Analysis
- max time kernel
149s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
29/06/2026, 22:31
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
28 signatures
150 seconds
General
- Target 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe
- Size 5.8MB
- Sample260629-2fnteahy3p
- SHA256 c2268a803009e141a2983e6e72a1ee0b1253ad90913e713df788b4f74537b53f
- MD5 4e168ccbe078c40ed084e50074f4a137
- SHA1 23203c755571baea4fe466f6e3a8103ba9d81f24
- SHA512 60bf755ed079c4f55bb878ecf81bf678fa5709647a75021392d7cd591a5c09d90fe888e545445a2b444b6fa6d7719feb2f4faddc82dca473461779a12ad49742
- SSDEEP 98304:qXyG3idUePTieuf5P4fmF18frP3wbzWFimaI7dloYiD:qAUYTivkgbzWFimaI7dl+
- TLSH T1FA569D51BF8D817AC95A1130172DAF2A402ABCA8773465D3B2743E7DEC753C26C3A61B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Floxif payload 1 IoCs
resource yara_rule behavioral1/files/0x000b000000024037-1.dat floxif - Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 5 IoCs
resource yara_rule behavioral1/memory/3036-10-0x00000000000C0000-0x0000000000691000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/3036-388-0x00000000000C0000-0x0000000000691000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/3036-399-0x00000000000C0000-0x0000000000691000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/3036-751-0x00000000000C0000-0x0000000000691000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/3036-753-0x00000000000C0000-0x0000000000691000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers - Detects executables containing SQL queries to confidential data stores. Observed in infostealers 5 IoCs
resource yara_rule behavioral1/memory/3036-10-0x00000000000C0000-0x0000000000691000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/3036-388-0x00000000000C0000-0x0000000000691000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/3036-399-0x00000000000C0000-0x0000000000691000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/3036-751-0x00000000000C0000-0x0000000000691000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/3036-753-0x00000000000C0000-0x0000000000691000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore - UPX dump on OEP (original entry point) 9 IoCs
resource yara_rule behavioral1/memory/3036-3-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/files/0x000b000000024037-1.dat UPX behavioral1/memory/3036-12-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/3036-316-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/3036-389-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/3036-516-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/3036-729-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/3036-737-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/3036-752-0x0000000010000000-0x0000000010030000-memory.dmp UPX - A potential corporate email address has been identified in the URL: [email protected]
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000b000000024037-1.dat acprotect - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe - Loads dropped DLL 1 IoCs
pid Process 3036 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe /onboot" 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe - Drops desktop.ini file(s) 3 IoCs
description ioc Process File opened for modification C:\Users\Admin\Documents\desktop.ini firefox.exe File opened for modification C:\Users\Public\desktop.ini firefox.exe File opened for modification C:\Users\Public\Documents\desktop.ini firefox.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\e: 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe - Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe -
resource yara_rule behavioral1/memory/3036-3-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/files/0x000b000000024037-1.dat upx behavioral1/memory/3036-12-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/3036-316-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/3036-389-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/3036-516-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/3036-729-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/3036-737-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/3036-752-0x0000000010000000-0x0000000010030000-memory.dmp upx - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\System\symsrv.dll 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe File created \??\c:\program files\common files\system\symsrv.dll.000 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Checks processor information in registry 2 TTPs 20 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243" 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A} 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Low Rights 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4} 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3" 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe" 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3" 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006} 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe" 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm" 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe" 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3" 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe - Modifies registry class 16 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter" 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\WOW6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D} 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan" 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe" 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User" 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1" 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Model = "180" 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Therad = "1" 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD} 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3036 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe 3036 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe 3036 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe 3036 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe 3036 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe 3036 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 3036 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe Token: SeRestorePrivilege 3036 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe Token: SeDebugPrivilege 3504 firefox.exe Token: SeDebugPrivilege 3504 firefox.exe Token: SeDebugPrivilege 3504 firefox.exe Token: SeDebugPrivilege 3504 firefox.exe Token: SeDebugPrivilege 3504 firefox.exe - Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 3504 firefox.exe 3504 firefox.exe 3504 firefox.exe 3504 firefox.exe 3504 firefox.exe 3504 firefox.exe 3036 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3036 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 3036 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe 3036 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe 3036 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe 3504 firefox.exe 3036 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe 3036 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe 3036 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe 3036 