29cc4afc5d3c89ad2c2d1213269a843a28cb53f678a3234b5fadf99e3ade4b61

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/07/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Size 5.8MB
Sample260728-e8e1msbj2z
SHA256 29cc4afc5d3c89ad2c2d1213269a843a28cb53f678a3234b5fadf99e3ade4b61
MD5 9c67ce60d6741c6d0a5a168d5a6546a9
SHA1 3a3552cad43e4101e8938592c5dfd1a768fbf37b
SHA512 acb55678bf56348dee1fa106b094733f8644f39402857835f2d4e2f3441015b212ae7aa76a77f625626baca9488f9502301bf30aac4d7bce9ca1ce5d9481ef84
SSDEEP 98304:30LgFQU3xyyj6P4eR8qLf3gbz2FSmaI7dlmg:PQU3AyjeQbz2FSmaI7dl
TLSH
T133569C52BF4CC176CA5A2570172DAF2A502DBD25773915C3A2783E7EDC313C2683A61B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery persistence phishing spyware stealer

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe /onboot"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies Internet Explorer settings 1 TTPs 22 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\Low Rights	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe

Modifies registry class 17 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Therad = "1"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\WOW6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Model = "208"	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	2832	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
Token: SeDebugPrivilege	564	firefox.exe
Token: SeDebugPrivilege	564	firefox.exe
Token: SeDebugPrivilege	564	firefox.exe
Token: SeDebugPrivilege	564	firefox.exe
Token: SeDebugPrivilege	564	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
564	firefox.exe
564	firefox.exe
564	firefox.exe
564	firefox.exe
564	firefox.exe
564	firefox.exe
564	firefox.exe
2832	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2832	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2832	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
2832	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
2832	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
564	firefox.exe
2832	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
2832	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
2832	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
2832	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
2832	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
2832	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 2816	2832	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe	86
PID 2832 wrote to memory of 1732	2832	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe	88
PID 1732 wrote to memory of 564	1732	firefox.exe	89
PID 1732 wrote to memory of 564	1732	firefox.exe	89
PID 564 wrote to memory of 4564	564	firefox.exe	90
PID 564 wrote to memory of 4564	564	firefox.exe	90
PID 564 wrote to memory of 4564	564	firefox.exe	90
PID 564 wrote to memory of 548	564	firefox.exe	91
PID 564 wrote to memory of 548	564	firefox.exe	91
PID 564 wrote to memory of 548	564	firefox.exe	91
PID 564 wrote to memory of 548	564	firefox.exe	91
PID 564 wrote to memory of 744	564	firefox.exe	92
PID 564 wrote to memory of 744	564	firefox.exe	92
PID 564 wrote to memory of 744	564	firefox.exe	92
PID 564 wrote to memory of 744	564	firefox.exe	92
PID 564 wrote to memory of 1112	564	firefox.exe	93
PID 564 wrote to memory of 1112	564	firefox.exe	93
PID 564 wrote to memory of 1112	564	firefox.exe	93
PID 564 wrote to memory of 4468	564	firefox.exe	94
PID 564 wrote to memory of 4468	564	firefox.exe	94
PID 564 wrote to memory of 4468	564	firefox.exe	94
PID 564 wrote to memory of 4468	564	firefox.exe	94
PID 564 wrote to memory of 2968	564	firefox.exe	95
PID 564 wrote to memory of 2968	564	firefox.exe	95
PID 564 wrote to memory of 2968	564	firefox.exe	95
PID 564 wrote to memory of 2968	564	firefox.exe	95
PID 564 wrote to memory of 4572	564	firefox.exe	96
PID 564 wrote to memory of 4572	564	firefox.exe	96
PID 564 wrote to memory of 4572	564	firefox.exe	96
PID 564 wrote to memory of 4572	564	firefox.exe	96
PID 564 wrote to memory of 1800	564	firefox.exe	97
PID 564 wrote to memory of 1800	564	firefox.exe	97
PID 564 wrote to memory of 1800	564	firefox.exe	97
PID 564 wrote to memory of 1800	564	firefox.exe	97
PID 564 wrote to memory of 1408	564	firefox.exe	98
PID 564 wrote to memory of 1408	564	firefox.exe	98
PID 564 wrote to memory of 1408	564	firefox.exe	98
PID 564 wrote to memory of 1408	564	firefox.exe	98
PID 564 wrote to memory of 4912	564	firefox.exe	99
PID 564 wrote to memory of 4912	564	firefox.exe	99
PID 564 wrote to memory of 4912	564	firefox.exe	99
PID 564 wrote to memory of 4912	564	firefox.exe	99
PID 2832 wrote to memory of 3424	2832	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe	103
PID 2832 wrote to memory of 5104	2832	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe	104
PID 2832 wrote to memory of 556	2832	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe	105
PID 2832 wrote to memory of 4336	2832	2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_9c67ce60d6741c6d0a5a168d5a6546a9_darkgate_elex_glassworm_remcos_stop.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2816
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1732
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:564
