Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
12/08/2026, 15:52
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
27 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
35 signatures
150 seconds
General
- Target 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe
- Size 5.9MB
- Sample260812-ta18jsdf34
- SHA256 11f39105826d97942a925e2d7af2c57bc9ad7254719a0391a65ceac3854430ee
- MD5 91ca46058a1657bdddafad0c79bd55c6
- SHA1 158833bf742876cf91e5472cc41abe0a21acf60a
- SHA512 acc51110cfe713e2e30d63e52635fd6039a87d1ffcc32781982959f5a0d34064d3f0d3ee727311060ae4299e183eadaf171788162412a6a71cd4e9c1a1c9db23
- SSDEEP 98304:rq+92rU3Cyyj6P4118frP3wbzWFimaI7dlosx:QrU3/yjIgbzWFimaI7dlL
- TLSH T1B1569D52BF4CC17AC95A2570272DAF2A5029BD25773915C3A2783E7EDC313C26C3A61B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Floxif payload 1 IoCs
resource yara_rule behavioral1/files/0x000b0000000242c8-1.dat floxif - Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 4 IoCs
resource yara_rule behavioral1/memory/4888-11-0x0000000000650000-0x0000000000C26000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/4888-341-0x0000000000650000-0x0000000000C26000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/4888-360-0x0000000000650000-0x0000000000C26000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/4888-771-0x0000000000650000-0x0000000000C26000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers - Detects executables containing SQL queries to confidential data stores. Observed in infostealers 4 IoCs
resource yara_rule behavioral1/memory/4888-11-0x0000000000650000-0x0000000000C26000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/4888-341-0x0000000000650000-0x0000000000C26000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/4888-360-0x0000000000650000-0x0000000000C26000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/4888-771-0x0000000000650000-0x0000000000C26000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore - UPX dump on OEP (original entry point) 9 IoCs
resource yara_rule behavioral1/files/0x000b0000000242c8-1.dat UPX behavioral1/memory/4888-3-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/4888-10-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/4888-12-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/4888-302-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/4888-342-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/4888-361-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/4888-501-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/4888-774-0x0000000010000000-0x0000000010030000-memory.dmp UPX - A potential corporate email address has been identified in the URL: [email protected]
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000b0000000242c8-1.dat acprotect - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe - Loads dropped DLL 1 IoCs
pid Process 4888 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe /onboot" 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\e: 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe - Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe -
resource yara_rule behavioral1/files/0x000b0000000242c8-1.dat upx behavioral1/memory/4888-3-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/4888-10-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/4888-12-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/4888-302-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/4888-342-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/4888-361-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/4888-501-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/4888-774-0x0000000010000000-0x0000000010030000-memory.dmp upx - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\System\symsrv.dll 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe File created \??