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe 3036 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe 3036 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe 3036 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe 3036 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe - Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 3036 wrote to memory of 4784 3036 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe 92 PID 3036 wrote to memory of 3600 3036 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe 96 PID 3600 wrote to memory of 3504 3600 firefox.exe 97 PID 3600 wrote to memory of 3504 3600 firefox.exe 97 PID 3504 wrote to memory of 4472 3504 firefox.exe 98 PID 3504 wrote to memory of 4472 3504 firefox.exe 98 PID 3504 wrote to memory of 4472 3504 firefox.exe 98 PID 3504 wrote to memory of 744 3504 firefox.exe 99 PID 3504 wrote to memory of 744 3504 firefox.exe 99 PID 3504 wrote to memory of 744 3504 firefox.exe 99 PID 3504 wrote to memory of 744 3504 firefox.exe 99 PID 3504 wrote to memory of 4884 3504 firefox.exe 101 PID 3504 wrote to memory of 4884 3504 firefox.exe 101 PID 3504 wrote to memory of 4884 3504 firefox.exe 101 PID 3504 wrote to memory of 4884 3504 firefox.exe 101 PID 3504 wrote to memory of 936 3504 firefox.exe 102 PID 3504 wrote to memory of 936 3504 firefox.exe 102 PID 3504 wrote to memory of 936 3504 firefox.exe 102 PID 3504 wrote to memory of 2192 3504 firefox.exe 103 PID 3504 wrote to memory of 2192 3504 firefox.exe 103 PID 3504 wrote to memory of 2192 3504 firefox.exe 103 PID 3504 wrote to memory of 2192 3504 firefox.exe 103 PID 3504 wrote to memory of 5260 3504 firefox.exe 104 PID 3504 wrote to memory of 5260 3504 firefox.exe 104 PID 3504 wrote to memory of 5260 3504 firefox.exe 104 PID 3504 wrote to memory of 5260 3504 firefox.exe 104 PID 3504 wrote to memory of 5492 3504 firefox.exe 105 PID 3504 wrote to memory of 5492 3504 firefox.exe 105 PID 3504 wrote to memory of 5492 3504 firefox.exe 105 PID 3504 wrote to memory of 5492 3504 firefox.exe 105 PID 3504 wrote to memory of 5500 3504 firefox.exe 106 PID 3504 wrote to memory of 5500 3504 firefox.exe 106 PID 3504 wrote to memory of 5500 3504 firefox.exe 106 PID 3504 wrote to memory of 5500 3504 firefox.exe 106 PID 3504 wrote to memory of 5512 3504 firefox.exe 107 PID 3504 wrote to memory of 5512 3504 firefox.exe 107 PID 3504 wrote to memory of 5512 3504 firefox.exe 107 PID 3504 wrote to memory of 5512 3504 firefox.exe 107 PID 3504 wrote to memory of 6080 3504 firefox.exe 108 PID 3504 wrote to memory of 6080 3504 firefox.exe 108 PID 3504 wrote to memory of 6080 3504 firefox.exe 108 PID 3504 wrote to memory of 6080 3504 firefox.exe 108 PID 3036 wrote to memory of 1712 3036 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe 112 PID 3036 wrote to memory of 3068 3036 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe 113 PID 3036 wrote to memory of 4072 3036 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe 114 PID 3036 wrote to memory of 1912 3036 2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe 115 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-25_4e168ccbe078c40ed084e50074f4a137_darkgate_elex_floxif_glassworm_remcos_stop.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:4784
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html2⤵
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html3⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2008 -prefsLen 27099 -prefMapHandle 2012 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {67af3068-ad66-4705-bcfe-778a6d054e8e} -parentPid 3504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3504" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu4⤵PID:4472
