Analysis
- max time kernel
148s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
13/08/2026, 15:35
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
27 signatures
150 seconds
General
- Target 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe
- Size 5.9MB
- Sample260813-s1rlcsswaz
- SHA256 614c64b31f7db1b4af0ca4d8cf203418b922e7cb0eab7e829685635940b6bfb8
- MD5 128e59739c3383407276e671b1019bab
- SHA1 528b4a29f5d860418ad9d751dd03408edc6a664a
- SHA512 d4e8471fc13964f22c75526f09f136cd7c9e585f254cdf339575b97324e1739ee88e495520f5a3fc32ad41654cea0ca5a314e8fb714dba998d6f40f18bb72d00
- SSDEEP 98304:lxLv5QU3Kyyj6P4o18frP3wbzWFimaI7dlosx:JQU33yjPgbzWFimaI7dlX
- TLSH T10D569D52BF4CC17AC95A2570272DAF2A5029BD25773915C3A2783E7EDC313C26C3A61B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Floxif payload 1 IoCs
resource yara_rule behavioral1/files/0x000b000000024323-1.dat floxif - Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 5 IoCs
resource yara_rule behavioral1/memory/4108-11-0x0000000000270000-0x0000000000846000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/4108-410-0x0000000000270000-0x0000000000846000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/4108-429-0x0000000000270000-0x0000000000846000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/4108-585-0x0000000000270000-0x0000000000846000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/4108-593-0x0000000000270000-0x0000000000846000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers - Detects executables containing SQL queries to confidential data stores. Observed in infostealers 5 IoCs
resource yara_rule behavioral1/memory/4108-11-0x0000000000270000-0x0000000000846000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/4108-410-0x0000000000270000-0x0000000000846000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/4108-429-0x0000000000270000-0x0000000000846000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/4108-585-0x0000000000270000-0x0000000000846000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/4108-593-0x0000000000270000-0x0000000000846000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore - UPX dump on OEP (original entry point) 9 IoCs
resource yara_rule behavioral1/memory/4108-3-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/files/0x000b000000024323-1.dat UPX behavioral1/memory/4108-10-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/4108-12-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/4108-280-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/4108-411-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/4108-430-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/4108-547-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/4108-597-0x0000000010000000-0x0000000010030000-memory.dmp UPX - A potential corporate email address has been identified in the URL: [email protected]
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000b000000024323-1.dat acprotect - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe - Loads dropped DLL 1 IoCs
pid Process 4108 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe /onboot" 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\e: 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe - Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe -
resource yara_rule behavioral1/memory/4108-3-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/files/0x000b000000024323-1.dat upx behavioral1/memory/4108-10-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/4108-12-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/4108-280-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/4108-411-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/4108-430-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/4108-547-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/4108-597-0x0000000010000000-0x0000000010030000-memory.dmp upx - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\System\symsrv.dll 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe File created \??