\c:\program files\common files\system\symsrv.dll.000 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe - Checks processor information in registry 2 TTPs 20 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A} 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3" 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006} 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243" 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe" 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe" 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3" 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm" 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3" 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Low Rights 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4} 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe" 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe - Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan" 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1" 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Therad = "1" 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter" 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User" 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7} 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe" 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Model = "223" 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4888 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe 4888 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe 4888 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe 4888 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe 4888 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe 4888 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 4888 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe Token: SeRestorePrivilege 4888 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe Token: SeDebugPrivilege 2508 firefox.exe Token: SeDebugPrivilege 2508 firefox.exe Token: SeDebugPrivilege 2508 firefox.exe Token: SeDebugPrivilege 2508 firefox.exe Token: SeDebugPrivilege 2508 firefox.exe - Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 2508 firefox.exe 2508 firefox.exe 2508 firefox.exe 2508 firefox.exe 2508 firefox.exe 2508 firefox.exe 2508 firefox.exe 4888 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 4888 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe - Suspicious use of SetWindowsHookEx 11 IoCs
pid Process 4888 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe 4888 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe 4888 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe 2508 firefox.exe 4888 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe 4888 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe 4888 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe 4888 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe 4888 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe 4888 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe 4888 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe - Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 4888 wrote to memory of 2536 4888 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe 85 PID 4888 wrote to memory of 4452 4888 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe 87 PID 4452 wrote to memory of 2508 4452 firefox.exe 88 PID 4452 wrote to memory of 2508 4452 firefox.exe 88 PID 2508 wrote to memory of 4460 2508 firefox.exe 89 PID 2508 wrote to memory of 4460 2508 firefox.exe 89 PID 2508 wrote to memory of 4460 2508 firefox.exe 89 PID 2508 wrote to memory of 1752 2508 firefox.exe 90 PID 2508 wrote to