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2496 -prefsLen 27135 -prefMapHandle 2500 -prefMapSize 270279 -ipcHandle 2508 -initialChannelId {84afa589-a5c7-4ce1-99d1-defb9fe37184} -parentPid 3504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket4⤵PID:744
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2936 -prefsLen 25213 -prefMapHandle 3032 -prefMapSize 270279 -jsInitHandle 2944 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3040 -initialChannelId {680ca5bd-2772-4a24-a6b1-09375c1127ef} -parentPid 3504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab4⤵
- Checks processor information in registry
PID:4884
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3812 -prefsLen 27325 -prefMapHandle 3816 -prefMapSize 270279 -ipcHandle 3040 -initialChannelId {2f3990f7-c019-4f6b-b4ae-43e227a87e39} -parentPid 3504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3504" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd4⤵PID:936
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4416 -prefsLen 34824 -prefMapHandle 4420 -prefMapSize 270279 -jsInitHandle 4424 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4432 -initialChannelId {ecfc702a-e036-4d12-b6fd-3c114b2de79d} -parentPid 3504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab4⤵
- Checks processor information in registry
PID:2192
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4944 -prefsLen 35012 -prefMapHandle 4948 -prefMapSize 270279 -ipcHandle 2988 -initialChannelId {56a0b2cb-693b-4d09-8b48-1b156798e6f3} -parentPid 3504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility4⤵
- Checks processor information in registry
PID:5260
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1636 -prefsLen 32952 -prefMapHandle 5112 -prefMapSize 270279 -jsInitHandle 5100 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5088 -initialChannelId {37ae8ff2-b2a7-4264-ac22-4d5a0e60131a} -parentPid 3504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab4⤵
- Checks processor information in registry
PID:5492
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5184 -prefsLen 32952 -prefMapHandle 5188 -prefMapSize 270279 -jsInitHandle 5192 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5200 -initialChannelId {9d417936-1aa9-493e-bcb8-f1e0aa0a2e88} -parentPid 3504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab4⤵
- Checks processor information in registry
PID:5500
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5568 -prefsLen 32952 -prefMapHandle 5572 -prefMapSize 270279 -jsInitHandle 5576 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5584 -initialChannelId {2faff743-84e7-49d2-bb5b-18beb800df83} -parentPid 3504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab4⤵
- Checks processor information in registry
PID:5512
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4020 -prefsLen 32952 -prefMapHandle 3744 -prefMapSize 270279 -jsInitHandle 3732 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3712 -initialChannelId {b8489ba8-f9f7-44f0-a50b-a1288cbc4d83} -parentPid 3504 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3504" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab4⤵
- Checks processor information in registry
PID:6080
-
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:1712
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:3068
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:4072
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:1912
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\System\symsrv.dll
- Size 67KB
- SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
- MD5 7574cf2c64f35161ab1292e2f532aabf