\c:\program files\common files\system\symsrv.dll.000 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Checks processor information in registry 2 TTPs 20 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3" 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe" 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe" 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Low Rights 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3" 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe" 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3" 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm" 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243" 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A} 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006} 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4} 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe - Modifies registry class 16 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe" 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan" 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User" 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Therad = "1" 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\WOW6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D} 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter" 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1" 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD} 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Model = "224" 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4108 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe 4108 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe 4108 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe 4108 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe 4108 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe 4108 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 4108 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe Token: SeRestorePrivilege 4108 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe Token: SeDebugPrivilege 3912 firefox.exe Token: SeDebugPrivilege 3912 firefox.exe Token: SeDebugPrivilege 3912 firefox.exe Token: SeDebugPrivilege 3912 firefox.exe Token: SeDebugPrivilege 3912 firefox.exe - Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 3912 firefox.exe 3912 firefox.exe 3912 firefox.exe 3912 firefox.exe 3912 firefox.exe 3912 firefox.exe 3912 firefox.exe 4108 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 4108 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe - Suspicious use of SetWindowsHookEx 11 IoCs
pid Process 4108 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe 4108 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe 4108 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe 3912 firefox.exe 4108 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe 4108 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe 4108 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe 4108 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe 4108 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe 4108 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe 4108 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe - Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 4108 wrote to memory of 2688 4108 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe 93 PID 4108 wrote to memory of 2640 4108 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe 98 PID 2640 wrote to memory of 3912 2640 firefox.exe 99 PID 2640 wrote to memory of 3912 2640 firefox.exe 99 PID 3912 wrote to memory of 3952 3912 firefox.exe 100 PID 3912 wrote to memory of 3952 3912 firefox.exe 100 PID 3912 wrote to memory of 3952 3912 firefox.exe 100 PID 3912 wrote to memory of 1764 3912 firefox.exe 101 PID 3912 wrote to memory of 1764 3912 firefox.exe 101 PID 3912 wrote to memory of 1764 3912 firefox.exe 101 PID 3912 wrote to memory of 1764 3912 firefox.exe 101 PID 3912 wrote to memory of 4732 3912 firefox.exe 103 PID 3912 wrote to memory of 4732 3912 firefox.exe 103 PID 3912 wrote to memory of 4732 3912 firefox.exe 103 PID 3912 wrote to memory of 4732 3912 firefox.exe 103 PID 3912 wrote to memory of 1568 3912 firefox.exe 104 PID 3912 wrote to memory of 1568 3912 firefox.exe 104 PID 3912 wrote to memory of 1568 3912 firefox.exe 104 PID 3912 wrote to memory of 3128 3912 firefox.exe 105 PID 3912 wrote to memory of 3128 3912 firefox.exe 105 PID 3912 wrote to memory of 3128 3912 firefox.exe 105 PID 3912 wrote to memory of 3128 3912 