memory of 1752 2508 firefox.exe 90 PID 2508 wrote to memory of 1752 2508 firefox.exe 90 PID 2508 wrote to memory of 1752 2508 firefox.exe 90 PID 2508 wrote to memory of 3364 2508 firefox.exe 91 PID 2508 wrote to memory of 3364 2508 firefox.exe 91 PID 2508 wrote to memory of 3364 2508 firefox.exe 91 PID 2508 wrote to memory of 3364 2508 firefox.exe 91 PID 2508 wrote to memory of 4524 2508 firefox.exe 92 PID 2508 wrote to memory of 4524 2508 firefox.exe 92 PID 2508 wrote to memory of 4524 2508 firefox.exe 92 PID 2508 wrote to memory of 2472 2508 firefox.exe 93 PID 2508 wrote to memory of 2472 2508 firefox.exe 93 PID 2508 wrote to memory of 2472 2508 firefox.exe 93 PID 2508 wrote to memory of 2472 2508 firefox.exe 93 PID 2508 wrote to memory of 2448 2508 firefox.exe 94 PID 2508 wrote to memory of 2448 2508 firefox.exe 94 PID 2508 wrote to memory of 2448 2508 firefox.exe 94 PID 2508 wrote to memory of 2448 2508 firefox.exe 94 PID 2508 wrote to memory of 4612 2508 firefox.exe 95 PID 2508 wrote to memory of 4612 2508 firefox.exe 95 PID 2508 wrote to memory of 4612 2508 firefox.exe 95 PID 2508 wrote to memory of 4612 2508 firefox.exe 95 PID 2508 wrote to memory of 4520 2508 firefox.exe 96 PID 2508 wrote to memory of 4520 2508 firefox.exe 96 PID 2508 wrote to memory of 4520 2508 firefox.exe 96 PID 2508 wrote to memory of 4520 2508 firefox.exe 96 PID 2508 wrote to memory of 3892 2508 firefox.exe 97 PID 2508 wrote to memory of 3892 2508 firefox.exe 97 PID 2508 wrote to memory of 3892 2508 firefox.exe 97 PID 2508 wrote to memory of 3892 2508 firefox.exe 97 PID 4888 wrote to memory of 4564 4888 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe 101 PID 4888 wrote to memory of 4064 4888 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe 102 PID 4888 wrote to memory of 1832 4888 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe 103 PID 4888 wrote to memory of 4036 4888 2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe 104 PID 2508 wrote to memory of 2940 2508 firefox.exe 105 PID 2508 wrote to memory of 2940 2508 firefox.exe 105 PID 2508 wrote to memory of 2940 2508 firefox.exe 105 PID 2508 wrote to memory of 2940 2508 firefox.exe 105 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-12_91ca46058a1657bdddafad0c79bd55c6_darkgate_elex_floxif_glassworm_remcos_stop.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:2536
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html2⤵
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html3⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2012 -prefsLen 27099 -prefMapHandle 2016 -prefMapSize 270279 -ipcHandle 2088 -initialChannelId {1eaf4b34-32df-4dae-a223-86df2597b360} -parentPid 2508 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2508" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu4⤵PID:4460
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2484 -prefsLen 27135 -prefMapHandle 2488 -prefMapSize 270279 -ipcHandle 2496 -initialChannelId {17aea308-1bdf-440c-8517-7af2d72ca271} -parentPid 2508 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2508" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket4⤵PID:1752
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3848 -prefsLen 25164 -prefMapHandle 3852 -prefMapSize 270279 -jsInitHandle 3856 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3864 -initialChannelId {5658c00d-6ac3-4901-8d32-af4830003e74} -parentPid 2508 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2508" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab4⤵
- Checks processor information in registry
PID:3364
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4016 -prefsLen 27276 -prefMapHandle 4020 -prefMapSize 270279 -ipcHandle 4112 -initialChannelId {1584cc8f-07b4-4c18-8cd3-647fa597191a} -parentPid 2508 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2508" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd4⤵PID:4524