- SHA1 14ba3fa927a06224dfe587014299e834def4644f
- SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
- SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
- TLSH T17863F1372AB5807DDD210D37949F835AB771E5A76C20643FC25907D988B8DD0E3239AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\System\symsrv.dll.000
- Size 114B
- SHA256 aefc503b1ed462d7b6280228a7b5b710792273b78934426f88325341ac5b5a92
- MD5 e609411db8aa6775d0344c75c23ae79b
- SHA1 1d2ff6194bf159ce36cd0461cd3da29486d1e97d
- SHA512 6884ff5c07bc687132c965a59cb8c5a898a25da74c6c846c1d6089ddca8007cb7e4d2f8520bdce9fbcf6e2f9c9e5c28d8c8d6d049d3522470bdc7d38bbfa0ad0
- TLSH T1FFB09262AA2791EAE1AA224505A0248C1ED0B62AB48638002EBA5A4E93256A85916147
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\cache2\entries\03100235E7AEBB25C597DD91664A8F544DDFC529
- Size 13KB
- SHA256 6984f95870a59c4f6c70bb6a2dd0666c28b4c10625d304c491412aa060256c72
- MD5 9dde43e14edcf75c170d8928f16c92cb
- SHA1 1e9aae3f22201f65008ef82625458e54db901e7a
- SHA512 07172006addfd580411156ebeb2660ee7f9416a115ebb0dec84fc70bc2fc6669213d49533b4e19e1e8ead35b71e8f4a02ee8c42f366f7ddaa83c00baeb3a239e
- SSDEEP 384:HPC9iO024Yvo6J+Sl1xDnZBPsac4j0lpDII+yXG:v9ZYvo0+Sl7zZlsac4ID8LN
- TLSH T186529EBD9F0238AA1927D1A5E5BE9258CD04E7BBDEE2D05619143C04CA447BCF4E68CF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
- Size 13KB
- SHA256 02894358d053c24b87084ae09f2db4d5988c0decb8b6b4217fd4413d095fed04
- MD5 866b9a8ac00dd8bd253b76c74c65c77d
- SHA1 582aad01e8e0fa984e86ef2bdcd0a16818071c62
- SHA512 2409fff5017e3336a0bcf66efb8532a6f87bc5fd8986755843546854d316291492b9fb60ee7cdbd0676ced9f2fe87919c25390d2424a67a2fe632c217684d677
- SSDEEP 384:H9XghOiO024YJo6J+Sl1xDnZBPsac4j0lpDII+pI5Ig:dX+ZYJo0+Sl7zZlsac4ID8LpEx
- TLSH T1D6528DBA9F0138AA1D57D090D8FD9255CD04ABBBDEE2D0961A143C44CA847B9F4E64CF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\9b1a5419-2814-4e3c-855f-859b87d7531d.zip
- Size 3.7MB
- SHA256 d594c4c1e82d2293c2996e1a0d9f687db132fc85335d037bf53ae54d0d2bf4e5
- MD5 85be32534f6db5e64f5fe96dd890234e
- SHA1 43b8d5861b73ce5184717c7e31e93d5b10b3adeb
- SHA512 1945d9efdc163ad64cbe3001456324768022556704ff3d8a99a1bb42f1a820c76a3daf1e3707a1ca7b59af452fbf5b7b084086b206c57a2fa930078f468b0ce5
- SSDEEP 49152:MtrhrApFrJipqGsR2ubf9PvX1ccJkYhcqIqKDWl2YGAqS42PH1Uqcxhcq2MzcwMD:MtruGLUNX17ZgDWl9GA9Pl6Tzcw1s
- TLSH T1B406F175D69C1A09CDCF83BE850C2FC2987C4FA68054A96BFA6F99715CA33E61F448C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 11KB
- SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
- MD5 25e8156b7f7ca8dad999ee2b93a32b71
- SHA1 db587e9e9559b433cee57435cb97a83963659430
- SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
- SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
- TLSH T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
- Size 502KB
- SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
- MD5 e690f995973164fe425f76589b1be2d9
- SHA1 e947c4dad203aab37a003194dddc7980c74fa712
- SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
- SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
- TLSH T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
- Size 32KB
- SHA256 95fb34f74de5fbc935e5d279917294d095461eda0bb77dfeabc3f59b2d292852
- MD5 e7eb0d45a26be4b86b84c66c5d457ab9
- SHA1 cbd213a78c0eb7223e801ee98a27c93c25b55ff5
- SHA512 4e74304622436b100a638a224f816296517026c47f5b66e7adc17d57584ab70e10ec64a2d102c4e6088cf26cf2ba2c3d7754b47e20cc190bdf5eede2c61d00ff
- SSDEEP 768:xEiZ2OBL3+gxoSS7UHGcmhuvp/KdBWjcYbwbYbSWH:qOBL3+gxoRsp/Si
- TLSH T1BAE22284FB2E953FD41512BBDCA50B102F39B88A591A2F573A4C64686C872DC3E5E07F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
- Size 32KB