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2020 -prefsLen 27099 -prefMapHandle 2024 -prefMapSize 270279 -ipcHandle 2088 -initialChannelId {86659c55-5384-43bf-a4da-b05fc750d53e} -parentPid 564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.564" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:4564
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2500 -prefsLen 27135 -prefMapHandle 2504 -prefMapSize 270279 -ipcHandle 2512 -initialChannelId {8af3f8da-242e-4a6b-8259-568876b31415} -parentPid 564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:548
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1668 -prefsLen 25164 -prefMapHandle 3772 -prefMapSize 270279 -jsInitHandle 3776 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3784 -initialChannelId {5a573692-a908-4e36-ae29-a2bf15c160e1} -parentPid 564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:744
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3932 -prefsLen 27276 -prefMapHandle 3936 -prefMapSize 270279 -ipcHandle 4016 -initialChannelId {89e5bdb2-567a-4dbe-b98c-2ba2fbf16068} -parentPid 564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.564" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:1112
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2968 -prefsLen 34775 -prefMapHandle 3060 -prefMapSize 270279 -jsInitHandle 3740 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3244 -initialChannelId {85ef47af-05e8-43d9-a7ca-d20a333a5c3f} -parentPid 564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:4468
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4876 -prefsLen 35012 -prefMapHandle 4880 -prefMapSize 270279 -ipcHandle 4828 -initialChannelId {b2bf268a-6ed0-4425-8d45-8e9537396a6d} -parentPid 564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:2968
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5072 -prefsLen 32900 -prefMapHandle 5068 -prefMapSize 270279 -jsInitHandle 5100 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5108 -initialChannelId {5e1b02b1-a99b-4593-80f2-4df0c8255133} -parentPid 564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:4572
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5128 -prefsLen 32900 -prefMapHandle 5132 -prefMapSize 270279 -jsInitHandle 5136 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5144 -initialChannelId {b1ed8ffa-e4b2-429b-8446-89204306769b} -parentPid 564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:1800
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5512 -prefsLen 32952 -prefMapHandle 5516 -prefMapSize 270279 -jsInitHandle 5520 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5524 -initialChannelId {f892f866-a245-4cff-834c-3150e85f50ec} -parentPid 564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:1408
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5544 -prefsLen 32952 -prefMapHandle 5548 -prefMapSize 270279 -jsInitHandle 5552 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5556 -initialChannelId {9d625b62-4ccb-4a8f-b431-423af1719ab3} -parentPid 564 -crashReporter "\\.\pipe\gecko-crash-server-pipe.564" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
      4⤵
      Checks processor information in registry
      PID:4912
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3424
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5104
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:556
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 15KB
SHA256 a6ffe2b2ec03564c2237d3d80cdec65c649a19c54d3988a78f49ad27e8956197
MD5 fb32dfb8bd56992fd9bb3aec1b3e40d2
SHA1 e6d55a16d07f4c3cf1ec7e9304c3021fbac8ef5b
SHA512 17f6e05efdf925b0f6cd01b378dbbd64ca261c5011cca4eb53fc5887954f90f46eab185879e8e71021981ad630d49d9d658d137095f8d69e0b3ecc774041f43f
SSDEEP 384:HwCe7iO024Y5dcs3hk2nhfdDE2Ba/rIVy8eTT+HT+A:QqZY5dv3hk2nhfS2sDIVy8C+z+A
TLSH
T11A729DBBDF516C5C1917D989C8AD93699D05F9ABCFF690A608243449C78432AB0FA0CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 4613362767c793938ed86a9556b097df057b985254fd1d4835167ebaf49896ef
MD5 9e3437adc997ff3c79e9b896aa519b50
SHA1 f7238daab619ac56af4f6d46ee66cdbbe07bc4a1
SHA512 3912ddd19d1e294693f86ba1c4e7c3a3d7b56fcf9ef89ee540aa815dca5ad0268452836cb9d044dbdb4bf674a234eb6efc418f0215697dce725c107ba18755d7
SSDEEP 3072:j3lpDCKORqKZd6ahdbAFuF7gaSZ9LG+XOoVb6U:p8PqKZ8ahdlF7kDy8OoIU
TLSH
T1BAB3AFF6DBA28D3D64FFD42E6782893EFD262404B3A3301DC923635451C6FB86679648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 adaf3b89a2321e6a8bc038d3d7345b64055df62c8c676f86f82316444afaa580
MD5 c5b8ab8727444d77a51c68b139bd7c07
SHA1 9be07ab31f371fb550b56b5b340ed1de6355f7b0
SHA512 9f9775e7479530e28107cd0c4f9b329067120497fb1144cf62793ed0ed3e277c65e975d618282b4a78e2ddaa9ace6a858eb73c05ffbe6f8db4b322ccad993c1e
SSDEEP 192:L1d66JozGzgCl6mc0djOv5zbo+ZmlyjQz:Jd66JozGzgC1jmbo+Zmlyj
TLSH
T13AE12DA8EA28823FC419527BCCA60F454F35389A9C4E7F1932DD610C2C476EE769E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\events\events
Size 1KB
SHA256 8aa8c61e3a297dab3f6e1fae94a2d9ae89f5e7ddf69d75ccf97f3d434fbf6ad5
MD5 61f1c55c41c3e2dbb7cec42f2926cede
SHA1 a5e3e994357dd84a84bbac81343c4efbb9150c6d
SHA512 440b91126f7d234ff0bf0525ef270e3f9415e027d35b48afacf37f9ba8811bf0088b0aa9f9f949d7d467cc94a965bad8850b8a9672191a33cd4f11c057c123d4
TLSH
T1DA21289C3DF84D6A69C6E39C788106CE53A54F4704971C470E12EE8DCE996DE326A43C
MD5 SHA1 SHA512 TLSH

