Analysis
- max time kernel
148s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/06/2026, 18:27
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
28 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe
Resource
win11-20260513-en
windows11-21h2-x64
36 signatures
150 seconds
General
- Target 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe
- Size 5.8MB
- Sample260605-w35gsacv21
- SHA256 e9717fb409ba9feb30ed1cef636df3f1c95068862281dab91ad311abf54cbf59
- MD5 799014398731a6a3cf1c3ae509a03f1f
- SHA1 c36f1b9829d1563f068c9fdcfeb2f6776c0b77d8
- SHA512 502bb8469596c49e5fb77860e28ba1991ac3c37724d0b6623dc5cf960ba26ca6f2c8227ccbd97cf6e0b94c3f5ad7948ec111186b05a7a7c68fcc5f8891502fca
- SSDEEP 98304:Tq35Xe/hpirHQzP4vs18frP3wbzWFimaI7dlo4Gs:We/hp6wCgbzWFimaI7dlvp
- TLSH T1C0569D51BF8C817AC95A1131172DAF2A402ABC98773465D3B2743E7EDC763C26C3A61B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Floxif payload 1 IoCs
resource yara_rule behavioral1/files/0x0033000000016864-1.dat floxif - Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 6 IoCs
resource yara_rule behavioral1/memory/4116-13-0x0000000000240000-0x0000000000811000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/4116-396-0x0000000000240000-0x0000000000811000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/4116-407-0x0000000000240000-0x0000000000811000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/4116-565-0x0000000000240000-0x0000000000811000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/4116-718-0x0000000000240000-0x0000000000811000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/4116-726-0x0000000000240000-0x0000000000811000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers - Detects executables containing SQL queries to confidential data stores. Observed in infostealers 6 IoCs
resource yara_rule behavioral1/memory/4116-13-0x0000000000240000-0x0000000000811000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/4116-396-0x0000000000240000-0x0000000000811000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/4116-407-0x0000000000240000-0x0000000000811000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/4116-565-0x0000000000240000-0x0000000000811000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/4116-718-0x0000000000240000-0x0000000000811000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/4116-726-0x0000000000240000-0x0000000000811000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore - UPX dump on OEP (original entry point) 8 IoCs
resource yara_rule behavioral1/files/0x0033000000016864-1.dat UPX behavioral1/memory/4116-3-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/4116-12-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/4116-14-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/4116-322-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/4116-397-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/4116-408-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/4116-719-0x0000000010000000-0x0000000010030000-memory.dmp UPX - A potential corporate email address has been identified in the URL: [email protected]
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x0033000000016864-1.dat acprotect - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe - Loads dropped DLL 1 IoCs
pid Process 4116 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe /onboot" 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe - Drops desktop.ini file(s) 3 IoCs
description ioc Process File opened for modification C:\Users\Admin\Documents\desktop.ini firefox.exe File opened for modification C:\Users\Public\desktop.ini firefox.exe File opened for modification C:\Users\Public\Documents\desktop.ini firefox.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\e: 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe - Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe -
resource yara_rule behavioral1/files/0x0033000000016864-1.dat upx behavioral1/memory/4116-3-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/4116-12-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/4116-14-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/4116-322-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/4116-397-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/4116-408-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/4116-719-0x0000000010000000-0x0000000010030000-memory.dmp upx - Drops file in Program Files directory 2 IoCs
description ioc Process File created \??\c:\program files\common files\system\symsrv.dll.000 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe File created C:\Program Files\Common Files\System\symsrv.dll 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Checks processor information in registry 2 TTPs 20 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe" 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3" 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4} 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243" 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Low Rights 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe" 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3" 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe" 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A} 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006} 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm" 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3" 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe - Modifies registry class 16 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter" 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe" 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1" 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan" 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User" 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Model = "155" 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\WOW6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D} 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD} 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Therad = "1" 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4116 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe 4116 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe 4116 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe 4116 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe 4116 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe 4116 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe 4116 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe 4116 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 4116 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe Token: SeRestorePrivilege 4116 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe Token: SeDebugPrivilege 1592 firefox.exe Token: SeDebugPrivilege 1592 firefox.exe Token: SeDebugPrivilege 1592 firefox.exe Token: SeDebugPrivilege 1592 firefox.exe Token: SeDebugPrivilege 1592 firefox.exe - Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 1592 firefox.exe 1592 firefox.exe 1592 firefox.exe 1592 firefox.exe 1592 firefox.exe 1592 firefox.exe 4116 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 4116 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe - Suspicious use of SetWindowsHookEx 11 IoCs
pid Process 4116 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe 4116 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe 4116 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe 1592 firefox.exe 4116 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe 4116 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe 4116 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe 4116 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe 4116 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe 4116 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe 4116 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe - Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 4116 wrote to memory of 960 4116 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe 101 PID 4116 wrote to memory of 2340 4116 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe 105 PID 2340 wrote to memory of 1592 2340 firefox.exe 106 PID 2340 wrote to memory of 1592 2340 firefox.exe 106 PID 1592 wrote to memory of 2348 1592 firefox.exe 107 PID 1592 wrote to memory of 2348 1592 firefox.exe 107 PID 1592 wrote to memory of 2348 1592 firefox.exe 107 PID 1592 wrote to memory of 4348 1592 firefox.exe 108 PID 1592 wrote to memory of 4348 1592 firefox.exe 108 PID 1592 wrote to memory of 4348 1592 firefox.exe 108 PID 1592 wrote to memory of 4348 1592 firefox.exe 108 PID 1592 wrote to memory of 3628 1592 firefox.exe 110 PID 1592 wrote to memory of 3628 1592 firefox.exe 110 PID 1592 wrote to memory of 3628 1592 firefox.exe 110 PID 1592 wrote to memory of 3628 1592 firefox.exe 110 PID 1592 wrote to memory of 8 1592 firefox.exe 111 PID 1592 wrote to memory of 8 1592 firefox.exe 111 PID 1592 wrote to memory of 8 1592 firefox.exe 111 PID 1592 wrote to memory of 1836 1592 firefox.exe 112 PID 1592 wrote to memory of 1836 1592 firefox.exe 112 PID 1592 wrote to memory of 1836 1592 firefox.exe 112 PID 1592 wrote to memory of 1836 1592 firefox.exe 112 PID 1592 wrote to memory of 5768 1592 firefox.exe 113 PID 1592 wrote to memory of 5768 1592 firefox.exe 113 PID 1592 wrote to memory of 5768 1592 firefox.exe 113 PID 1592 wrote to memory of 5768 1592 firefox.exe 113 PID 1592 wrote to memory of 5812 1592 firefox.exe 114 PID 1592 wrote to memory of 5812 1592 firefox.exe 114 PID 1592 wrote to memory of 5812 1592 firefox.exe 114 PID 1592 wrote to memory of 5812 1592 firefox.exe 114 PID 1592 wrote to memory of 5836 1592 firefox.exe 115 PID 1592 wrote to memory of 5836 1592 firefox.exe 115 PID 1592 wrote to memory of 5836 1592 firefox.exe 115 PID 1592 wrote to memory of 5836 1592 firefox.exe 115 PID 1592 wrote to memory of 5868 1592 firefox.exe 116 PID 1592 wrote to memory of 5868 1592 firefox.exe 116 PID 1592 wrote to memory of 5868 1592 firefox.exe 116 PID 1592 wrote to memory of 5868 1592 firefox.exe 116 PID 1592 wrote to memory of 812 1592 firefox.exe 117 PID 1592 wrote to memory of 812 1592 firefox.exe 117 PID 1592 wrote to memory of 812 1592 firefox.exe 117 PID 1592 wrote to memory of 812 1592 firefox.exe 117 PID 4116 wrote to memory of 5380 4116 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe 121 PID 4116 wrote to memory of 5392 4116 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe 122 PID 4116 wrote to memory of 5416 4116 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe 123 PID 4116 wrote to memory of 5428 4116 2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe 124 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-05_799014398731a6a3cf1c3ae509a03f1f_darkgate_elex_floxif_glassworm_remcos_stop.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:960
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html2⤵
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html3⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2004 -prefsLen 27099 -prefMapHandle 2008 -prefMapSize 270279 -ipcHandle 2084 -initialChannelId {0b8657ef-aa37-4f16-9fcb-c7ff9972acfd} -parentPid 1592 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1592" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu4⤵PID:2348
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2464 -prefsLen 27135 -prefMapHandle 2468 -prefMapSize 270279 -ipcHandle 2480 -initialChannelId {183c5651-d7bc-4ecb-9a97-0cd3e9b73c13} -parentPid 1592 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1592" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket4⤵PID:4348
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3000 -prefsLen 25164 -prefMapHandle 2928 -prefMapSize 270279 -jsInitHandle 2984 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3760 -initialChannelId {57b814f2-9b26-442d-adbc-192433708aac} -parentPid 1592 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1592" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab4⤵
- Checks processor information in registry
PID:3628
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3896 -prefsLen 27276 -prefMapHandle 3900 -prefMapSize 270279 -ipcHandle 3984 -initialChannelId {7f21e8b0-eaf8-4416-9a32-e838c5fbfb8c} -parentPid 1592 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1592" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd4⤵PID:8
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4284 -prefsLen 34775 -prefMapHandle 4288 -prefMapSize 270279 -jsInitHandle 4292 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4240 -initialChannelId {aae93ef0-e9f5-4341-85ab-ae0bb64d9479} -parentPid 1592 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1592" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab4⤵
- Checks processor information in registry
PID:1836
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4948 -prefsLen 35012 -prefMapHandle 4944 -prefMapSize 270279 -ipcHandle 4912 -initialChannelId {2e4838f3-7ac9-4787-bb7f-a561aec6c3cf} -parentPid 1592 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1592" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility4⤵
- Checks processor information in registry
PID:5768
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5188 -prefsLen 32952 -prefMapHandle 5192 -prefMapSize 270279 -jsInitHandle 5196 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5200 -initialChannelId {956a1a13-101b-47b1-9c8f-f59f26ed5b77} -parentPid 1592 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1592" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab4⤵
- Checks processor information in registry
PID:5812
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5220 -prefsLen 32952 -prefMapHandle 5224 -prefMapSize 270279 -jsInitHandle 5228 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5236 -initialChannelId {a53cd3a9-73e8-4a40-837d-012d5aa02f80} -parentPid 1592 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1592" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab4⤵
- Checks processor information in registry
PID:5836
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5576 -prefsLen 32952 -prefMapHandle 5580 -prefMapSize 270279 -jsInitHandle 5584 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2848 -initialChannelId {4fc7fe83-b870-4c7c-9759-0f5b5a073277} -parentPid 1592 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1592" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab4⤵
- Checks processor information in registry
PID:5868
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3816 -prefsLen 32952 -prefMapHandle 2788 -prefMapSize 270279 -jsInitHandle 3868 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3856 -initialChannelId {94ca9d88-f375-4175-addc-f3fe93726363} -parentPid 1592 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1592" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab4⤵
- Checks processor information in registry
PID:812
-
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:5380
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:5392
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:5416
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:5428
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\System\symsrv.dll
- Size 67KB
- SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
- MD5 7574cf2c64f35161ab1292e2f532aabf
- SHA1 14ba3fa927a06224dfe587014299e834def4644f
- SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
- SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
- TLSH T17863F1372AB5807DDD210D37949F835AB771E5A76C20643FC25907D988B8DD0E3239AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\System\symsrv.dll.000
- Size 114B
- SHA256 aefc503b1ed462d7b6280228a7b5b710792273b78934426f88325341ac5b5a92
- MD5 e609411db8aa6775d0344c75c23ae79b
- SHA1 1d2ff6194bf159ce36cd0461cd3da29486d1e97d
- SHA512 6884ff5c07bc687132c965a59cb8c5a898a25da74c6c846c1d6089ddca8007cb7e4d2f8520bdce9fbcf6e2f9c9e5c28d8c8d6d049d3522470bdc7d38bbfa0ad0
- TLSH T1FFB09262AA2791EAE1AA224505A0248C1ED0B62AB48638002EBA5A4E93256A85916147
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\cache2\entries\C5643FFFEA92A5665EA3F3F42C97FA8CC3904334
- Size 13KB
- SHA256 728b20bfdc730604b25b41f55b77938c51ec0d5972a876926d75a175a9937658
- MD5 217d9450d5130d3a0e97235071e80fe7
- SHA1 2b4737d4fcf77513a20738c97fcb3a2d23571e43
- SHA512 7e549ca9e9cef6ac8d57a217d33c2ddd099d67f607b5513b2323f666a85f17cdc7d10f01580480baa19f3f03a08a8b18d4805179133f5c4858d4e4dc0f4b3ce9
- SSDEEP 384:HUr7iO024YbCo6J+Sl1xDnZBPsac4j0lpDII+yh7hs:0SZYbCo0+Sl7zZlsac4ID8LD
- TLSH T1B8528EBA9F0138F92A27C195D9BD5244CE05E6BBDEE3C0A605143C04CA44BB9F0E64EE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 11KB
- SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
- MD5 25e8156b7f7ca8dad999ee2b93a32b71
- SHA1 db587e9e9559b433cee57435cb97a83963659430
- SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
- SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
- TLSH T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 502KB
- SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
- MD5 e690f995973164fe425f76589b1be2d9
- SHA1 e947c4dad203aab37a003194dddc7980c74fa712
- SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
- SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
- TLSH T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
- Size 31KB
- SHA256 fc6d70aa416a12de9f9835ddc474b87dbed782adeacc3d3a5a3907f6de81a10e
- MD5 4beba0769781ef728baa0aafb333a036
- SHA1 a11f6eee8b92ca85f9e85811022142a5b10c37bc
- SHA512 d96550a139f79ca817c05c1c2f1900818e4c08b891188393dfa463d5e349a0d3eee4c29bcabcff30b7984bcd5373d0ab5dc4846427375cab225acc3367f14f59
- SSDEEP 768:7EiiVwXCHceUHGcmhu1lVhKcy70yybxbtbH8H:CwXCHIVh7Y
- TLSH T1E3E21184FB2A953FD41512BBDCA50B042F79F88A58192F5B3A4C64686C872DC3E5E07F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 77769560015a5493e68ef46a881e7d0c24509261c68a29f16d17a75453d87973
- MD5 5a9112530796a4f6931117da55fa7ff7
- SHA1 bed60e2040d751acf68a7e8611456f7fc4942102
- SHA512 af70d100b43699ba4a7b10868da7e78a74b1fc1644a1ec8de019eb9821b6c89a3a6f09b6128677f8fb4e18622b4b67d9bbf162c4a9d0b16209b5850227cc8d2c
- SSDEEP 192:FdsmTh1d66JozGzgCl6mc0dKOv5zbo6aZbWyjOBp:td66JozGzgC1jHbo1ZbWyji
- TLSH T196E12FA4F628867FD404027BDCA61F814F3A389A984E7F15359C644C2D472DE7A8E1BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 b3df19fc38c2ba1845e6ee884a43e09c358929beb71e6789ff56fcab50b15dc5
- MD5 6aca3c8b3dfd4acd8650c7c109f1f539
- SHA1 17a32c103ce0a889a67f2f5cae2050afa5071f03
- SHA512 4e80adc60481336ac4866c4a673ee0266266ddb5640eb3e5671a111e5b92717b6be0155d3f4602cfa6114a83e1b113f464d0e7d302ecdc38c89352aafaf88537
- SSDEEP 192:FdsmTh1d66JozGzgCl6mc0dLOv5zboZaZbWyjOB9:td66JozGzgC1j+bo4ZbWyj6
- TLSH T11EE12EA4F628867FD408027BDCA61F814F3A389A9C4E7F15359C644C2D4B2DE7A8D1BD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\events\events
- Size 1KB
- SHA256 1b2e57d58ed28b7c62d24237e9ea3bcae422ac869b2f684294c607a74f61f21d
- MD5 ea0219fda650d96fd51cbb3b4a7b60f5
- SHA1 80472163840cd0a870cc5febb9affee4a7dbf2d4
- SHA512 c1b7f5c6792d0180a2b03d56f8f9215abd6788fc88d73ca676036ac51e867b110f774b66a650cc45e70b177dac55005eac3f80f45fdf4316cc759fa93a38a1ff
- TLSH T1BD21AC6E35B84DAA5EC7F29C744172CE5B55CE0B08C71C430D52EE8DCE81AE9326A43C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\0211b7e0-c72a-431b-9cc8-3c4147f1a068
- Size 886B
- SHA256 dd0de81eb72510ccffc21b868022f0d0b89a2387e054f4ab744caad0cd96d0cf
- MD5 055fa77ade255fe46b1c081b8243de79
- SHA1 2036b8d12aa11006eb743f674c6df58fbf87b027
- SHA512 790069c47bb49f1f67cd5f7f06ab8ceca18556d4299a03f924dea79a02a2f3b9d21019e532cdbd538b8a9f8799422c00a44bfe5db547a4031227237ceaf91ad3
- TLSH T19A110491D624BDF1DC6C928BF5E277424BF4B41390C75C543D604E1C0CBA51D9766607
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\4779441c-8791-41ee-b22f-dc751754aa22
- Size 235B
- SHA256 d31e70253b935a4a41faccce0b9e000acb3b97ca716053e651d489fcc8f6e3a5
- MD5 cb2e569ed373506a419073a9e5eee703
- SHA1 1772afa6aa720daadc13762aae13a84a89d83310
- SHA512 58f704187e04db7a00895f1445856ec572fc98a316b2f196c3f47ee634c1cd61031eab7e1fe1f13872daddd907bc0e43a40e6046fd01207c3d59b6d11fb7433b
- TLSH T1A9D0979028D8236E48144F4BF0E068D330888C7310A4A890C9618178EAFDAC853A1827
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\6e61b6ef-e3e8-4add-928d-d18d1f32ac58
- Size 883B
- SHA256 09d7b2fea361a05765c8d8c73d34c324ef577cac0cfb19c5f4ee7fc4d6f6c23a
- MD5 82a1f66b2df0e7c489437a2bb7dd40a1
- SHA1 e0c62c2d20b1f0bac2a6a1cc44d6717d85a03afb
- SHA512 aa5127be3c0baca29d2668238557d730cf79d2b634f74d656d2fecbfd2500d5fe273100860efa4b4ed0c4bf7ffa44e26a352f1534c4eb91190aae62679405e0b
- TLSH T1A6112790E23479F2DCACD24BD5513B42CFF4751380C958543D915E080C7E52E976A74B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\9e0e24ea-9ee0-4b96-85c6-6b9b5cf67853
- Size 15KB
- SHA256 c04a99780041acd5f89d15228d2844efb5e9c4511b46a1346dcc1ec84508f30c
- MD5 1a4aaad2eeaf6577df9cd5959ac24bb6
- SHA1 4033e5f68c1b1cf71c49a73d6b962b632d83b489
- SHA512 d89636bc459ddd18fb6d8aae9f95d1f736bc37c1d4d93a05c13fbb9891ddf67dd83fdaddc979a9e2e16da161450f8bac32058d2aa275c72787380d70c7533c01
- SSDEEP 384:uear0jz0LZ8L8jN7xYCdRiscrql5J4EOPglW6:uDYjALGXYOGW6
- TLSH T1C472C9562420497A8691E3A994FCBFC7E5F528CF4C418FCA9BE4BD086DDE06E112784B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\bdfeac16-2d39-46ea-9e5e-255a7415ea2e
- Size 2KB
- SHA256 3f1998b6a92de4ce5e80d387652f33995e33f70a91235db35df79c8deba249d6
- MD5 7ff43861d8ad5272c814f78ad609657a
- SHA1 464eb0581c85c7b86ae2b2bae3548119fd6522f4
- SHA512 6ce5e0231295e98a9220bde9028ad4092f315b3a881e488ef2c40ece78d4a55e7c60fbad3f1204ddec866ecb52d45d1f02eecb2546315fda80a7cd634681c92b
- TLSH T1FB41435877785DB79D9AF68EE091338E57A48D0310C21CC32E91DE0C8C9665D736A52B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\f1cb328c-0d12-48af-b8e4-8f3a795ecbd8
- Size 235B
- SHA256 7601987e53161290e4af26b34b1aba3ca41bc17389bcb320e1d34e70f57e0b30
- MD5 3c506a4496f4d4f76bdd657289aa6e8e
- SHA1 d2360fa602a93630499b834f660c5f1dd7f12122
- SHA512 2fbae36895d50da53bb183e7f4e33c6ec830dd655f4889e297d128a44e43ce33e4035c3e119ad84afff4b2c677314365114003bf28f483f1f166ae2951478b81
- TLSH T1E0D097D018A8AB2C08201F0BF0E028C23044CC3321B0EC30D6912138AAFAFC8035285B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\extensions.json
- Size 16KB
- SHA256 911d81f2ab508079de37297e2850fb40676255afe75ae3d39c3a5c29e7cb2dd5
- MD5 6dfe0cf35bb83f9cd967af99c8debec1
- SHA1 50b6e9e1fdb058e8d520f63c2b3e8db611ee5d74
- SHA512 7f6d976281b09eead7f56ccb68c1581ff5949c056641849134574c462106e4a3919dc7d83940c0fea3d3d49425b0fc1316f94e5764b768ff6d955bbc6261cc77
- SSDEEP 384:AkI4vyUmldvXf8dhWnV94z6196opL4HBL4PlL4HDL4HfL4H224hh:nI4qRf/0Xen4K6W454d4P4j4Z4z
- TLSH T13C72531545048EB8294FA79BAA367E01C37D433B60845C38F4DD8FC842FA5B902FB65B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
- Size 1.1MB
- SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
- MD5 626073e8dcf656ac4130e3283c51cbba
- SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
- SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
- SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
- TLSH T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
- Size 116B
- SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
- MD5 ae29912407dfadf0d683982d4fb57293
- SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
- SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
- TLSH T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
- Size 1002B
- SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
- MD5 dcffff15fa618a53834ee4ae8673bd23
- SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
- SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
- TLSH T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
- Size 21.6MB
- SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
- MD5 d14dd3f0107ff91c3e21f301d83f82b0
- SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
- SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
- SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
- TLSH T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs-1.js
- Size 8KB
- SHA256 c5ac7888302c458dfe33dac68c2a7b8090341b6e405e24619ebf7a5c0e2b418c
- MD5 16db57500f2eaf5595d965fac18ad834
- SHA1 ee263bddf1f1997d7a116422d43195218716258e
- SHA512 497b6b977c5eb2e4e5b3f7b8031118138fb14263ee8dfe3e1c2554ed572f4465e5eea35d927a5a11b5bfb43d6b7cc11065c19970e114fe5bf0e8af62cbf3eff9
- SSDEEP 192:9wLazff1RFfmOuzeCCSlISSPR74/3x9fJBw88OrWCsa1N5ag:vzRYwsB
- TLSH T17502FB78A404CF7F75B2366CAC248D715A72423BBBBF68D610B95485054CF3441FAAEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs-1.js
- Size 6KB
- SHA256 611592700521990847d19b1af7f7639971637317f194c0125b7e4cd71a3c366b
- MD5 75708b69ba26b83edb829785918939a1
- SHA1 73228266df07ced876a9a49b2cb569e7cdfb76ee
- SHA512 e74e4cfce3801223e601e43d1248528cb97f0b4184e34410a1aac28b56820c6fefb213c66f760d005d7f4c80cebb4d957a2d432c2aa973b7766d367ada630639
- SSDEEP 96:xHHUTUZfvqGqqkf+CC1zSwlISSlDdv9jtmnLHH4/39Bw88n8L4cn/MVzW:9QRFf+CCdlISS6H4/39Bw889g
- TLSH T165E12E7891088F7F64B677ACAC288D316AB2013BB7BF28D750B95484055CF3442F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs.js
- Size 6KB
- SHA256 b9338e3a2f46d45d5d780235319deaecdbb2420f53388d95fe1460384d121c52
- MD5 b6280c5a44e6c67c178cef257c90901c
- SHA1 79985fd18a4fc472c9bda5121190b16057276003
- SHA512 465d1afdffd7b671adf73a7f4d10905046aa8c20591bfa828ec5784cc81c31a27f6937b334be69e0013cd29956586bc2c1a854f60814cb9999245711370863bf
- SSDEEP 96:xHHUTUZfvqGqqkf++J1zSeSSlDdv9jRenLHH4/39Bw88n8L4cn/MVzW:9QRFf++JHSSGH4/39Bw889g
- TLSH T140E11F7891088F7F64B677ACAC6889316AB2013BB7BF68D750B55484054CF3442F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs.js
- Size 7KB
- SHA256 81ba2cba458eba229a855cddd26624698fbf2402e8e4f980b7bc084843d3c0e1
- MD5 ce758963eb868350b541cb38f7b32662
- SHA1 26e54cf7a0238bb3a52df99ea747fc92022e1330
- SHA512 8f8370b220274d1e8d468ba51bddfecbd9327f98c179be6073debe73f2c18b4008887954c4dd59f36850d878a26f4e0c5ccb59ae36f05c5d7964e55ffcebc487
- SSDEEP 96:xHHwLazffFTUZfvqGqqkf+CCObzSwlISSlDdv9jtmnLHH4/39Bw88Ou8L4cn/MVa:9wLazff1RFf+CCSlISS6H4/39Bw88Oag
- TLSH T1AFF11C789408CF7F74B277ACAC2889315A72013BBBBF68D610BA5485055CF3441FA6EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\sessionstore-backups\recovery.baklz4
- Size 4KB
- SHA256 7286cf1d7418ce6404fc7434a40db22f80f47d0d05942f699934a9dbdd0f54f9
- MD5 9fb5c13f0252e933fb9dacda5660ebe3
- SHA1 c1e5edbd92bf0a0df8ae5662651111631fdbbc6c
- SHA512 7f61dd6a07aca15c41d7c70290cd4d3a59bb34790ec98bac29c5d9f494b2c70e6b7a4ad3dd80929fb5b0ca74555bcb47a1bba8ac6ff7e73d1ccfb837b6ce869b
- SSDEEP 96:eaBfbt69VgScQeW9jILA0NjoB8kMJttn0YJZQBX:RpxPIOnNcB85JttnTZEX
- TLSH T1F7916C07370F28A7FD5B918FEE898CF105A4310A998188EC90CF2E1AB357A5B7559475
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\sessionstore-backups\recovery.jsonlz4
- Size 4KB
- SHA256 eabbca267c88dc9a054d9106988abbbc3ce9454f6de1350372d76a00c17e7691
- MD5 7a96b5d3708b4326f854d7e5cc0d1686
- SHA1 48360e378b1ac8d597055a7bf87c4481aad4cbb9
- SHA512 2aba2ed43c17608673aacbd99eb9d45c683db2a6340d6c572f96c3a38c147c00549cff7a99c45976cbe7250a06db1d49c51ed1eaf13b6e64ebc189211da6d9d7
- SSDEEP 96:eaBfbt69VgSKQeW9jILA0NjoB8kMJttn0YJZQB2:RpxdIOnNcB85JttnTZE2
- TLSH T182918D07370F28A7FD5B818FEE898CF245A4310A988188EC90CF3E1A7357A4BB158475
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 6.2MB
- SHA256 de22e69728826beb63524e7c96219e2dd01b08ea56cb2965f3a49140acee74e6
- MD5 acb2b60319eddb5fb61db81af3b06430
- SHA1 12c105b117efd678ef2b902a8a643a5880a12a7e
- SHA512 cd7c40c38075ad22d4898eba8f77eea4263f2e48f3a7dcfbca84e4ad86c78ff106270e19cf2b78b331ac1942811e64c71a7950736e6d4d76db109673aa0be851
- SSDEEP 49152:ALqLyIaeUq6QC5zYYCWeTrWDxAEaWYoXGVoXTs81lww2Z3c2y9SgCuKVsQjrXS8k:dS/9ouKVsQjrXS80OgFehB0
- TLSH T125666CE420E29252F38140B3719A53FB11EFC01C6076CE44579896FAA5B8CEB4E977BD
- MD5 SHA1 SHA512 SSDEEP TLSH