- SHA256 50b4d64708aa229a14dd6aee5a48323267e643a78f8f3d47e2541867d7e3530c
- MD5 d49ff6d0cc8aa685a6513079987265ee
- SHA1 d0f00dff3739450256a2e1da1e2c26aa44a6ec2d
- SHA512 7466af1e0aee44a6e66532a8a063c6a5fc64aaec44947a0e4de5ec495f95bd5b4ce0175af36fd889377752270a8b79b5f1bcc51c29d53cf9667a6d323cc836f0
- SSDEEP 768:fZ2OBL3+gxoSS7UHGcmhuvp/KdBWjcYbwbYbSWcE/:oOBL3+gxoRsp/SY
- TLSH T12AE22284FB2E953FD41512BBDCA50B102F39B88A591A2F573A4C64686C872DC3E5E07F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
- Size 32KB
- SHA256 934f78a35dd1f8c51cec92f4a92e22c4dfb8da213d5b0b0472b5f68533e9f536
- MD5 5957488b7dc93b0bccaf3cacd85d373c
- SHA1 f4b20db70a4c5c8e69833caa6c7278304276575c
- SHA512 7a7851b871a69bfaa098725b3efa16b86efb19868d990e7b9efd65e250e98a690919503207a145b4e1031f64a0001e53ffaf781d465c18993f8d5909dfd96bd9
- SSDEEP 768:KOBL3+gxoSS7UHGcmhuvp/KdBWjcYbwbYbSWcEiZ2:KOBL3+gxoRsp/SC
- TLSH T1A8E22284FB2E953FD41512BBDCA50B102F39B88A591A2F573A4C64686C872DC3E5E07F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 4788bc358e704a9010d73f1791bc5d1dfb632a4ff27d16dec6f6f56f8b30e776
- MD5 d21cf24b9733796488cae2f688fc8c61
- SHA1 f13f4b49f2e654f14e237c7ba4326ef7bb08a3b5
- SHA512 80bacf1a214339309accbce56d15d512899df625c8d51ad8a76fe82631ad274e84fdeccd97f21007967abcb8e001ad688a1dc3cde1314d3c9b6b6d8be100357a
- SSDEEP 192:bFtgD1d66JozGzgCl6mc0dLOv5zboOqZbWyjOM:kd66JozGzgC1j+boDZbWyj
- TLSH T126E11E64E628863FC409137BCCA21F814F3A389AD84E3F1535DC64482D5B6DE7A8D1BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
- Size 7KB
- SHA256 93e91293f052f8388cfe270b4ddc3e280dddbd5b71dc02628b74397444089fa2
- MD5 41846b481c2d418da8ec6dd16db5f5d6
- SHA1 09d5f377f7fbbed6a8335928faf1e9a21a6837c5
- SHA512 47721255e5d17e71f033c7a4eafcbb859f16e5a4f31e3986cec03073df38b4ea0e58d9f46f6baef415b5628431a7cee917d1a79970aade4a1d79dbc9c88d80e9
- SSDEEP 192:YRtgD1/66JozGzgCl6mc0dNOv5zboPCbWyjOQ4:B/66JozGzgC1jsbo6bWyjg
- TLSH T1A5E11064E628863BC009137BCCA60F810F3A389A9C4E7F1935DC644C2D976DD7A9E1BD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\events\events
- Size 1KB
- SHA256 083824a798ce6fc2a35f236ae5587dd75cad9fcb774e257c256c89897507b68a
- MD5 00764b085c898aa9eb6287fb14f60540
- SHA1 3fac1048c21610937258bd748ba06cbb7182f094
- SHA512 384b1474833c6947f393e35f523d58d2bbf78bef795d08eefbde928570ecba006eb93bc0c4f5dee485aab4c53895940ca6eed26980891edbdb03f00ea1b363f7
- TLSH T1BA213A5C3EF88D6A9C87F2DC7485028E53958E0746871D434E52EF8DCFA2AD9326E438
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\1aa86132-18b9-4b37-ad60-7fb1746103c3
- Size 883B
- SHA256 26652699b03b06bf8f8bc58d7377f11cea8a8dbca3feb20c5377ce95f1258d7a
- MD5 d89f0db0cdd91a4154285459dab09fcb
- SHA1 f35ad18e5f5d0e2db2861e21d341f7e4b0985f46
- SHA512 7f4c7c71ecf331681d7212325f5215ad367b4358c30c40ab400e053754002fb79e04f600ef9d86f64b0b5b19344318689f5c1405bb6c14a2ea3d417bbef15ce3
- TLSH T183112340E638BAF2CC6C924BC5A13B528FF4B01380C658107EE01E140C7EA1EA77974B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\2c6ded42-c98e-40cf-8c27-e8afe55fe6b2
- Size 886B
- SHA256 26d2e01e26ca87b14dd3a49cf8c766172db9b2cb90b575d4b730069316989add
- MD5 066281bfb94608bdd15200e11ebc79f1
- SHA1 f7259587e75085161c0f84c2c9a19020c6922ea8
- SHA512 b8bbf5e9a4aa7b25ec0cd5b8a51a819453217e03bec1035bba42223607d02de670f43136d7b01b12f7cfcc6d7256b9954c04d7dc7bb163ef3bb190b0572403e7
- TLSH T17E110050A639BAF2CC78A28BE4A1B7528BB57023C0C619147EA05F180DBA51D6776B0B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\38ce6374-ead1-4a82-ba4b-962f3ad9aa67
- Size 2KB
- SHA256 3e891a32eb7f32e7f65de29d83f4cea3c7f6c91891ca7b9e59cafe215560c358
- MD5 20720f63c6a34b2961e32cc9a354ed4f
- SHA1 44543f7efb061ab9e0b026d755784cbbd64ce947
