c-4842-9c42-03b5bc43dc40.tmp
Size 37KB
SHA256 56557e8c583a1be1f29b6b2bc54751c59fd040a94fb16924c08b89b739b21131
MD5 1fca3c17cebb7928c228347f8dcb5a34
SHA1 69e64c754ae70f7c28a4f46393f2a8372a8601c7
SHA512 b8fb6b591fffac51c01fe9b888a8d0fa099518dc54f27278777b06fb552be1256f8b8b4ccb72e52388c959c024a6136c3850c581da03cfce6d36dc928973986f
SSDEEP 768:X/UxvxjgC+H3VTEOEA/9OA9at01j0iq00+Ia2dSHxRz:KZj3+H3ViCHq00NaiSTz
TLSH
T1E703C031ECA19D739CF7B384730A63979FF44663C6C96AA049ED2A0D05876AD1307CA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o9575aad.default-release\activity-stream.contile.json
Size 4KB
SHA256 f5d57090b94f3cc529753e50c2bb8a53a5b80dd0485919236b5a56e200ca5d9c
MD5 0f8300fce6eb3a42745268696d4d1b36
SHA1 28b8968b8823f84667a1ad2343938a249fed64d0
SHA512 327d0a746039271e650c8a5f535e12d4ea68c00481373cac4bbe6e6ff2257d00bbf1f02b02a1b4192b9d518451febcfcc5d685e3be448fecbfdb79f78a7a70ec
SSDEEP 96:TLV6jMK67Om+5zNbUN7XmQnyt7zOn1V5yYqNT+mRM75olz:HVaMv7OF5qNTm57a1VzqcmRM7eF
TLSH
T12391C85F8964981A1731E5E52C0B26BCF017701686F5CB9CB17A9D3285BC7EBD0CAC8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o9575aad.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 f258636f4ef96fc6127754bdda92096d3dc90dfbd2f6af85bec1bc1b6722759b
MD5 660aa10298a7cdb46082a4a20ae37e46
SHA1 83b3b66dc5fa49da0453af3717e6ba02541e2e3a
SHA512 eb55e65f91b28c1cc8baeec4b49151a5d244b24f77d7efb88baae343095674ecc8081ad3bf5643e73f2085fa3560a47fd136bc51cb1a9d23fd9b84fb67d54e19
SSDEEP 768:4y9cVduL02wsytqY51OJiUNPgvXqZ2Jm7O4+GX5V0KOOra1k5:D9cP2nSqIwJLNvZnO5Gbo25
TLSH
T12C731AA396E8B2FB1B9037C71C0FBA5B66D30185E34506CDFCE9C91D81CD6A4023A5AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E9338C5CCF1E2FCF149487351399F198A4F9FCD6

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o9575aad.default-release\cache2\entries\E9338C5CCF1E2FCF149487351399F198A4F9FCD6
Size 16KB
SHA256 c1e8f320340b93641c92e0aaefd6cd17a28b9c9a7e07878a47fa62da51d22919
MD5 7568d4b2eed44a22a0b9955be17e05bc
SHA1 b4a690c12502fb46d36b4f7856df2b7bf4152115
SHA512 70da18f30cee7b97469b99090a8883bf90905822806f3e37477e6ff8a392d23c76170edda218b9149dbb62cd92b8cd0e99e024ca012b6bd15e536e0d76852c2a
SSDEEP 384:HGNQiO024YXWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMAc:mDZYXWTToXJWTTogB7S/AmVAf+hRM1
TLSH
T193728E7D8F013CAD275780E8C8B583598D18B7A7DFB6C06D26883D09C988A1671F945F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o9575aad.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 cd757ace098be48e5584aa2e887960faa33342e4b40c8d3b8f1eb02a83800a0b
MD5 41a8cb496a6b88fa667945de2aa3bff4
SHA1 d97fe17fb966fef71713e4c50b575a92d808d04e
SHA512 e510c18b7f5c59e26279d4456899a9288ee60b6d6434a39da57ec1503622b3e311604b85b813eac2f006b03496a723bfb05bdaf64b54b5d229237837e1b75039
SSDEEP 3072:X3lwKZYcywVV3oAW6BrWZbqAb1cs8CV60UUD2UI:Frdp3Y6B2blb1csap0y
TLSH
T153B3BFF6DFA2C97D58FFD01DAA82843EFC267414B3E72009C963671062CAB747679609
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o9575aad.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 24895e555c471c775ddd70b648ea0aac9d505c1a7b5d385f2bea70a7e0802286
MD5 d8d1230beb10327f2a1c01fb52dd086a
SHA1 2548b86be9c902b0306308d7b899c9c31c9c14a6
SHA512 020d6f9af6aa8351d5e2a4c559030dfe40683eb7e03c973619b8b43fbe612f5fce369db1a24259081acd13cf807f44b2614a471d33643aaa33ec8e071f7651ea
SSDEEP 3072:j3lwKZYcywVViXBOB9VEbqAb1cs8CV60UUD2U9:prdpiROBcblb1csap07
TLSH
T118A3A0F6DFA2897D58FFD42DAB82C43EFC262404B3A72009C963671061CAF747679649
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