Submit Download

025dc0ff-8a85-4864-a089-493282832600

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\025dc0ff-8a85-4864-a089-493282832600
Size 886B
SHA256 10d6344f77c172095c7ffe7bed3dc1ef6aa80a40db9604de40f09fdc7b3b3886
MD5 aaea9c4e9986dd66c4039dea28a6ccec
SHA1 1558f8330167fbbd6cfabe63f6fd5238ba878543
SHA512 f93c0cfe31c92d2a6ac0a25b6f9e333a914354f866e6a3ada7c2ff54473881ab79f5b98afd2c02bd2a5f12577e50a7c0c3dde1259c82e665d08a83c1650b6da2
TLSH
T1871127819678B5B38DB9E25B8895374287E0752780C549087DA05B180DB952FA3A720B
MD5 SHA1 SHA512 TLSH

Submit Download

b9a9c76d-8548-40f7-b6be-db9f894373c1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\b9a9c76d-8548-40f7-b6be-db9f894373c1
Size 235B
SHA256 b5355a114c4f66bbe0f74511063b02cc2d18ad305ede68eae4b66bca931284b2
MD5 7bcfcd6c831bc37e03a90169a3b437f1
SHA1 94aa0e6b828f22ad634409cc26818b17d6f8ea01
SHA512 48ae059ce999d85af6d08a03e5b63aeff6a88bae30b88ed6dfd4bd65902729d4acf278faed771796fecb4958ef79929c6794a15515b6476cbabd5e2f81e864db
TLSH
T143D09790649C636D49241F27F0A0A8DA30454C371872D810C95142398EBABC95262807
MD5 SHA1 SHA512 TLSH