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4512 -prefsLen 34775 -prefMapHandle 4516 -prefMapSize 270279 -jsInitHandle 4520 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4528 -initialChannelId {07f861b5-9e64-435c-8187-a7a3e39bce12} -parentPid 2508 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2508" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab4⤵
- Checks processor information in registry
PID:2472
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4472 -prefsLen 35012 -prefMapHandle 1668 -prefMapSize 270279 -ipcHandle 3444 -initialChannelId {6ec1282b-0666-4cd9-a7f1-23d8f6167d2e} -parentPid 2508 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2508" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility4⤵
- Checks processor information in registry
PID:2448
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5024 -prefsLen 32900 -prefMapHandle 5052 -prefMapSize 270279 -jsInitHandle 5056 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5064 -initialChannelId {69a2fcd2-e3dc-4fe9-8e5f-757b8aad2b90} -parentPid 2508 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2508" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab4⤵
- Checks processor information in registry
PID:4612
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5128 -prefsLen 32900 -prefMapHandle 5132 -prefMapSize 270279 -jsInitHandle 5136 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5144 -initialChannelId {769ac2b4-b2a5-4d3f-ab6d-5d54e5445f39} -parentPid 2508 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2508" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab4⤵
- Checks processor information in registry
PID:4520
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5488 -prefsLen 32952 -prefMapHandle 5492 -prefMapSize 270279 -jsInitHandle 5496 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5504 -initialChannelId {c9fb9ded-05d0-46c1-91e3-656281f0848c} -parentPid 2508 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2508" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab4⤵
- Checks processor information in registry
PID:3892
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3884 -prefsLen 36639 -prefMapHandle 3980 -prefMapSize 270279 -jsInitHandle 3944 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2948 -initialChannelId {30e17bf1-fb8e-43cf-95a1-5091eeaf67bb} -parentPid 2508 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2508" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab4⤵
- Checks processor information in registry
PID:2940
-
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:4564
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:4064
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:1832
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:4036
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\System\symsrv.dll
- Size 67KB
- SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
- MD5 7574cf2c64f35161ab1292e2f532aabf
- SHA1 14ba3fa927a06224dfe587014299e834def4644f
- SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
- SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
- TLSH T17863F1372AB5807DDD210D37949F835AB771E5A76C20643FC25907D988B8DD0E3239AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\System\symsrv.dll.000
- Size 114B
- SHA256 aefc503b1ed462d7b6280228a7b5b710792273b78934426f88325341ac5b5a92
- MD5 e609411db8aa6775d0344c75c23ae79b
- SHA1 1d2ff6194bf159ce36cd0461cd3da29486d1e97d
- SHA512 6884ff5c07bc687132c965a59cb8c5a898a25da74c6c846c1d6089ddca8007cb7e4d2f8520bdce9fbcf6e2f9c9e5c28d8c8d6d049d3522470bdc7d38bbfa0ad0
- TLSH T1FFB09262AA2791EAE1AA224505A0248C1ED0B62AB48638002EBA5A4E93256A85916147