66df563d-0233-4cee-b54c-f7d19912566e.tmp

Path C:\Users\Admin\AppData\Local\Temp\66df563d-0233-4cee-b54c-f7d19912566e.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

b1dd1796-4673-41e4-9fc1-0804a4f5bb12.tmp

Path C:\Users\Admin\AppData\Local\Temp\b1dd1796-4673-41e4-9fc1-0804a4f5bb12.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1436_1025788702\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 21.6MB
SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
MD5 40bf410fa9ef0d5499907e34885af6f4
SHA1 4d7722337a0e26bf4a1c6478129356acb2f7b720
SHA512 b763712aa4bd9819b7972a40216c08fd32338b14fab7ce4b166e39ce441ad62678bf0e1f25da436ffdb56ff1b1a21e3dbbaf47c0f5918c252e70656f5d0307ac
SSDEEP 393216:KYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHY:3mghF5QDwWCm/2YU8Ivq9u5P
TLSH
T14F37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addonStartup.json.lz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\addonStartup.json.lz4
Size 4KB
SHA256 5a4bc26a3e2763ce3fe06bd7894321b04fe2b2bb58253fd9c86cfb52b6f04603
MD5 bb9d3afed9132504249ce8d495a83452
SHA1 fcf417e4abcad3ad00db357d4b3094bb0a27cc87
SHA512 74f66711df2dc1709110834034337783effa63ace2cddf78492a1f6ae12d8b6815e40c1fb2343dd25d564e8e94f5dd733eda1431d22355a0603271a99dc8cb55
SSDEEP 96:NbOs4sHNw6M2xWGhD41MgGvmHhF+rUpO1LnOYvhQhIRhN:Nb+52xxhD8rGvm6ApwnHUuhN
TLSH
T104A16DAAD581EFB6FE32C04748D57FB2E6D5AB7420B9C8E4F1AA71294C74A735704340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

broadcast-listeners.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\broadcast-listeners.json
Size 221B
SHA256 25187547623085a50c49f9bc68f7e7511eccef897712f743d47ece9008769729
MD5 59811e97e97887d270f902086b28d661
SHA1 daac98fb8f33136a884a884a5fec2b50c10f6d06
SHA512 fb294b74497ad2689fd9991baa60c25e087b775dfdbebf55b912bbe9ebf3bc69a955caebc19576d85bbbb99e85586ae1c950766cb99fb1bed38dcb44702a29db
TLSH
T1BCD0221F10273C7F4B586639F8042BC50BAB204E7270903DC3AE20640A2AAEC4108190
MD5 SHA1 SHA512 TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