Submit Download

d53106b4-632c-4d67-a879-11db22d06f90

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\d53106b4-632c-4d67-a879-11db22d06f90
Size 2KB
SHA256 c6690833803e49b3b51d0e6f5f1f1d3b9552fb060a3546f0225b58f5234d5e0b
MD5 2286121d72d78c10b4733b155660f6cb
SHA1 b8325d6dd1a340fc4957582a4d2d992e8cd685c1
SHA512 bc3c9bfac93e0e5dc5dce1ff2f143896a5ffa52dc52ee372584b3e66c3512b07b2cd2bab48969242cca87fa7f20021b084ca15233fd5e84a1202c4e61627ab75
TLSH
T1E041F15C397C5D778DDAF1DDD551234E57A48A1300C21843AE62DF0C8C9AAAE237F86A
MD5 SHA1 SHA512 TLSH

Submit Download

ddfb54b6-5440-4eca-bd4e-51798ac49406

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\ddfb54b6-5440-4eca-bd4e-51798ac49406
Size 883B
SHA256 e2ec475712aeb6186e94e02ff19490ea78824f5f4cd0d035ca834c7af52dab26
MD5 570fcce2d60e9e09a28f94cc8efbac77
SHA1 e37ef12067cc4fc76e6d2c59747bb0a5eaee6022
SHA512 064b6f17be2a229991430fecb54627f1762a6381e8df9e6504b28c7bf26c8ede3d05f5718401c39e3953cdb56421e484bdec367eddeeaa49579712d8fffe30aa
TLSH
T11811C481A6387573CD68D25F855537058BF4792380C555143DE15B140D7D92F63AA60B
MD5 SHA1 SHA512 TLSH

Submit Download

eaa62796-0654-4ab6-894c-b6ced15d3d6d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\eaa62796-0654-4ab6-894c-b6ced15d3d6d
Size 235B
SHA256 30384a69b84290bd405a85a28fbde60f052ab4cf1bb8eb44684539a645a11404
MD5 10a8d0d49aaf3ee132e4e0ead53f2a48
SHA1 223a46192b0b82cc71f7afb0ef3d403ca4a351f1
SHA512 20645fc05d8a4c067d407237ba57684f0a8bca2f98e332aaf40e2c8a943e6b3e04f2e5c557a68d5e28be88d1b1f45bbc6783b7f42d9d145498f82fc3139536eb
TLSH
T118D09798A8E8271E48141F07F1B0ACC630548C3798706860CB9589B49AB89C8121295A
MD5 SHA1 SHA512 TLSH