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n6kourw2.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
- Size 16KB
- SHA256 e5e27cfeaa76075785e761112e87f1ac0b7b37e3eead3000413b4209a40152c3
- MD5 4e17eb60902ae440cc9579d06dd1315d
- SHA1 e3a969de01637d5065089b1ff17bdd03d5df8089
- SHA512 8020747b4ee62564e14958701dfc354ad905d58c46044d34d4e7fd98aa86edf3e23dc3b06e866d1aeac6d0d7fc1f0336289a236ea0429f9090bc7ddb2a7c81e1
- SSDEEP 384:HXkRyiO024YTDL84KKDL849B7SOEAd9KVRaAcP+AWRMAh:3mZYTDL8lKDL8CB7S/AmVAf+hRMk
- TLSH T19C728E3D5F003CAC25A7C0FCC5E982AA4D18B7A7DEEA806D21183D09C79896DB5F548F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 11KB
- SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
- MD5 25e8156b7f7ca8dad999ee2b93a32b71
- SHA1 db587e9e9559b433cee57435cb97a83963659430
- SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
- SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
- TLSH T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 502KB
- SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
- MD5 e690f995973164fe425f76589b1be2d9
- SHA1 e947c4dad203aab37a003194dddc7980c74fa712
- SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
- SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
- TLSH T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\db\data.safe.tmp
- Size 3KB
- SHA256 9dd25c1148ccada12eda3237ef9390333580e784dc3c198a326abf54fee2d4d2
- MD5 53fb39a9a0ca2bf8cb2124c4464c7a6c
- SHA1 3e2d065d00808331c95ae4083fb8b794b9753762
- SHA512 49fb868dbbd2c56e3da4ef8289f5a9b97e01a92d20642051df7e502dc9cbc3b11351c054657fd55af6f29f1f14dc18e0b467eae1c8c6a3ba1bc855b44e182b18
- TLSH T14B61CB5CF629863FE849813ACD961B412F347456A8AF3F2A35AC604D1E1B2CD768D07D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\db\data.safe.tmp
- Size 7KB
- SHA256 5cf5419963d1255b119ad3e9be0c75ae83d6f0aee8fd033433fc01fa14757213
- MD5 59d0293a3ee869a322e596e861086c2f
- SHA1 cda250d33c655047ca15c03a3c06bc2a3c2169d5
- SHA512 7d7007bb7e422209e28cc1e4697449912c722e77ef510a7326e786f193634ebb7c63d6f73fcf13660ea38cd6a4360646778da399e5a7dcf4542022c59f893dbe
- SSDEEP 192:dl1d66JozGzgCl6mc0dqQcOv5zboPHZxLpyjO1C:djd66JozGzgC1j9bovZNpyj
- TLSH T15BE11F68EA29463FC808027BDCA61B414F39358AA84E3F2835ED741D2C4B2DD768E17D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 b219718a39be0b87945d83536b6dfb5fafdc9b23dc392ab5cde863f13cb4f7b3
- MD5 e8f323fed11e33bb146999cfeffdba11
- SHA1 d5afc2fd485a0ec5a71452693fb717586372ff27
- SHA512 95b7101e042c176501ed27696e7ac4d8388b79890c1450908d8a44b6bf23029192a134038d78dd8971029851b31c5e2692da3cd865a83414d989eee894e4d433
- SSDEEP 192:BQcOv5zbowbxLpyjO1Crl1d66JozGzgCl6mc0dz:IbowbNpyjJjd66JozGzgC1jd
- TLSH T123D12D64EA28463FC848423BCCA51B414F39355BAC4E3F2935EDB4092C9B29E778D1BD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\events\events
- Size 1KB
- SHA256 86e54bf720cdc3a3f14e187eda862ebab4d10356dd5029a094f3eef0d84555ee
- MD5 6fbccfbe2b4e4c386c2189c4ca282b8b
- SHA1 ed9174fb67347e49b480fe2662acb502062d36ba
- SHA512 a1feadf6dc7a3f4daefadd4544b140b2715adae700a86b0b7a5eb36ca9fdf98f1d577534b5878c24b8a656f8227c2b89264f049d16ebb8f03bcdce67649be4ac
- TLSH T1D11157DC39F94D7ED9CBE2987442028D63158A4A05471D4B8E13EF8DCFC1AE9326E439
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\233b3534-d480-413d-9dad-f195ea27c1c0
- Size 2KB
- SHA256 509fb0e2e848439bb9002b7d2ec2730cbc27b64fe97066f9be5f9bda3238c077
- MD5 4cabaca0e07eef5af1a78208d59f8b6a
- SHA1 0672c2d001664dcf52805e52b3dd656190b28c04
- SHA512 176f35849b9008f0039a3154133c534e86fec4c80a78b6c9d014fb56a3f1a9349f9c9f519cc0510106a3edc045c2eb058f44bd006107954d56b45bd230f6cdfb
- TLSH T10D41255C36784CBA8CDAF58DD441338E5764965300C61C932E51EE0D8C9A69D23AA43F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\615e490f-41e9-488a-8818-4ee89887b341