store.json.mozlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\crashes\store.json.mozlz4
Size 66B
SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
MD5 a6338865eb252d0ef8fcf11fa9af3f0d
SHA1 cecdd4c4dcae10c2ffc8eb938121b6231de48cd3
SHA512 d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c
TLSH
T175A022C28E0C83BACF000833008AF00300E83B020B8B0F882AC2AEF8200200C8082082
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\db\data.safe.bin
Size 35KB
SHA256 04ea1134568a20566f42103dc779eb7225f65dbc6b27f7079705b94e69ecb631
MD5 0f986926d669297bcc2b12c2d44cc2bb
SHA1 cd28b12b051358d9a61bbd1c82447bf24de6c5f7
SHA512 b93dbb0cacfed5c491d454632fe6de1946291cc81296edcd25cd7eea4241472c2ef7733f99a18d3d4ea287bd39091b8a6d3f1af5e4294cfc329d00c34e8c97a8
SSDEEP 768:PjVc6C0D0Gcm+u9V5QKABGj/8hGbgb3bXbeb1SIciQfHA51/:PjVc655Q+5aiegz
TLSH
T1E3F25284EB2A813FD41452BBECA51B142F39B88548592F5B3A8C54282CCB3ED3D4E57F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\db\data.safe.tmp
Size 35KB
SHA256 016ff2a80762fff83cb91e181050f02af1b8a780dbf5dc728ffc4719e6f7a968
MD5 930497df3bdb5f2e9602814016f53c96
SHA1 ed1530a9c2d4702a56da7038afce189c52e966a8
SHA512 b45944acb72b366c11f882b1d5406f3dce211fb0c9188bf278ae6b48bed41822599b8ebe62f5ea34dee0d1609d121b754e3ebd15bff37624449853eb568a82bf
SSDEEP 768:q1zciQfHAujVc6C0D0Gcm+u9V5QKABGj/8hGbgb3bXbeb1Ss:diegujVc655Q+55
TLSH
T134F25284EB2A813FD41452BBECA51B142F39B88548592F5B3A8C54282CCB3ED3D4E57F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\db\data.safe.tmp
Size 35KB
SHA256 c67ed75d3dc6c1dd92fb4ca633bd7e8056de7e464af8f51ef639f35ea7c3244a
MD5 f5511d49f60e865133a5a2515efd190f
SHA1 67a59888fdd7adfa7d22076c9938b6b313f0058d
SHA512 dc9fe3beb8497a674f13608d13d4b4656be8510c73f3e5417198f78960c26c73e9ac234f6a32056d6cea8cfcbf82c71ac07ec68f983e2052f32c399c9fe40e96
SSDEEP 768:KciQfHA51ijVc6C0D0Gcm+u9V5QKABGj/8hGbgb3bXbeb1Ss:LiegOjVc655Q+55
TLSH
T15CF25284EB2A813FD41452BBECA51B142F39B88548592F5B3A8C54282CCB3ED3D4E57F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 4a5fbc5faf42337c423b83a5654febf25c70295130145183484ddfde499433f5
MD5 85e77d3bb0f5a868324cb59f988b3fcf
SHA1 b51bc6d0d008b0d5ccff8ef5e0d71eb735316440
SHA512 49a71cf9e834e4a743ad8a0918908de20c4fa33f03e579153440c6d345eb7c92528aac403f4e5c763c9090aed18e683fcf5ba4c94d38718ccd8f15b4a79f6fb3
SSDEEP 192:6fHoh1d66JoztdzgCl6mc0dWlcyEKHOv5zbo7i5xTHHyjiW98K:6fHofd66Joz/zgC1jUlcyEK4bo25xTHW
TLSH
T1C1E120A8FA28863FC418027BCCA61B414F35385A9C4E3F19359D601D2D5B3DE768E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 48c47880644982e4ccf9e4d5f9ed4bd12f0d4425662c155fc3047d9d580357a1
MD5 522d522596fdde73c8adc2dd5b6a179d
SHA1 f26a354c9c154f61bf21f702787775eb136d1bb3
SHA512 9a2a284c3d3d722f66aca7ef996eac80698f2276add3607ab47b9ae57d5b367facc0a99024907eb558f9d1e291727ed976cbccc75e0a428886abe267191b192a
SSDEEP 192:0lcyEKHOv5zbo8MxTHHyjiW98ifHoh1d66JoztdzgCl6mc0dz:0lcyEK4bo8MxTHHyjiW9fHofd66Joz/H
TLSH
T147D11FA8FA28863FC408423BCCA51B414F36385B9C4E3F19359DA41D2D5B2DE768E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 54949c35d7119121f894f1690b90a5820bf3ce78b9441ee0b24947e3349b7cc3
MD5 5154f40529dab85f8c396c615a9d30be
SHA1 7a5959d05e9631b3df68522742d1ff6908e24d54
SHA512 8df350e9ec67dc82d7bd8af9713886d18a61aef54b67f4cf422beba5ef0694476aa0596e84616d51faba0b42bab01bdd5dec9f93ef7f7b5932d54b0c9325f3a6
SSDEEP 192:6fHoh1d66JoztdzgCl6mc0d1lcyEKHOv5zbo7iSZxTHHyjiW98K:6fHofd66Joz/zgC1jLlcyEK4bo2SZxT2
TLSH
T1A0E120A8FA28863FC418027BCCA51B414F35385A9C4E3F19359DA41D2D5B2DE778E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\events\events
Size 1KB
SHA256 f313597310a66f09367f69102511d1379beb0b5f89b992f690a044e85f1b7ec6
MD5 f8572d7d29e2ce8de03a14959025443f
SHA1 1ff559bff21f42b99ead191adaac2a7f034ea834
SHA512 ba02b21fbe2995ace7585c4f760e665a3688f5eb8822e8dd23fdf22f192dca8808a626e71a43a2417b51609a7715af3d3658e6dc5f19102baa4ac76aaf3b6b85
TLSH
T13A216A4C3DF84E2A59CAEA5CB44102CE53954E0B54873D470D82DE8DCD91AD933AB83C
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\events\events
Size 2KB
SHA256 94350932add40ca8586a4367fa6e21aa3cfdddb09328bfe9be0467d58e5ce23d
MD5 aa1977a19361c0e5353001a6ede66a77
SHA1 a7de34c686a910f38db13460187ac307b6467015
SHA512 a65c3a0daccd99738b7f4ed2346dbb06b4b658e94233944655a5fde23aa5eee391471434e7b6a75dfba77ca4c27583ca67c3905658b3da479cd70b4e59bb7f45
TLSH
T1D1418B0C2AE94D3A6887E6CCF84106CD97854A0694D73D874DC6DE4CCC53A9933AF42D
MD5 SHA1 SHA512 TLSH

Submit Download

4536cdae-9b1c-429e-b417-4cbc35a7e72f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\pending_pings\4536cdae-9b1c-429e-b417-4cbc35a7e72f
Size 235B
SHA256 9bf17e44088995208613a258906ff6d9206e3085be2b3c5043f39eb6ee155598
MD5 10464ceb02ae46e4a389b427da2fb0ef
SHA1 063bf6f10d50c5fe31b7c7e740af6673d72c0070
SHA512 73fef0ed09eb92795b954604d8c4f2e84d7f2c6c62325bb47548261f5ac21697534da49bee67d3d941214d11bc4c824323cd5b9b01c71b8b9f51684022df7099
TLSH
T1E6D097A0189867AC48100F03F0B02DD230844C3354A1A870D9B084389EB9AC891A1807
MD5 SHA1 SHA512 TLSH

Submit Download

62df7ac3-6e4f-488a-90b0-bf3757448227

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\pending_pings\62df7ac3-6e4f-488a-90b0-bf3757448227
Size 2KB
SHA256 28133e5ce3b337369913ec43b9e665d9ee3c93e2284be86ab2020a1d1938fd1e
MD5 a771c29e6deebc6e24cae023974c1f92
SHA1 2b98a56886475bb5ba2ac771b36baf14fe6fc897
SHA512 72ad32dc331c74ca3ea55f15448b50b91d6c9ff4758280c9f984418ed67a32188ad55756167751382a422583afd0d6e2118c07d9bee48f0cae5d829ec39517bc
TLSH
T1DB41436C39B84EBA9CCAE14E9481334E57608A0300C61C83AD42DF4DCD976ED73AA53B
MD5 SHA1 SHA512 TLSH