firefox.exe 105 PID 3912 wrote to memory of 5516 3912 firefox.exe 106 PID 3912 wrote to memory of 5516 3912 firefox.exe 106 PID 3912 wrote to memory of 5516 3912 firefox.exe 106 PID 3912 wrote to memory of 5516 3912 firefox.exe 106 PID 3912 wrote to memory of 5580 3912 firefox.exe 107 PID 3912 wrote to memory of 5580 3912 firefox.exe 107 PID 3912 wrote to memory of 5580 3912 firefox.exe 107 PID 3912 wrote to memory of 5580 3912 firefox.exe 107 PID 3912 wrote to memory of 5588 3912 firefox.exe 108 PID 3912 wrote to memory of 5588 3912 firefox.exe 108 PID 3912 wrote to memory of 5588 3912 firefox.exe 108 PID 3912 wrote to memory of 5588 3912 firefox.exe 108 PID 3912 wrote to memory of 5600 3912 firefox.exe 109 PID 3912 wrote to memory of 5600 3912 firefox.exe 109 PID 3912 wrote to memory of 5600 3912 firefox.exe 109 PID 3912 wrote to memory of 5600 3912 firefox.exe 109 PID 3912 wrote to memory of 5620 3912 firefox.exe 110 PID 3912 wrote to memory of 5620 3912 firefox.exe 110 PID 3912 wrote to memory of 5620 3912 firefox.exe 110 PID 3912 wrote to memory of 5620 3912 firefox.exe 110 PID 4108 wrote to memory of 2068 4108 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe 113 PID 4108 wrote to memory of 2412 4108 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe 115 PID 4108 wrote to memory of 1068 4108 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe 116 PID 4108 wrote to memory of 3120 4108 2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe 117 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-13_128e59739c3383407276e671b1019bab_darkgate_elex_floxif_glassworm_remcos_stop.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:2688
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html2⤵
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html3⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2004 -prefsLen 27099 -prefMapHandle 2008 -prefMapSize 270279 -ipcHandle 2084 -initialChannelId {443c0085-63cf-4d04-b754-b1499eab41ff} -parentPid 3912 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3912" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu4⤵PID:3952
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2480 -prefsLen 27135 -prefMapHandle 2484 -prefMapSize 270279 -ipcHandle 2492 -initialChannelId {028e14f7-ade4-49ea-971d-9d852bd9ed0d} -parentPid 3912 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3912" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket4⤵PID:1764
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3732 -prefsLen 25164 -prefMapHandle 3736 -prefMapSize 270279 -jsInitHandle 3740 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3748 -initialChannelId {a4f68fac-690a-4885-b147-ea51cd2080f6} -parentPid 3912 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3912" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab4⤵
- Checks processor information in registry
PID:4732
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3892 -prefsLen 27276 -prefMapHandle 3896 -prefMapSize 270279 -ipcHandle 3964 -initialChannelId {dc7072bd-3db5-412f-9bb3-02d6e40a50c1} -parentPid 3912 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3912" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd4⤵PID:1568
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4324 -prefsLen 34775 -prefMapHandle 4328 -prefMapSize 270279 -jsInitHandle 4332 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1628 -initialChannelId {11ba7cd4-a028-44ef-bd93-4472ed8d604d} -parentPid 3912 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3912" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab4⤵
- Checks processor information in registry
PID:3128
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4844 -prefsLen 35012 -prefMapHandle 4840 -prefMapSize 270279 -ipcHandle 4832 -initialChannelId {53086b08-8d0a-4a41-84cd-1be127c3819f} -parentPid 3912 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3912" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility4⤵
- Checks processor information in registry
PID:5516
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4952 -prefsLen 32900 -prefMapHandle 4956 -prefMapSize 270279 -jsInitHandle 4960 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4968 -initialChannelId {197811cd-8e2c-4abe-8142-56523a3c6f10} -parentPid 3912 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3912" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab4⤵
- Checks processor information in registry
PID:5580
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5092 -prefsLen 32900 -prefMapHandle 5096 -prefMapSize 270279 -jsInitHandle 5100 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5104 -initialChannelId {a312abca-a520-4c73-933f-2225121ffd55} -parentPid 3912 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3912" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab4⤵
- Checks processor information in registry
PID:5588
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5408 -prefsLen 32952 -prefMapHandle 5412 -prefMapSize 270279 -jsInitHandle 5416 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4956 -initialChannelId {1f53ae30-1efd-4f15-ba6d-984e14dfc9a6} -parentPid 3912 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3912" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab4⤵
- Checks processor information in registry
PID:5600
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5628 -prefsLen 32952 -prefMapHandle 5632 -prefMapSize 270279 -jsInitHandle 5636 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5644 -initialChannelId {9bf08df2-8d02-416b-b8cd-fe9d0eba3a6f} -parentPid 3912 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3912" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab4⤵
- Checks processor information in registry
PID:5620
-
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:2068
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:2412
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:1068
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:3120
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\System\symsrv.dll
- Size 67KB
- SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
- MD5 7574cf2c64f35161ab1292e2f532aabf
- SHA1 14ba3fa927a06224dfe587014299e834def4644f
- SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
- SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
- TLSH T17863F1372AB5807DDD210D37949F835AB771E5A76C20643FC25907D988B8DD0E3239AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\System\symsrv.dll.000
- Size 114B
- SHA256 aefc503b1ed462d7b6280228a7b5b710792273b78934426f88325341ac5b5a92
- MD5 e609411db8aa6775d0344c75c23ae79b
- SHA1 1d2ff6194bf159ce36cd0461cd3da29486d1e97d
- SHA512 6884ff5c07bc687132c965a59cb8c5a898a25da74c6c846c1d6089ddca8007cb7e4d2f8520bdce9fbcf6e2f9c9e5c28d8c8d6d049d3522470bdc7d38bbfa0ad0
- TLSH T1FFB09262AA2791EAE1AA224505A0248C1ED0B62AB48638002EBA5A4E93256A85916147
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ho495kqa.default-release\startupCache\webext.sc.lz4
- Size 104KB
- SHA256 ced86ca2a038e1f30644474fa964413980d134020c31abdbb62c215bd4552aa3
- MD5 28ed0c5afbf065535bb8b7c0e6c94138
- SHA1 69874fe7819a6f778ffc18d69cdcff8869716cec
- SHA512 4fff730b6bd7264f7886fe4eecde1ade54e8b66484d80820782153575b0d2a4169ab380348cb915c825ab2b7d39ec7cc1d0649391da63efb6d49ef4df3984c16
- SSDEEP 1536:jTrliEeXzDuGA2R90GjVcAtsKEhaYBAQ/eGXM2Cn0D+nW4HJhqaLszwCNojXFQnf:j3l2A2R9tDtsFqQ/eSMMcE1BATG
- TLSH T17FA39FF6DBE2CE3D94FFD42D6A82C83EFC262400B3A72019C963275166C6B746675748
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 11KB
- SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
- MD5 25e8156b7f7ca8dad999ee2b93a32b71
- SHA1 db587e9e9559b433cee57435cb97a83963659430
- SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
- SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
- TLSH T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 502KB
- SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
- MD5 e690f995973164fe425f76589b1be2d9
- SHA1 e947c4dad203aab37a003194dddc7980c74fa712
- SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
- SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
- TLSH T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 5e6c668f6e62cde74ad83342f5f08a1042c22b3a96bc76d5913f916739dadf7f
- MD5 c63344843a864f94e42de67dd6521b68
- SHA1 46314b0428eb4b67b409e3acc9adee16d4964641
- SHA512 312b35e8b9d1f16fc6ffe87dca4f754d442cdd3c0cd0d5c9acc97f31c8d3b1564238d8cd1398ea5e45f9ceb6d7deba9ba1616bc1a5e40ac3848f274bd3a8278c
- SSDEEP 192:xm1d66JozGzgCl6mc0d3POv5zbowbqmyjFCw:xAd66JozGzgC1j9gbowbqmyjL