- Size 16KB
- SHA256 c9e0db6051665c8c15310dbb02068c3582ae2f79f9f48f0b679ab4c761da9935
- MD5 57835b1e27ed4d82ea3b7d1fe069e16a
- SHA1 1302ee815176161200a7f163b38c750b5af01347
- SHA512 d4794c7a9c718d464be2845fb4bda105e0c50b78040d834ca2de0ece9b6dff4f85c2a0774ba53871bec02009b6a76d8d5addabffb7be7f0bf1f00df982e32bb0
- SSDEEP 192:k+aJuWVzxJ8b7wHKyJrYTLFLKHSF1Igt+doscZIJIVUz9smUfCmMiKyzlBRx1D3c:EkWVlJ8b7wHKyVYaK8U961LyJD3EXF
- TLSH T19E72E956283045BE8651E798D8F87FC3E1F528CB4C019FCA9BE4BD086DDE06E512794B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\75f9c45a-c8b3-4e36-a441-db30031fce91
- Size 235B
- SHA256 a20d90a5ba8a29f9eaa666085be6b6f7ee03f8787feec18ac989fa30311cf164
- MD5 170ef6db179f65ddea9dd0641b9147dc
- SHA1 e11511a66029318240e2e96c53e8107ca591505e
- SHA512 82910e00384b4830b4419a63dbb61ae95e1c6cfe9e396ff06cdcccc64be09c1cf9d8e9793454ad5944c8adff92370ad44274b7d0f419c30726f3a67876345c40
- TLSH T179D097D818A833BC0C140F0AF0E06AD631888C3360645C50C9A0887499FFAC4423186B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\77e2da51-6d29-4c3c-bfda-59700bd845be
- Size 235B
- SHA256 0aa8a39950e2b27c2dcf0382c190fe563073d6d4867a982e2985da28abc9193e
- MD5 80715789ae0a376af7d98fa9de9ebc7f
- SHA1 d09def56149f9e75103fe3965b44c3c98e2ac5f8
- SHA512 845182307e89340aebc7100da280f779eb0dc88058601aa87a5e8b975c15f367e754359d56f9af1dfda5f53eec05d021a6eed03fa4467af957f8c5a9b4346dd1
- TLSH T1A3D0239058C8339D08200F0BF0F42EC730588C3324B078A0E991843CDAFDEC80179D07
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\99f90690-26c7-44e1-9637-56eb7e84edf6
- Size 886B
- SHA256 5bc1885cad28db5d6966dd433372fde83c7ebfd55e3ae04ff8f7eded2c6f4b75
- MD5 338afc37920bd68f1e669a2ec1d577fd
- SHA1 2142fd407792fbfcbdb4202b9e92421a0c18686d
- SHA512 a19742b6d1a38613a490003c81587d18e1de9e432d6efb4e38da259949ed3a29622c5f3865946e3e2101f7f223dc6af988dd232c6b5e5ee1a6990cef6dc3c397
- TLSH T1BB1140446A21B4B58D6CD28FA191775687B4B113C0C708243EA1AA1C0CEF41E936720F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\pending_pings\c04856ad-d979-4883-9957-81515e1410ad
- Size 883B
- SHA256 0f20c81749035e1836f3613b4fa0778df73792cf16419b82452d97421035d298
- MD5 3499a8b56f2c9fb65754e51ae8814ed0
- SHA1 b18705f37fe9fe4d3dfb5289a6d256cb2218627b
- SHA512 93513bc792a65f2f309ce4016a38799fabc8234f7ca57b8567872013cf7c21d5c14b460a9b9df29d59aa7482319a90691926dddc85bd52d5daf9619687556e4e
- TLSH T13C1100805A3575B6CCA8D24F85953706DBF4761380CA84243EE19A190DBA92E936B20F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\extensions.json
- Size 16KB
- SHA256 3e8670399b515f9ed8879aa2ae8e970346f81194c6604e1efc684e1405ffc72f
- MD5 a49359ab15fb0087af837940ea1d2358
- SHA1 9b269459cbae669fd652afcf3d51a56637058a62
- SHA512 bfd4bc21e9c28f267e6211bd331c1091d450420823fd39cace0cf986654d5291a82cc27fef796d074d482792bf07b9640a61accd0047a15080f6bf4f16c03b1d
- SSDEEP 384:8kI4v3Umldv18dhWE94zh96oaL4HIL4PtL4H2L4H/L4Hol4hs:TI4vRf2XZ4D634q4V4c4D4I4C
- TLSH T17972421545049EB8294EA79BAA367D01C37D433B60855C78F4DD8FC802FB5B902FB66B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
- Size 1.1MB
- SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
- MD5 626073e8dcf656ac4130e3283c51cbba
- SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
- SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
- SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
- TLSH T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
- Size 116B
- SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
- MD5 ae29912407dfadf0d683982d4fb57293
- SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
- SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
- TLSH T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
- Size 1002B
- SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
- MD5 dcffff15fa618a53834ee4ae8673bd23
- SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
- SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
- TLSH T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
- Size 21.6MB
- SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
- MD5 d14dd3f0107ff91c3e21f301d83f82b0
- SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
- SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
- SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
- TLSH T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs-1.js
- Size 6KB
- SHA256 fbb38f54c43c2c290182ebff116bc42904554ad0b45d0bd5e6932cd254e0afbb
- MD5 c2ce470b21a2268d2377378b3a475029
- SHA1 b1e949730e141c196d67543fe68b4fce052e905a
- SHA512 0436ec080ecc8f3639e50d9807739bd98bbbc39d4f2ad3f807ad69838e9d2c1b496f20e8ea019423cbab1d0d33b7a8a3c6d2de7f2c9ce1f4964ba65182e016ab
- SSDEEP 96:xHi+UTUHqGqgaf07GgObzSHk5SSlmdv9j9nuH5lNdHWTBw88n8L4cn3XH1:k+aRgaf0agGSSF5lfWTBw88qV
- TLSH T17BE11F7895088B7F74B677ACAC688C716AB2013B7BBF68D750B55484014CF3482F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs-1.js
- Size 8KB
- SHA256 fb9e7c0eee29bf9d1afd490ddc7841c59ba699559c7555cef4407566146e7fd2
- MD5 496da317689f48176e5da2de4ff4bd3a
- SHA1 258b6004f2134882b02d6e64c5216ac17504433b
- SHA512 efa235eb601c06f13f6f69f775281612eacfa7b8931270149952ccaa5ea627d3c3df363ad05af3b05fe38a05d01ee237a6c9a462a6a8c42c93a0be81b8a4a0d6
- SSDEEP 96:xHi+HwRwcsxTUHqGqgafM87GgObzSHk5SSlmdv9j9nuWR29lNdHWx2WfMjBw88SF:k+/RgafTagGSS0R0lfWmBw88FgV
- TLSH T101021F7C5504CF7F74B6366CAC2988316AA2023BB7BF68DB10B95485014CF3445F9AEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs-1.js
- Size 6KB
- SHA256 7b41adb4a715e24c205966094de923de77cbc633c1b10eccaa8efbeb3043afac
- MD5 2a6b6ee0247908d6aa234df9562c82ba
- SHA1 9b415e69106f9eec222e7645b3fe483d7e433382
- SHA512 3936ffb0b6a7050e82e9078f41ae81329fd50748906849d0f1bb6719059bd060ff72b3c920d09c3b24b55751eda8af1157638ed377ebbf14c77f086351f9737c
- SSDEEP 96:xHi+UTUHqGqgaf07Gg1zSHk5SSlmdv9jmnuH5lNdHWTBw88n8L4cn3XH1:k+aRgaf0aglSSW5lfWTBw88qV
- TLSH T106E12E7895088F7F74B677ACAC6888316AB2013BB7BF68D750B55485014CF3482F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs.js
- Size 6KB
- SHA256 f17ebf2c1b0933adfa3adfc16ed85a21f63f5ae7ef30ec63f7f82049012f0d98
- MD5 7251301d995459748a36fdddfc8bd19d
- SHA1 53faad23a055675540036a533fa558ae96c56875
- SHA512 d98320ae72dea210dee72b9d0b0fa2b05587ea508b34a947792d54e5918863aa83bda63ede54086dd41718e37a2032497d77512a2fe70efe95a244e34ab5e8ef
- SSDEEP 96:xHi+UTUHqGqgaf0io1zSnKSSlmdv9jmnuH5lNdHWTBw88n8L4cn3XH1:k+aRgaf0ioaKSSW5lfWTBw88qV
- TLSH T10AE11F7891088F7F74B677ACAC688871AAB2013B77BF68D750B55485014CF3442F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\prefs.js
- Size 7KB
- SHA256 6678e0dcf293f15b8a682a33c9d15574c4bef9e7825f25ca4f6eb0b2bebec1aa
- MD5 7ad8bbd865569b35d5714bfcf7d07a34
- SHA1 9241122ad0342522800decf4a8c886c4ab556042
- SHA512 cb09b39f6db79013813d4f70ef2264b631cd1a5c109afdf4ef4b130982bbeeb24f8abc6f2122bedb2a49ccaa640011aa8679a211295152db2b934d19e18e9df9
- SSDEEP 96:xHi+HwRwcsxTUHqGqgaf07GgObzSHk5SSlmdv9j9nuH5lNdHWTBw88Sooo8L4cnV:k+/Rgaf0agGSSF5lfWTBw88mV
- TLSH T1EAF11D789104CF7F64B676BCAC6948316AB2013BBBBF68D750B94484014CF3446FA6EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\sessionstore-backups\recovery.baklz4
- Size 1KB
- SHA256 6b6ad7aa03dcbb4f2f7bbb7dcfc2a3b8aa8d4e21679ff0e4632d08eef2b3e4f8
- MD5 a70370b6771a2f7806c4426862f9f306
- SHA1 f5cfb492bf611b64d40de1decc99f54a02045d8c
- SHA512 b604631cc38ca8cad1059d6f78528f6f1f38d41834a848854c1db702b4f58eb79a97e664467f7f3e91d94e7cfbc89c4d9497d3358df3e7c620072d40fbc50e67
- TLSH T19A212BC7C93A29F1BE22871ED0444F5E855B253349760CF0E156590152CE058638F15F
- MD5 SHA1 SHA512 TLSH