Submit Download

f8c8b41a-b6c4-4923-8d6c-e493ae4452da

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\f8c8b41a-b6c4-4923-8d6c-e493ae4452da
Size 16KB
SHA256 6f1f346c31ed8a221491b765e04bae2adb128f9386a606ab02c8b9ada7a63800
MD5 38eb35d30653eb27033ed3f7809eb0d7
SHA1 547bea3d9c1b6fdc63bd6797189d979710f11f8f
SHA512 d973c34518fc04fca8bda2378f46f065479c1404016e54fab3500c3253ec32142d2a12696ea4e3f025683807451d7c72fadd0898b3537a39545051a823a49d33
SSDEEP 192:IrHTZQIqKAdUi9tVJgBZSVahE2Uzv1s11EAGLBoYDaEh/srEizxdck7S6buyPORp:IrLVQLGua00hldck7S6bROrKqS6x
TLSH
T12E72C856286045BA8651E368D4FC7FC3E5F528CF4C418FCADBE4BE086ADE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\extensions.json
Size 16KB
SHA256 4f603b37dd51f791c4f59ec3434f5f0a298d9c99f4843d9dd45d3704a14350a7
MD5 ced5a33f17be3efa50cad510ffda49a1
SHA1 cb7a5deaf612e9e5d734140949a22d1cf674aed5
SHA512 0db54c41fef91067f1f560b6e1b0cbff2a864cb9f8a1e9e213771d4896a208ea1ca4f0a0925350d82357219159078c03f60b65d58ce478e528f2c819f32847ae
SSDEEP 384:okI4v2UmldvV8dhWk94zH96oLL4HkL4PRL4HgL4HuL4HYFezb4hzC:/I4+RfmXt4Z644e4R4i4044e4M
TLSH
T11972531545049EB8294FA79BAA367E02C37D473B60845C78F4DD8FC802FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\prefs-1.js
Size 6KB
SHA256 acc382cc5901ff86c3f0a231c3d75bcd079695dafba3341981312b7c92b27bd4
MD5 e1ff43940717d63c518d3a62f7eef2db
SHA1 7daccd91bb6d82d181ecae2a44745109ac907de0
SHA512 2d9fa31cc6b8f37f4d9aa40d8dc6ff8e8fd1f425ab4702bf95413d6f9a438c51f85a70da256b275ee25b23554414a4dfb9b209910a8d22c0ff75af8b1f52a2c8
SSDEEP 96:xHBUTUxVqGq5fgDK1zSQdSSlWdv9jSDnqH/8MBw88n8L4cn+wGC:HyR5fgDKFdSSvgdBw88hC
TLSH
T1F1E120789448CB7F74B676ACAC648C716AB2413B77BF28C710B65488055CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\prefs-1.js
Size 8KB
SHA256 f10203912ea51c967b207f65fe0faf1fa7495c82f455e9f0a7ef4cf19dc56937
MD5 9038c7e287de7d25616f18e4b2d8d88b
SHA1 2f7f4ee56ac2a74769837b6dd6d5ace88f9a7830
SHA512 d3738e34b5d47f9f76cb1ad72a0ad232a96aa56f2a42a1a161de18dab23c4209b45728c37e99d16a0f565f206a3f9559175c01d7378fd046ed91796fb31c7718
SSDEEP 96:xHBhTUxVqGq5fgDKObzSQdSSlWdv9jSDnqWR1Ar8IBw884kDj8L4cn+wGC:HrR5fgDKSdSSv1RyBw884kC
TLSH
T173020F785444CB7F74B636ACAC244D705AB2023BB7BF68C710BA5485051CF3842F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\prefs.js
Size 6KB
SHA256 fd954ce501e03350e2b7dc5df25d8494b754bc63fe4bd8954f95a5dd2d45dfa8
MD5 b633be419dade1b7199e462bde8d2e35
SHA1 4601d71cd86f4dfb15216de81f96083896e5af4a
SHA512 35e0a7594a8c84faec1a55e2a74788f7ddfe24d2041f8c5a1f43b1979598098b0976f1bf4aa8beaa6ba1f64a1b9d9d0818e72669f44ba1063cfe54489ac55189
SSDEEP 96:xHBUTUxVqGq5fg9o1zSSSSlWdv9j2nqH/8MBw88n8L4cn+wGC:HyR5fg9oLSSedBw88hC
TLSH
T116E110789408CB7F75B676ACAC688C715AB2013B77BF68C610B65488055CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 ededef04b6e89721c6dbf4994263d9369b04a96faa60deb1598275049a54cb05
MD5 9bcfc247d0827043b9b9f1839e22ff3a
SHA1 1e58c70adf26180404b7713c50939d80a4e45aeb
SHA512 be448bb415c77ebe0e75b4b814e4fb81b0002197672c924b232eb7659a74c7f200b3b7396b734c922321099a208e6b6c4c3e0b893d00e1e3688b6b41157059c0
SSDEEP 96:ecfKQj9RZQeW9jILA0NjoB8kMJttn0YJZQD+:LKiIOnNcB85JttnTZm+
TLSH
T1D6917E42371F2897FE6B81CFEE494CE144B4300A988184FC50CF3A29776BB4B7499475
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads