Analysis
- max time kernel
148s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/08/2026, 01:02
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
24 signatures
150 seconds
General
- Target 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe
- Size 5.8MB
- Sample260805-bd8spabd35
- SHA256 57b7a7dd1a9a26570fe6ea3f72d18f5f344294cebe1dedf4748e2327c7f27e6b
- MD5 43bd6f5eedaca35177150b3e67f0700b
- SHA1 9e1fbee5cca1fb7d652b2ebf6c2918f2f4247528
- SHA512 19c0391533b2175fcc6ab1270083b9ef7907459d9fe0f3fa222e9d6db1b2079125d91cbc65e6a97685ea1bfd37b8bf8095f4643469198ae7d4f5ab00da02e308
- SSDEEP 98304:2Y+wkQU3xyyj6P4o18frP3wbzWFimaI7dlos:yQU3AyjPgbzWFimaI7dl
- TLSH T1BD568C52BF8CC176CA5A2570172DAF2A502DBD25773915C3A2783E7EDC313C2683A61B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- A potential corporate email address has been identified in the URL: [email protected]
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe /onboot" 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe - Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Checks processor information in registry 2 TTPs 20 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm" 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4} 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe" 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A} 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe" 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Low Rights 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006} 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3" 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3" 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe" 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3" 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243" 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe - Modifies registry class 16 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter" 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe" 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan" 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User" 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1" 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD} 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\WOW6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D} 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Model = "216" 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Therad = "1" 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeRestorePrivilege 1700 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe Token: SeDebugPrivilege 2800 firefox.exe Token: SeDebugPrivilege 2800 firefox.exe Token: SeDebugPrivilege 2800 firefox.exe Token: SeDebugPrivilege 2800 firefox.exe Token: SeDebugPrivilege 2800 firefox.exe - Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 2800 firefox.exe 2800 firefox.exe 2800 firefox.exe 2800 firefox.exe 2800 firefox.exe 2800 firefox.exe 2800 firefox.exe 1700 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1700 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 1700 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe 1700 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe 1700 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe 2800 firefox.exe 1700 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe 1700 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe 1700 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe 1700 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe 1700 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe 1700 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe - Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 1700 wrote to memory of 4408 1700 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe 90 PID 1700 wrote to memory of 4100 1700 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe 98 PID 4100 wrote to memory of 2800 4100 firefox.exe 99 PID 4100 wrote to memory of 2800 4100 firefox.exe 99 PID 2800 wrote to memory of 3676 2800 firefox.exe 100 PID 2800 wrote to memory of 3676 2800 firefox.exe 100 PID 2800 wrote to memory of 3676 2800 firefox.exe 100 PID 2800 wrote to memory of 936 2800 firefox.exe 101 PID 2800 wrote to memory