- TLSH T17ED11EA4EA28463FC408037BCCA51F810F35395BE84E7F2931AD755C2C5A29E768D17E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\db\data.safe.tmp
- Size 7KB
- SHA256 8baa82b84e8d064e02710cab384f6f4f371dceaacf60decdefc23cb7931ff9b4
- MD5 8434bbd3cc90381f19d728d73986b60b
- SHA1 1ea389d480b0b6483cf556d0b6423708dd53dbf6
- SHA512 b78b2188a58a8dc250df18a29650cf8aa24c34725ecf95e61c495b7d42e5578af5424c552962754842886a74c5d32b6b785b8221fa279551b5519031f550bf38
- SSDEEP 192:Mm1d66JozGzgCl6mc0dgPOv5zboPnZqmyjFC:MAd66JozGzgC1j+gbofZqmyj
- TLSH T151E100A8EA28463BC409037BDCA61F810F35395BE84E7F29359D745C2C562DE368D17E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\events\events
- Size 1KB
- SHA256 eba590c3c246ee936994aed44206ab1c4c5938b15df81b117b3524ef112323ee
- MD5 e620f06e9ab228b2e9b3d1549bda99d3
- SHA1 410ad0c7618759f408e46b689e714e51a57eda3d
- SHA512 2af0e92add8195a2106711cf3431d9c31b9927faefcf0ae085013a0bfab0c3480f9377ec9ed0fef0b41c4b279069ef05db6f5b94cc94261e604cfb959ddc4b39
- TLSH T13E217C8C79B8CDBAB987E29C7441128E53514E0B08871C438E02EF8DCED1AD9716E43D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\22318184-42f6-47c2-b063-3990c0029ec0
- Size 16KB
- SHA256 f44b74a2a450c230a3f4f794715a8ecaf1dd8264ffd91c6b4b21e3a2071e9cd6
- MD5 bd96f013c37d7747acf38240cb18d129
- SHA1 2f34fa7700e0aafb7c12d64dad799dfaf4fe1ff2
- SHA512 29dc3995305f20b29a360d5709276708cb505453b5626085a21fba2a72d26628386c6dcbe5bef0bfae28511cd93dcfbbea7733432b9308373f6ae211e7e2d4b0
- SSDEEP 192:QHzNOBKxIFL2HtGjkBWvmq9kG0gGjrk8Lyd9EB5huI+5B1YuBP7aQbuWDV3GKiJN:w6d2HUVyD+PVeQSYV2KiJn6A1so5
- TLSH T12072C856682045BA8251E36998FCBFC3E6F638CF4C419FCADBE47D0819DE06E112794B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\45ae00ab-5bed-498e-b85f-40c53bb3a1c3
- Size 886B
- SHA256 3f6ef78d1f5243294abc52781769aaa1c524a94de9d5e8d625b90741cf034c52
- MD5 0f72990f734c9f9a81572c8d675b50c4
- SHA1 56e7a685834b45942b2858b5387b5def26e03624
- SHA512 aa417d7af63fb12a2f87f6fe05eca9c0e9fe212fb6f83aba0954eecd7d34d9b0b3a567227957f0325e03ae82d5ea506f2f333870a3014bd44d825460da142112
- TLSH T1011123C58E3079728C6C938BA5D4BB934BE07433D0CA58143D917E280CEA52E932A207
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\9d32d603-01bc-4a27-8bcb-70ee9b08aaf6
- Size 883B
- SHA256 1dca7f702279b77e58dae2acfc712f292cb8cd9d9d4e30df6e43c213a26b66c9
- MD5 28470a2a69a792f024e1d18949057701
- SHA1 ff29021a0008ecda9f32ff1cb8dc70e4316ee089
- SHA512 f4af2804310fe5d85495b421e50d352fc9a92aa9b0174c3733f57e1224e5ced58eae1b415bac190ea24b5cc6f6f79b7c2e04138896fa3dd3a8c6f8e2128ea1a4
- TLSH T1001123919A30B973CCACD28BC69537425BE47A23C0CA84143DA12E280DBA52E936A607
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\ba13ea2a-9de5-4ac9-a070-1501ab69a7eb
- Size 2KB
- SHA256 069ff4675be349fabf54878061468136fc1e7a25bdf17b936b7ab1439d4421e9
- MD5 a56376331b7ce1ea9c9e8ff7a9971e1c
- SHA1 1dfdb4834d93d7eeecd5ef070cf16cd09a09abbe
- SHA512 f3f25ec6f14d2984a70672e5d360fa02382ce2dcec1b0940cfc4765c2c5d43d077d4a54b749e5061d3717f3d4d3b90d8783b407605b6981a442af30a954f8918
- TLSH T12541236C36784C779CDBF2CDD982238E57654B1340C628832E52EE0C8C9A75A236E537
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\cccfdde1-f29f-420f-aeca-592716865290
- Size 235B
- SHA256 25c9dd81067c1b10e7b9b0d048ec4af0d178a6554d7a0830d69e6378525b55c0
- MD5 d3122c2dc16e961106eb67e78ad34d38
- SHA1 0135179dabc25bf3c5fac5801e9a01161679e4db
- SHA512 b9386adc723ad4cec9f0ee3038a56a7ae40a86c03481ff8028e0c43049727681f10e6cc959e3bb27b5e8779cb5f10abb0d8569ac8e3f5a9fd52b83cf5e8603ed
- TLSH T1E3D097C154982B1E08040F03B0A028C63084CC3368B45810CB60453DCAFEAC80111827
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\datareporting\glean\pending_pings\f833794b-83f6-4f18-b714-9f47c1d37cbf
- Size 235B
- SHA256 4b536740405f31ffc31b91332f6f26b23be38c2f39fcecccf4657b4d199f0560
- MD5 8ac390453db3aa709137a3bbe67c18fb
- SHA1 aa305e8bac805962625e33e557f7472dfd98d3d5
- SHA512 f46bc05c6530cc1b94427896fd40fdf52556f6d0a2b847e33148db6025f51c4377223b1bcac8017a93c76b9a23bbb51520043fc2dc0e438095da792cf0538a26
- TLSH T1D1D097A61488A31D08040F02F0E169CA30588C3310A8A860E99040349AF9EC80131C86
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\extensions.json
- Size 16KB
- SHA256 5ecb612e4801ae02482f40a8c3e563435de480ac5c00b20009e7ee512a595ca6
- MD5 1c8d86990265aa8599d05df961931579
- SHA1 761661f909d4a2143edfea129e7d2582086cb596
- SHA512 71d58bcea8cf273c9c1594c2f35e30d9ad559a1de8d572f372eed2d584f37738c50478aa9cdaf41ef8ae7ab01a2c067c70b140f4ffbeaa16ce78fd0690cd756a
- SSDEEP 384:uskI4vdUmldvt8dhWE94z2p96o3L4HLL4PfL4HXL4HzL4HRf4hK:ujI4VRfOXN4e60434L474f4J4U
- TLSH T18472531545049E78294EA78BEA367E01C37D573B60845C78F4DD8FC802FA5B902BBA6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
- Size 1.1MB
- SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
- MD5 626073e8dcf656ac4130e3283c51cbba
- SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
- SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
- SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
- TLSH T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
- Size 116B
- SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
- MD5 ae29912407dfadf0d683982d4fb57293
- SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
- SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
- TLSH T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
- Size 1002B
- SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
- MD5 dcffff15fa618a53834ee4ae8673bd23
- SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
- SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
- TLSH T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
- Size 21.6MB
- SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
- MD5 d14dd3f0107ff91c3e21f301d83f82b0
- SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
- SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
- SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
- TLSH T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs-1.js
- Size 7KB
- SHA256 558712c2e18a6e8531ecc548fa0961f233f41ec3d2d62577c4b36acd3cd284d2
- MD5 9a89e288b738502ea457c9e7e49a9471
- SHA1 6e9366930807f99b589e89ec9d5061d9640b3640
- SHA512 c19b5c224b7687fbaba6bf7dffcd022a4a3ce54cd7513ac03c14c4b295eab8cad0ef04d42959c143c7b0d235acda938b51723c6cda1e2e7cc6b6a6ff79c8e57d
- SSDEEP 96:xHc9TUuqGqdf2e6ObzSOqSSlDdv9junERHsBO+yJ8Bw88n8L4cnrzBHK:6oRdf2e6QqSS59vmBw88+w
- TLSH T194F11F786404CB7F78F6766CAC2888715AB2023BBABF68C714A954D4050CF3446F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs-1.js
- Size 6KB
- SHA256 47de6e94f78bfea07e718ebf8c495d490da42b3657896c4a504a9169a84a9a48
- MD5 dac9b5c2c03457ca6f2b0919b160096e
- SHA1 60cecdae12b61a76a9f79b99628a4360a1c65247
- SHA512 39e8eb16c44a2dc24c3848cd6e581e3a62c1a6f9862ee0835ff5746477ce0b55b90900fe3c160feb7f029fbe297c818ae7d46443026ab2befbd24d28dfda8fe0
- SSDEEP 96:xHcUTUuqGqdf2e61zSOqSSlDdv9junERH9O+y1Bw88n8L4cnrzBHK:65Rdf2e6PqSS59A1Bw88+w
- TLSH T1D1E1317894088B7F74B6776CAC6888716AB2013BBBBF68C750B554C4050CF3446F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\prefs.js
- Size 6KB
- SHA256 81deb86e79fb261c32f86e8e866b34d7c678fa418192271e390a2f34c60a005c
- MD5 bd0ff1668b67dd4e1cdb9dc12c750c4a
- SHA1 bb5e5fdc49d50245cb62302d53940bb34113a993
- SHA512 5d88f324daae43dd1125fce6e80a44010a9e27d876b137c8dbee7c137da594e719f50879719e0818b6ceb856b7702ef60391d335b2911c5aa317feabe868ebf6
- SSDEEP 96:xHcUTUuqGqdf2oE1zSHSSlDdv9jznERH9O+y1Bw88n8L4cnrzBHK:65Rdf2oEaSSe9A1Bw88+w
- TLSH T1EEE1307894088F7F64B676ACAC6888716AB2413BB7BF6CC750B954C5050CF3442F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\sessionstore-backups\recovery.baklz4
- Size 4KB
- SHA256 b319614ce3982c4b36532f8e12a5b9ec26d4ec856655b7570495d6524af4f4c3
- MD5 10eb34891a10e416f6337c0fdddd6d23
- SHA1 d31d55fdca12fa85ed5a5ae0360e6e991bfb889f
- SHA512 2e40f21e5c99fecbfad13d2aa030c89d64e9f73c80b7eb8b0a604676d0ff234bb67db08479b9dc9ba1104c65ced697bae702eccf1164dc9776b9d220f8b45e84
- SSDEEP 96:e4foKOtYJ9O9QeW9jILA0NjoB8kMJttn0YJZQB/E+:ToLIOnNcB85JttnTZE/E+
- TLSH T19D917D05361F79E7FE6F854FDE890CE144B4310A568048D890CF7B6AB72FA4B74580B1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 4.1MB
- SHA256 711bf3ccc9705722e95fc8202153ca6101f51f76e590a0096f67c7c02334e9fe
- MD5 1222cf50f60af6005e0156d0d1484b2b
- SHA1 1e9fcfb1f080fc9a73db73df2005afce0d58fe7e
- SHA512 8dd585b8c3f7c5f64a30ab8942dc0efd1902f35a57fb74d8327c013470018031487a83413d7c44a254c469a8cb58f0cb4b6b5f00a44dec74c3ad507f903ebc55
- SSDEEP 49152:WDmgsukjA5lUl2DF0cNeaKvgmRBbFOYwg/:ym9uk856l2xheaKvgmF/
- TLSH T1751639F824D1A257F3818037668563EF21AFD00C6467DD484BE966F990B8CDF9E05B2E
- MD5 SHA1 SHA512 SSDEEP TLSH