- SHA512 4a475828ce4a280e2b0274cc6a7356040901b5dc80d7996364e3b74c77ad6131ff52481f7fd4df4f4fb98ad4d4152efd495b05c06cd7634a16b2860413bcacf3
- TLSH T10B41131875785CB698EAF18DD442238E57604D1310C72CD32E51DF4C8CDA65E336A46A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\41750536-1142-4ea5-8405-fbe592034b97
- Size 235B
- SHA256 368e45adb7936b108e60da55dd04d9eea93e22f9e20d7af872aa6f9ddaaf12bd
- MD5 bed884512d3b2649f8ffa7d16e53225f
- SHA1 b1613fc7bbe58ee09099c9b1f137a52293de1044
- SHA512 a18552a6087c38091d128f4a0bdb2c6ee6d599ec53dc2ca6d3d000846cdecfaae63025741b44564cbb142e3741ea4b459cb1e9daedb4afaab4273626d1cd5e31
- TLSH T1B5D0A789189C675D0C144F06F0A06AD774598C3B1879A820EA514578AAFEFC942E2917
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\581f54a4-1d8b-4b99-8935-1f6272661ee1
- Size 235B
- SHA256 90989f53b5b30288ac4d69062707b45f63b5cecd101091b2e7164421846929ee
- MD5 9e56b7432a953a00a3b7cee823052f9d
- SHA1 87e8aa0306a170be68717606c81750888fbffc04
- SHA512 a763790e094d394d816cb91c87d7687e0ee2a9db357e2ba0700c9a4d8a7695f5605e1ab92911b7acfbac7869258281417e462dc5eb5b02b408950d7fb0ef2550
- TLSH T171D0978028AC239E08040F07B0E07DC732444C3310B45854DAA144358ABE9C82151917
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\9e708fc4-6586-4313-82d3-d63ea50a7bd3
- Size 15KB
- SHA256 1f1e95d2a393c71af81e65aeefaf7d9368e59516734183d9c75ed3f991a3892d
- MD5 8874f0126aec4617e29c7b60d3839bdf
- SHA1 a3bad70c4138b854146cd9d6421beb1c2a11f07d
- SHA512 1da8e2c4e85d139061092dbc3345d8379b4b20f4c2f50deb00a01fa93ab6aba625fe97a4f9d288608bbf818bdb7488e02ad168f5e9b80606223311687ceb0ef4
- SSDEEP 384:PkKf+0KHkR9EYMwPx3/NmCy9TSHH1SVMiC:DKHOawSCy9A
- TLSH T1EB72B8166820497A8691E36994FCBFC7E1F528CF4C419FCA9BE4BD086DDE06E112784B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\extensions.json
- Size 16KB
- SHA256 1b2e42d451c79c0f9bf49a5c57de04520d8a49e3cc2aed9699e400a6543fc705
- MD5 e85d18f280dca42e41e6a5826a0b9fa7
- SHA1 c8f4446438ef9aa53f665576e5535aea4eed0814
- SHA512 c1bdba2f141a9917c7eb4ec9a10f22102bef2576ae046d2889fbf6d69d749b82569b2835f62cd5a8cf30f102b079a7244c4c3d3bd058f90878e9d1e7830b32cb
- SSDEEP 384:AkI4vyUmldvXf8dhWnV94z6196opL4HBL4PlL4HDL4HfL4HAI4hv:nI4qRf/0Xen4K6W454d4P4j4t4R
- TLSH T14672521545448EB8298FA79BAA367E01C37D433B60845C38F4DD8FC842FA5B902FB65B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
- Size 1.1MB
- SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
- MD5 626073e8dcf656ac4130e3283c51cbba
- SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
- SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
- SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
- TLSH T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
- Size 116B
- SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
- MD5 ae29912407dfadf0d683982d4fb57293
- SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
- SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
- TLSH T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
- Size 1002B
- SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
- MD5 dcffff15fa618a53834ee4ae8673bd23
- SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
- SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
- TLSH T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
- Size 21.6MB
- SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
- MD5 d14dd3f0107ff91c3e21f301d83f82b0
- SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
- SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
- SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
- TLSH T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs-1.js
- Size 7KB
- SHA256 77ca1a6290e7ffb9d36c09b0d3973be7e7122f1c5f06b5ef83c051c096e1beb9