of 936 2800 firefox.exe 101 PID 2800 wrote to memory of 936 2800 firefox.exe 101 PID 2800 wrote to memory of 936 2800 firefox.exe 101 PID 2800 wrote to memory of 3080 2800 firefox.exe 102 PID 2800 wrote to memory of 3080 2800 firefox.exe 102 PID 2800 wrote to memory of 3080 2800 firefox.exe 102 PID 2800 wrote to memory of 3080 2800 firefox.exe 102 PID 2800 wrote to memory of 2360 2800 firefox.exe 103 PID 2800 wrote to memory of 2360 2800 firefox.exe 103 PID 2800 wrote to memory of 2360 2800 firefox.exe 103 PID 2800 wrote to memory of 3532 2800 firefox.exe 104 PID 2800 wrote to memory of 3532 2800 firefox.exe 104 PID 2800 wrote to memory of 3532 2800 firefox.exe 104 PID 2800 wrote to memory of 3532 2800 firefox.exe 104 PID 2800 wrote to memory of 1576 2800 firefox.exe 105 PID 2800 wrote to memory of 1576 2800 firefox.exe 105 PID 2800 wrote to memory of 1576 2800 firefox.exe 105 PID 2800 wrote to memory of 1576 2800 firefox.exe 105 PID 2800 wrote to memory of 5648 2800 firefox.exe 106 PID 2800 wrote to memory of 5648 2800 firefox.exe 106 PID 2800 wrote to memory of 5648 2800 firefox.exe 106 PID 2800 wrote to memory of 5648 2800 firefox.exe 106 PID 2800 wrote to memory of 5944 2800 firefox.exe 107 PID 2800 wrote to memory of 5944 2800 firefox.exe 107 PID 2800 wrote to memory of 5944 2800 firefox.exe 107 PID 2800 wrote to memory of 5944 2800 firefox.exe 107 PID 2800 wrote to memory of 5952 2800 firefox.exe 108 PID 2800 wrote to memory of 5952 2800 firefox.exe 108 PID 2800 wrote to memory of 5952 2800 firefox.exe 108 PID 2800 wrote to memory of 5952 2800 firefox.exe 108 PID 2800 wrote to memory of 5972 2800 firefox.exe 109 PID 2800 wrote to memory of 5972 2800 firefox.exe 109 PID 2800 wrote to memory of 5972 2800 firefox.exe 109 PID 2800 wrote to memory of 5972 2800 firefox.exe 109 PID 1700 wrote to memory of 5604 1700 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe 115 PID 1700 wrote to memory of 5752 1700 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe 116 PID 1700 wrote to memory of 5812 1700 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe 117 PID 1700 wrote to memory of 5860 1700 2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe 118 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_43bd6f5eedaca35177150b3e67f0700b_darkgate_elex_glassworm_remcos_stop.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:4408
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html2⤵
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html3⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2024 -prefsLen 27099 -prefMapHandle 2028 -prefMapSize 270279 -ipcHandle 2116 -initialChannelId {5397a24a-cae3-4a5f-939a-e91d5006dfaa} -parentPid 2800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2800" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu4⤵PID:3676
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2496 -prefsLen 27135 -prefMapHandle 2500 -prefMapSize 270279 -ipcHandle 2508 -initialChannelId {9e7505e8-c7a0-4f98-b24c-2fbb55330d40} -parentPid 2800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2800" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket4⤵PID:936
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2992 -prefsLen 25164 -prefMapHandle 3108 -prefMapSize 270279 -jsInitHandle 1624 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3024 -initialChannelId {5b0405d6-cafb-400c-84fc-e9fb25e2b7f9} -parentPid 2800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2800" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab4⤵
- Checks processor information in registry
PID:3080
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3888 -prefsLen 27276 -prefMapHandle 3892 -prefMapSize 270279 -ipcHandle 2992 -initialChannelId {be2c9e7e-1530-4edc-a248-3b5c62b167b9} -parentPid 2800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2800" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd4⤵PID:2360
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4296 -prefsLen 34775 -prefMapHandle 4300 -prefMapSize 270279 -jsInitHandle 4304 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4272 -initialChannelId {8ae61aad-d282-4adf-986d-42657aab382b} -parentPid 2800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2800" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab4⤵
- Checks processor information in registry
PID:3532
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4760 -prefsLen 35012 -prefMapHandle 4764 -prefMapSize 270279 -jsInitHandle 4768 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4732 -initialChannelId {e25588ea-9da6-42d8-964e-400ad74a3f08} -parentPid 2800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2800" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab4⤵
- Checks processor information in registry
PID:1576
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4808 -prefsLen 35012 -prefMapHandle 5012 -prefMapSize 270279 -ipcHandle 5004 -initialChannelId {85ede78b-9479-47d0-97e6-91bd139f3707} -parentPid 2800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2800" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 utility4⤵
- Checks processor information in registry
PID:5648
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5432 -prefsLen 32952 -prefMapHandle 5436 -prefMapSize 270279 -jsInitHandle 5440 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5404 -initialChannelId {29f63b5a-1c10-4936-ba2c-cb1488380918} -parentPid 2800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2800" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab4⤵
- Checks processor information in registry
PID:5944
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5608 -prefsLen 32952 -prefMapHandle 5612 -prefMapSize 270279 -jsInitHandle 5616 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5624 -initialChannelId {24099d9d-67df-40ea-bbad-5e82f12ee06b} -parentPid 2800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2800" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab4⤵
- Checks processor information in registry
PID:5952
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5448 -prefsLen 32952 -prefMapHandle 5824 -prefMapSize 270279 -jsInitHandle 5828 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5836 -initialChannelId {ba0432e3-637e-4abf-b577-fbbd70ee4e98} -parentPid 2800 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2800" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab4⤵
- Checks processor information in registry
PID:5972
-
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:5604
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:5752
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:5812
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:5860
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
- Size 16KB
- SHA256 d6fc42bcc028e3133808922e0806a0d8736696f38d378c4a35ac0442b2cc5da3
- MD5 2b79d38abff1c0161be7522dd0e3b176
- SHA1 1a3e10cde60f0dd8e08b00499784cd7c3a40f2ad
- SHA512 1e9494f201039fe36691e7b1802763e142f98b14cab605b89a5e12d6167ed17b63ac1139ec1c8b9cc42afeba5a324027ae5bd70d738f35a6d32f080b18ef3644
- SSDEEP 384:HwCe7iO024YSDL84KKDL849B7SOEAd9KVRaAcP+AWRMAA839P:QqZYSDL8lKDL8CB7S/AmVAf+hRM3839P
- TLSH T165729E799F413CEC15A7C0E8C5F892DA8C18B6A3DFE6806D21683D0DCB98969B1F544F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\startupCache\webext.sc.lz4
- Size 104KB
- SHA256 464ac1ace9c039cf3ebefe914a9bbd51c7b341b428d4b33e8182df273e75e90a
- MD5 4786277f3a2ab04385a5a9aac8ba7800
- SHA1 74738f609c1f5c87ca7c116188513c2c694851f9
- SHA512 56b9eaeca728b9583d15ceb669250ed2fc2ad3de3c4917e7e0469795dd80f2aebfd07a9c411e8e9d996b91c7451005440e4c5d6db35d2c46b235290b0fee4b50
- SSDEEP 1536:jTrliMTvXCvibUl9XOmVcYM7bJeI6gLSXoTa35LBmeBA9dBqaCSG3NtQDBro3/89:j3lJbUl9ZcJ1/fW3uDlCE1YUmW
- TLSH T14BA3AFFADBA38D7D54FFD02DAB92883EFD266440B3A33009C953675062C6F687675248
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 11KB
- SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
- MD5 25e8156b7f7ca8dad999ee2b93a32b71
- SHA1 db587e9e9559b433cee57435cb97a83963659430
- SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
- SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
- TLSH T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 502KB
- SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
- MD5 e690f995973164fe425f76589b1be2d9
- SHA1 e947c4dad203aab37a003194dddc7980c74fa712
- SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
- SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
- TLSH T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
- Size 28KB
- SHA256 4583cb2a18fc6f673cd1fc8e0e6e2bdf6a603549a3fbd651f20632e5cf76384c
- MD5 cfc2c21e756904da9c521d6df2d7d5ba
- SHA1 b76c9725f728a474511b9f7d701e2005d4eb0d98
- SHA512 b4416d74b10d8e1467f86561e05a867d4b4cbe3deb334b6cc801065aadfe0b75cf0a3038d449e399c14f0e90b0b43dd3042ff9c5af26d74b6a8c71dc5c6965fc
- SSDEEP 768:iELbq321cGcmhuzspRK1JEokbYbmbmbdPxy:Tbq321pEQ
- TLSH T19BD20144EB1E953FD41952BBDCA50B001F79B88A98092FA73A4C646C6C872DC3D9E17F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
- Size 26KB
- SHA256 10b499889a89c54db1a039f9f4ba7d0054b69dbde5f10f9233be9e5f648334bc
- MD5 3605afff7f0673366ff034dfd9bebb33
- SHA1 b4be64c4b0e669a30b9928c09350f32b570cca28
- SHA512 49c5ff099abe075795a679f90858c49b026c9292f23014d9d9f380053e5a4303198dac750a1f95e8080931858a0a1f3e32e3152d061f66c51f6f6db83d185f0c
- SSDEEP 768:cbq321cGcmhuzspRK1JEokbYbmbmbdVEn2:cbq321pE
- TLSH T1ABC2F044FB1E953FD42952BADCA147002F79F88A58192FA73A4C64686C872DC3D9E07F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\0fe8f89a-6c28-4da8-a8ae-b14bf4f5395b
- Size 235B
- SHA256 2135fda6c141e516b6a3e49b9e5e148be581ed1ecee3002b27e59e889c142305
- MD5 ded38e77e0f36afc4114248d1b186470
- SHA1 84e0689ec8d362f06f11512972d3fedc6dd7dda0
- SHA512 76142be46357d077ba537c861770d5ca5053167388e3ad125b042c757bf06fecd29a217c0bb294324cde97b510d99a89c1f955c6f274974f1c1862bf272c955b
- TLSH T1D5D0978068D82F2D88180F02B0E038C630448C3324A05810D65089788BB9FC882E2A0B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\2ad6f095-1816-4fc9-b768-754d3f1e11c0
- Size 886B
- SHA256 3477d781279aaf5d527d3a888b03ac891ac7548046fac46ac799de9cc8dee008
- MD5 08cd0efbc5df4a4e43d29fe9829dcb4b
- SHA1 25c9db6585511b4204aee01a04041426a8feb316
- SHA512 0ddb78c6d6b16c436d6a31e33e0602acaf3c0196f4e9243b3b6d2cfd050085a4318600436af6aa001fa501c65c4c1ba0c2b108ae332f2aa7e0fe82c35e15148d
- TLSH T1B91144509638BDB2CC38834BE59177428FA0302380CA0D10BE985E040D7A52E6666707
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\8bdb0627-8649-40c4-ad05-40462978dc18
- Size 871B
- SHA256 3136addc74ed23c647228cc78e32382d7cf074ce7e6f8dae83ab10f10f1f5da1
- MD5 b9fc51a901aa0609105eee4b4d141433
- SHA1 d998946196b8c40993ddcee59ff0a051fb30018d
- SHA512 386059f3158deba8dbe86dc21ebc9ef7bfc0494c60c8a12f4779c03691f76479b353f461762cdd2a4c24253145fe9c6d5466b66b7263f315a1a7a31433305a95
- TLSH T1E811E351D634BAF2CD78934BC55577528FB47523C0CA94543DA04D080D7B62D97BB70B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\ddc008b4-35c8-4c99-9eeb-fdef84a10c03
- Size 2KB
- SHA256 4e5607aa8fcb1fedc6ff44cc64621931cbfd6d70fa32bfb3af02b4916a06ec12
- MD5 112f8014ee2269b84edcad39eb56a709
- SHA1 7f9818aa9317e837e1aebdcf2c05c27292aed6a9
- SHA512 dbca0d40fce176032738523b3fb81c4e7abe7680961d2852ba1ab9c45a290b2f870095a774a4f9a57111aa90cbe886fd260cba1368f015de703ee0296e3b87c4
- TLSH T1DC41335876789DB69CEAF18DD492338E57644E0340C62CC72E91DE0C8CA666D237A42B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\e9f4703a-6aac-461b-81e2-0fc249b0c31d
- Size 235B
- SHA256 9f7645096963fec0d6ecb0a75ec3d6b4b0c988c2cf08e7f1fc093f85521d6ff7
- MD5 36b7803294864f929b75c02799c03b6c
- SHA1 44a3ca7ce68a0c431d69b9706a5785dd2a034516
- SHA512 a294c70c7dbf212e456a195180a20708d1e222fe4c06f2f556f8d1739ee8575f9787ad7b6f4947a212f9fd9edad3dd32c006e420ee82a93832ed0f9fe050837c
- TLSH T15CD097812498331C08102F0BB0A038C370688C3B10B068A089A145348ABEAC84117907
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\extensions.json
- Size 16KB
- SHA256 506408fc0ee25e2f78e5fc661f6d989d88d9a45b9cb35afba02da3fedf7fbe72
- MD5 49dd49a8e822146e17d15e0c61f3ed2a
- SHA1 82fed1178a01dddf8843b80a6e7e74119e4d36f2
- SHA512 5a82fba8dc5623b59353f2091234229b69f556f32acdffa423becac75f98112ddfd52c49d79f7a51a947aacfff1815953c2244811c7b24108b1778396aed9e4d
- SSDEEP 384:AkI4vyUmldvXf8dhWnV94z6196opL4HBL4PlL4HDL4HfL4H4Xv4hG:nI4qRf/0Xen4K6W454d4P4j44v4c
- TLSH T14572531545048EB8294FA79BAA36BE01C37D433B60845C78F4DD8FC842FA5B902FB65B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
- Size 1.1MB
- SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
- MD5 626073e8dcf656ac4130e3283c51cbba
- SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
- SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
- SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
- TLSH T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
- Size 116B
- SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
- MD5 ae29912407dfadf0d683982d4fb57293
- SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
- SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
- TLSH T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
- Size 1002B
- SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
- MD5 dcffff15fa618a53834ee4ae8673bd23
- SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
- SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
- TLSH T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
- Size 21.6MB
- SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
- MD5 d14dd3f0107ff91c3e21f301d83f82b0
- SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
- SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
- SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
- TLSH T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs-1.js
- Size 6KB
- SHA256 0cf54aa88941806f62e8e190ebd3a2c16a883d74e697c649d1c8ff08596d70bf
- MD5 3558af6b6192f1e4dc18fec2af12d463
- SHA1 fd1bce2d14eece1f61ab7268be88d927ee19c214
- SHA512 2661e785a366b3dfdec8693414f909c8c69eccd96e0261ca10d596ce9915fa1e83807827ac078ac85848706bc748e197205618d614087271ccf2b01e3f89724b
- SSDEEP 96:xHHUTUZfvqGqqkf+zR1zSWSSlDdv9jDnLHH4/39Bw88n8L4cn/MVzW:9QRFf+zR3SS9H4/39Bw889g
- TLSH T188E13F7895088F7F64B6776CAC688D316AB2013BB7BF28D750B95484054CF3442F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs-1.js
- Size 8KB
- SHA256 dcf93edf7436195921c8c9e7c974479cd537aabf5ace66eacbc3e33c7f6dbfef
- MD5 d530804409828cbb51fac1003005a3e1
- SHA1 a369b4f4d8caeeb1ad648ffa3e8300f821e1d6d0
- SHA512 e27594d8f359a9a169cf4ff333a8fef0edce1cfe729cfc88e4d8b57720b639c97865011815f82e0e99d89ee0400ca833d7eedf2883a26460779fd2f2ca420226
- SSDEEP 96:xHHFTUZfvqGqqkf+zRObzSWSSlDdv9jDnLWRyJL4/3/Bw8879hX8L4cn/MVzW:91RFf+zRsSS8RE4/3/Bw88/tg
- TLSH T1A2020E385544CF7FA4B6376CAC2889716A72023BB7BF68D710B95486054CF3442FA6EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs-1.js
- Size 8KB
- SHA256 6c402942a9e048bfbb6cdedf76c5949d0b1056536c591f37a4cd8c1483afee76
- MD5 97aac0caabfe9f1817bc0478c195841c
- SHA1 b4fed4d43a1e4cc81ee3b9ab6c143e616cb37862
- SHA512 1b7b0ea609c4a54c968e07ee18ab9d3f7a85f67e08917854db02bfd2ceeeb44d125d72ca1cded32dfb0f37419d2a1dfc6617ddf336ce6dd3d5cfac27535aaf81
- SSDEEP 96:xHHFTUZfvqGqqkf9zRObzSWSSlDdv9jDnLWRyJL4/3QBw88793W78L4cn/MV4W:91RFf9zRsSS8RE4/3QBw88xWhd
- TLSH T161021E385544CF7FA4B2376CAC2889715A72023BB7BF68D710B98486054CF3441FA6EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs.js
- Size 6KB
- SHA256 14a17361ff81548cd286985578b2b4de3f7051286ab015ce8bc00c8fbedaa8bb
- MD5 4988bdd9d83bf772adbb34cdd0fdf598
- SHA1 e2084738e449b407a631d0fc3f4e8c657ba0e6ec
- SHA512 f595c6a38b817d63c884eb6b6a68e63fbd06b3b63e4c0d938b7e9479d685f565595c261c2e49a3269bfe3f6c47492fa5e73ddca9790ddabcb91efd0ccfd1da88
- SSDEEP 96:xHHUTUZfvqGqqkf+3nKF1zS7aESSlDdv9jTjinLHH4/39Bw88n8L4cn/MVzW:9QRFf+3KFMSSdj2H4/39Bw889g
- TLSH T1C8E12E789108CFBF64B677ACAC6889316AB2013BB7BF28D750B55484050CF3446F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\sessionstore-backups\recovery.baklz4
- Size 4KB
- SHA256 8137fb57353e17ca7f27512f741e6623698ebc5e8dea5366aca97c12b2901280
- MD5 4360bb7de2165a547d4216d7bb39a7dc
- SHA1 28a194f6a04b24ef13c66b5656da0feab7ca7c00
- SHA512 4aa87c9e11e9d7f30fdcf24830736feb9e77c41edd1e83470e3bef50990c1b666b4c5564a2cef39b446caacc61d20778dd69d3aa40fcfdebcf9e6f16e5f198ba
- SSDEEP 96:effbt69VJ1oQeW9jILA0NjoB8kMJttn0YJZQB1q:Wx/IOnNcB85JttnTZE1q
- TLSH T17D917D073B0B28A7FD9781CBEE854CF14964311A548088EC90CF3A26B32BB4BB469475
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 4.5MB
- SHA256 548b222328ef9bdb2b28d34a3528f07df7f12028c60f6fa7f3f7ccdb6228d508
- MD5 77a2c2af0add2d56d80b8ae5f5b7f8d0
- SHA1 0b2280dbf7f97e232d0e7e9a36793c23d5ef5063
- SHA512 ba69585c667264c153aa68246ef8f3c97e5309dc8aa1d822c31e924ea8cc570c17759bf8892df28cccc090371a0710f4fd70ec0666e0b6ebd7a876b643525b27
- SSDEEP 49152:S7AzfsOyaP6ryZt3dd3i/S2xRzMUghuRPbPxYIpqOU:MmfshaP6ryZt3dORzMUghu1qB
- TLSH T1D42639E820D1A257F3814073A64553EB21FFD00C6037DE484BA956E9A4B8CDF9E16B7E
- MD5 SHA1 SHA512 SSDEEP TLSH