Submit Download

7e6b89bb-683c-4961-8967-c9955bc60957

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\pending_pings\7e6b89bb-683c-4961-8967-c9955bc60957
Size 235B
SHA256 86685133c9b7b8ae59a06da726ff5519f9a27ecf98dea380845de6ab050d216b
MD5 3a9273a7327df9e2432149a3c55e9d32
SHA1 edb045fbccc19aa4ea3308770a49d5ad868ee14e
SHA512 ea7a947000ce87720c66e1a3d3d10a4d3032f014ceeec16402b471c011081011fcf1651301a948231ac3ae04bfb2b882ebf81856d1a2194767a1feadb87a97db
TLSH
T16AD097C028D8232C08000F07B0B0B9CA31A88C3358605C3096A188348AF9DC482E1807
MD5 SHA1 SHA512 TLSH

Submit Download

94d136b0-8810-4f18-93b2-7261ce5f7a6a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\pending_pings\94d136b0-8810-4f18-93b2-7261ce5f7a6a
Size 883B
SHA256 dfbc6abc09101ac501f91c0537207144c04bc337a66b7daad11cc50e86e02e8d
MD5 8cbd968bb6d83a1aed275da596890355
SHA1 9e22351000037bb11ac63d24117cd6414b26fcf0
SHA512 22c93f91fbe4ff01b99d8c56afdb6280aabbaffcfab095b1c27f1f235871759338d0b5aae332b84d2f364f5739a1c92b95618cb53082b6471e2db1576825b357
TLSH
T11C1127546534BAB2CC7C820FC99537058FF4241380C681083DD18E184D7E76DA36671B
MD5 SHA1 SHA512 TLSH

Submit Download

95a58439-56f2-40f4-a3d5-727a25ef48db

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\pending_pings\95a58439-56f2-40f4-a3d5-727a25ef48db
Size 16KB
SHA256 f5a1a3f78c03a3b29e8f0cc05c9da9ee26930b104aa3b779494b97df58db64e7
MD5 fc582d11d69f55c6f10d299ada47c409
SHA1 f128500b62e401fb0ff70987f1a5e88f681e02ad
SHA512 302711d237ec0c941f28d7891363a8180a3b7c6a16714e5d05ed1a33658e6dcd7e9bf1fbbbfa6c53565319ab660406ca97a103f14ca78ecce08443f884b2a33b
SSDEEP 192:LEWd55XSuuSzU7R15mUdei7aJ24Io4GF0yNtb5KxM2+axAtouB4oUFV1sNDvdSs4:LEQ55XSZSo7R15ZeVS+ZtNkFychKRZO
TLSH
T12172CA56282055BA8691E36994FC7FC3E6F528CF4C418FCEDBE4BE0859DE06E012794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fc9eff4b-70c7-4151-99f7-d2c2d49708de

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\pending_pings\fc9eff4b-70c7-4151-99f7-d2c2d49708de
Size 886B
SHA256 b49d4b7157552e8d786bd436a6b6141b9e3efa7e024f1baa9045e0ad88d18523
MD5 1565e60f8ff5dc46192a93961c44adda
SHA1 5518b946b571763589bc14607e2040a19f6e971a
SHA512 3b7e4097cfa6d5317ce0c90bd094263d81ddd42a9f5880e53318a7f713c848165271564cb85fcad70aa7d585191fcd60875f58b27a74fa7b71aed49557e4756c
TLSH
T1C41104449929B671CC78924B85B17B428BE4252380D649483D604F284DBF25EA367717
MD5 SHA1 SHA512 TLSH

Submit Download

extension-preferences.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\extension-preferences.json
Size 942B
SHA256 a56a46aa7451d640626f9adbce3ffb26ea6ab549f15af56fc2cd69f0bcfda67b
MD5 8913f98eab4828647224c9a64b706b3c
SHA1 f886a4456ee44a4e73ef32a2b138193f2fa41d37
SHA512 28869c106812bf053c732469b0f67da993e42a471c7b576e68d45fe66d2f067bab0a66c5334e88c6460e08a06285daa643f5f34771bd0d7361097307137e1630
TLSH
T16211F13A640B6EB01E8E5625FA384A92E791111B50B7F2E47E69934A13D3970C1ED39C
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\extensions.json
Size 14KB
SHA256 9795b210f2fcab9b31f2600f147bf4b0abff94ed1e74a52bd757d44505c61a60
MD5 f04c529a0d10aa0146d03093f8628e9a
SHA1 c446a4ab8dec05e92923b971204f8eb3025d34f3
SHA512 aa34cdf2c15fce60f112cb20f6af1983ae7045d87b6ff548f753119c28d9f9174891ce754645d1760d6e51902fef1f78551c01573b2cb4e15d9e13faebc403f5
SSDEEP 384:DkI4vLUmldvg8dhW394zg96oUL4HDL4PiL4HRL4HSL4HC:AI4TRfZXW4I614P4o4p4A4i
TLSH
T13262531545148EB8298FA78BAA36BD01C37D473B60445C78F4DD8FC842FA6B902FB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll.sig
Size 1KB
SHA256 c5f50bed6afd38490baca2ce8e8fdd1a39849c9f0dc06478a8a2e9226526607b
MD5 61d51cf075ad6dcbaaebf956c6bc1dcd
SHA1 f176331dcdb84327afd47ecf8ede3b0664c7d05a
SHA512 de263ed43f1112786186afa7bb942f25482fe60b04e7138c3687ec09956e0247307e5a6303a4297f785a572ed9a0059747a9b870c2fb6e84483373cfe27ca6c5
TLSH
T1C421B6DDAD2426542DC0EB2D5EF8E826DD3112C2F96404BB426666C3FCA3BA038C466D
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\prefs-1.js
Size 6KB
SHA256 94f0f40b819bfc9d3d8eb3f01f55b18caf70b083fbe15db11f2534c094a80e5c
MD5 a691b98a9b30ab033f3b97ff84ec86cc
SHA1 b7f7244d52b17a0e241b2ccde6a32aa40f989c9f
SHA512 4c5e8ae2485f82f1d2fde3073e38ff2e5834b0da6a51901d0576a58699c302fbe9f08e57ec3de87f1c9aff8ee22420d54727961c9b43e08daee51966718bfd3d
SSDEEP 96:xHAUTUvqGqjfGEb1zS5SSledv9j7nGHtcSXaBw88u8L4cnEo1/Gc:+SRjfGEbcSSbtrXaBw88zuc
TLSH
T122E10F789448CB7FB4B6766CAC6888715AB2013BBBBF68C750A554C4050CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\prefs.js
Size 6KB
SHA256 01e4c58a772b9672a5e38a35c40510d1961dcedca6172cb0006cd9eb1a37db2d
MD5 a1bed0c9e2f3ce03c5a239bf60775829
SHA1 8f9b08f297682431e356e171a28d2ac16d05febf
SHA512 5cf7ad72f0e1c5b4ff7c3cc2c20a3b2a6e479167d9c7b22cc960bd63edb2d7ce3d7584b201da2b799efe9b0dea88e21d1e2e5bbbeb85939e25aa22bad51ab31c
SSDEEP 96:xHAUTUvqGqjfGrc1zSJSSledv9jPDnGHtcSXaBw88u8L4cnEo1/Gc:+SRjfGrcsSSXtrXaBw88zuc
TLSH
T1DEE11E789448CB7FB4B6766CAC6888315AB2013BBBBF68C750B554C5050CF3881F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\prefs.js
Size 12KB
SHA256 9e5f51e87400270d3cc29a7dd41a034aa416eae4f970bbd7499ded861102b238
MD5 73ec867c68b2ca3de42d3621ba071ee0
SHA1 b1f05d40a644b0ec40b04f71efc927d845d7cc38
SHA512 b2cd26fc6bf09a10c636a29f27b6ca22338ef88ba39eb84c85fa8a37d3332fe5029e38bc4d81df5f64177797145853f02b7ef3bdac1631ed82ac9562746eb722
SSDEEP 192:cPRjf0Eb7SSdLRVrX3OBw88B3E3rm/rfuc:W1RVrX8w2K7uc
TLSH
T1E142CC3C54818F3F64B6727DAC2549B019624137BABFBCDB45F898D2044CF2442E6AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\prefs.js
Size 6KB
SHA256 1fa7a97223a6d444f7090e956b968bc85afcd77165ef21a2908947dfe17f8183
MD5 700758ba7ed1386decb609b880993d3a
SHA1 2af50c6b5145ebe2b4677c4240173776ab027316
SHA512 5d34a5b1b2a133a7d169f23f5355cc475ea2dd1a2dfc9d164910fbe7deb0be8718498ae7024ac0c4af26be1d045e0186ac547e2f7af9a72ff5e797d3c4986967
SSDEEP 96:xHAUTUvqGqjfGEbObzS5SSledv9j7nGHtcSXaBw88u8L4cnEo1/Gc:+SRjfGEb7SSbtrXaBw88zuc
TLSH
T15CE11F789448CF7FB5B6766CAC6888715AB2013BBBBF68C750A554C4050CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\prefs.js
Size 8KB
SHA256 875b8f2d862bed6976dfe855ed029199e28a2b9ec02c9f816cf6c4f740631bea
MD5 7481bda7d813bb6c83867126bedf6b6c
SHA1 1149909a4a43ec2fa934718a54b227d544aace45
SHA512 dd85da924db6da8de940bbb316b3c8b96f30d2a40b4da626c3ac45e3b761461c9ac8cf6a23d2d430a65c64dacd00706767cc41b16b80d6ed1ab839e8d28c5a54
SSDEEP 96:xHAFTUvqGqjf0EbObzS5SSledv9j7nGWRrhcSXDBw88BH0Ez8L4cnEo1/Gc:+PRjf0Eb7SSSRVrXDBw88Bbsuc
TLSH
T13002EA389444CF7FB4B6766CAC6449705A72013BBABFA8D750A954C5050CF3842FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 431dfb050faa71c8154c4a4b3c5b229c72fb76296153ad6d810a543994f22504
MD5 4a85346eb5b332530ace48de762fb13a
SHA1 8c7f164942def7e820a64a4315c3db17e8af0d6c
SHA512 b5259252039f3069372f010b9437b8d9b1cbbffb52f0e3d297b51f5c40091bd1de907db8eeb05b75c3ea550b1387e5227d0e5226eda868e0d4444e03d33050a9
SSDEEP 96:d2fyeNZOeW9jILA0NjoB8kMJttn0YJZQaFz:Oy2YOnNcB85JttnTZlFz
TLSH
T12D918C42320F2963F95B868FEF2A8CF24564300A558184E880CE7B26F26FB8B756C075
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 c5cf203178519fc730ec7756b09137d2471e04a1a1ddf324c799f7912e5c772d
MD5 d21f393082d7b91db3644c31fb48f193
SHA1 818d0a0419e834e59737978ba73e7f788ea1171e
SHA512 bf9f94d8610b27913403a07b5e1dd9dfdcb216422e4991d060420ff21d4bcc88b44ca9924668d09b05b94efc4abad02305cfaae57ad52e1079f44ebfbd4c2b38
SSDEEP 96:d2fyeNZ3eW9jILA0NjoB8kMJttn0YJZQu7z:Oy2dOnNcB85JttnTZBz
TLSH
T1E2918C41320B2973F95B869FEF2A8CF24564300A548184E890CE7B26F26FB8B756C075
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download