- MD5 c0a4accbab4be373818beafbe96f1588
- SHA1 0569e8a7d622cd84d42800a4f9d1d1f132fea739
- SHA512 5cbedaa993e25cf2071dea5b7989f39c2fecc481137f6d53e66a260992ef628c985112e6efd3b43e53207e6a2fcedcac8af0111fb68073e0303484445e73edfe
- SSDEEP 96:xHH9TUZfvqGqqkfbdvObzSXBSSlDdv9jnnLWRAcL4/3iZBw88y/8L4cn/MVzW:99RFfbdvlBSSIRd4/3iZBw88yFg
- TLSH T120F12D789544CF7F68B236ACAC288C315A72023BB7BF68C610B98495051CF3445FE6EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs.js
- Size 12KB
- SHA256 5cd1b918974900dca5a0aab1f5fa2ba80231a72d43d9df3bd08aa7e3497fe9a8
- MD5 3baeb0ae7f0ec99db21f3af3cec62de7
- SHA1 63d51d44886d800c1f6e3c47885935e304dfd6b4
- SHA512 17651f8308a4aaf71f662e0fb94f323737309be09276a56fdd45b61ccd55523f96311e8b18bb472f88d4e1da05d3c79f77c370508d9bec9c69f0abd00d626da5
- SSDEEP 192:/9RFfbdvlBSS7LRd4/3iUaOBw8813wFIx9B:9TR4wVDd
- TLSH T14A42DE3C5680CB3F28B2367DAC294D7119510227B7BFBCD606F884A2455DF2485FAAE7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs.js
- Size 7KB
- SHA256 3e457159dec90531cd6b495aab78c1bb42577cdc95ae985ce0ed511c59c06865
- MD5 c669f307379e1c62fe816144f2fd4df4
- SHA1 95925762a3cf9d11dac70409536f9943295c574b
- SHA512 70509bd726053744bd1382afa62c1dde01490a63f594500dda47bf2aa1e207c195f64b924b8c5c29aaf7a72193e8af6a74d56bab76d42dc2af4fd6e333127650
- SSDEEP 96:xHH9TUZfvqGqqkf+dvObzSXBSSlDdv9jnnLHH4/39Bw88J8L4cn/MVzW:99RFf+dvlBSSBH4/39Bw88fg
- TLSH T1B9F11D789548CF7FA8B237ACAC2849315A72013BB7BF68D610BA4494051CF3445FE6EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs.js
- Size 6KB
- SHA256 817056d0dd0adfc8c78f26015853efb4afcd94b950152afa94ab59b69c158dfa
- MD5 62442f45cd15ce6cc1e58cb1be5ab473
- SHA1 11192f624ae1ba11630e50e4411525924ba9db83
- SHA512 69b95987034ccb4d2ea5e10d2b4b88465e3ed9b129de7db9e85237ab672d12eb67db16aee7f649c6473de1b8bbe8e0d547af37559934b2527c5a98d93572c2a3
- SSDEEP 96:xHHUTUZfvqGqqkf+lV1zSXdSSlDdv9jdnLHH4/39Bw88n8L4cn/MVzW:9QRFf+lVKdSSbH4/39Bw889g
- TLSH T1A7E12D7891088F6F64B677ACAC288C316AB2013BB7BF28D650B55484054CF3446F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs.js
- Size 6KB
- SHA256 5033bbf358f2aa87d368b34d0d8de00a069bf1b060df0611d5c42f89bceec89c
- MD5 030c785c8b759b61ca1e7a4b5fa54509
- SHA1 209790155930eb4450c4edd7721fb758aa4aa482
- SHA512 2c1fe41690c5d016a9d888e5ffeb59929a47f2c4b4721c2714f1cba3844f4a2c556ca9cee3d9772b3ee9268ba19f8d1e9f6408d284a2d1ce65d280b0fd767381
- SSDEEP 96:xHHUTUZfvqGqqkf+dv1zSXBSSlDdv9jnnLHH4/39Bw88n8L4cn/MVzW:9QRFf+dvKBSSBH4/39Bw889g
- TLSH T19EE12D7895088F7F64B677ACAC688C316AB2013BB7BF28D750B65484055CF3442F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\sessionstore-backups\recovery.baklz4
- Size 4KB
- SHA256 ee4b0c89cdb5f65e2fb0f8562b0e6888d9057f37ac27c3c11757a8c68b0da501
- MD5 b3bf290b1e444bba6db58c05ba1c90af
- SHA1 28688b512735dab46182319e607b966d508804dd
- SHA512 328a76dde567d2cfde4b7f97b01d4a65591581da88f256e7eb4d66b18558a0a4e6cf669709e6564c56472fdfe76c79b95a03b4a3f234a612d5b6efef779b046c
- SSDEEP 96:e0Hfbt69VJX/sw2QeW9jILA0NjoB8kMJttn0YJZQBpU:bx0aIOnNcB85JttnTZEy
- TLSH T132918D07361B28A7FD67818FEE994CF206A4310A5C8084EC90CF3E5AB36BB5B7459475
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\sessionstore-backups\recovery.jsonlz4
- Size 4KB
- SHA256 47cc76422f3fa9cd20e6391756e5b523f512b94c21825de132ae4d3d233e8ac3
- MD5 f7e950c5718061c08a8b85d3bc849be4
- SHA1 ae705b3e9f7d1cc5aae5f97d1e85e48412546b4b
- SHA512 4e81be4538a182903bcd4155a175fe13f4bf35e24c6faf78bf2acf2dcadc22b07f1f947ddae85f6c21b9bd713af2481805773b08d03afec0bcb0ff6012b2ed13
- SSDEEP 96:e0Hfbt69VJX/swlQeW9jILA0NjoB8kMJttn0YJZQBpm:bx0hIOnNcB85JttnTZEk
- TLSH T1DB918D03361B28A7FD57858FEE9A4CF246A4310A9C8084EC90CF3E16B36BB4BB559475
- MD5 SHA1 SHA512 SSDEEP TLSH