Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
15/08/2026, 03:44
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
27 signatures
150 seconds
General
- Target 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe
- Size 5.8MB
- Sample260815-eag3cael6t
- SHA256 569a57d08c3f2448e0e75514eba369d2184ff29c4552d778f6a35a1e0d81b5a4
- MD5 67cf8bec6f11a7149a1937fb4452b11c
- SHA1 4cfdf94848466d3a1a5a34490d9cc6872bca0bab
- SHA512 69f43db3394fc4afcd5968c41f2136703005fddaa7d17dec854dbf646e29a28c2bb84a0397b846ec5c12584c733e99efc5542fdbf441d035f7285f4047b2ef3f
- SSDEEP 98304:jTz31rPWQ6QYqThwNP43A718frP3wbzWFimaI7dloZ:f1P5tYq9pgbzWFimaI7dlO
- TLSH T121569D52BF4C827AC95A11301B2DAF2A502EBC68773455D3B2743E7EDC763C16C3A61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Floxif payload 1 IoCs
resource yara_rule behavioral1/files/0x000a000000024250-1.dat floxif - Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 5 IoCs
resource yara_rule behavioral1/memory/2320-12-0x00000000005A0000-0x0000000000B73000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2320-413-0x00000000005A0000-0x0000000000B73000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2320-424-0x00000000005A0000-0x0000000000B73000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2320-781-0x00000000005A0000-0x0000000000B73000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2320-789-0x00000000005A0000-0x0000000000B73000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers - Detects executables containing SQL queries to confidential data stores. Observed in infostealers 5 IoCs
resource yara_rule behavioral1/memory/2320-12-0x00000000005A0000-0x0000000000B73000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/2320-413-0x00000000005A0000-0x0000000000B73000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/2320-424-0x00000000005A0000-0x0000000000B73000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/2320-781-0x00000000005A0000-0x0000000000B73000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/2320-789-0x00000000005A0000-0x0000000000B73000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore - UPX dump on OEP (original entry point) 10 IoCs
resource yara_rule behavioral1/files/0x000a000000024250-1.dat UPX behavioral1/memory/2320-3-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/2320-14-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/2320-13-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/2320-330-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/2320-414-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/2320-425-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/2320-775-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/2320-782-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/2320-807-0x0000000010000000-0x0000000010030000-memory.dmp UPX - A potential corporate email address has been identified in the URL: [email protected]
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000a000000024250-1.dat acprotect - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe - Loads dropped DLL 1 IoCs
pid Process 2320 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe /onboot" 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\e: 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe - Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe -
resource yara_rule behavioral1/files/0x000a000000024250-1.dat upx behavioral1/memory/2320-3-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/2320-14-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/2320-13-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/2320-330-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/2320-414-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/2320-425-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/2320-775-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/2320-782-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/2320-807-0x0000000010000000-0x0000000010030000-memory.dmp upx - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\System\symsrv.dll 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe File created \??\c:\program files\common files\system\symsrv.dll.000 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Checks processor information in registry 2 TTPs 20 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3" 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3" 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe" 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243" 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4} 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe" 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A} 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006} 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm" 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3" 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe" 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Low Rights 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe - Modifies registry class 16 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1" 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD} 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan" 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Therad = "1" 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter" 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe" 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User" 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Model = "226" 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\WOW6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D} 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2320 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe 2320 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe 2320 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe 2320 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe 2320 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe 2320 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe 2320 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe 2320 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 2320 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe Token: SeRestorePrivilege 2320 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe Token: SeDebugPrivilege 4708 firefox.exe Token: SeDebugPrivilege 4708 firefox.exe Token: SeDebugPrivilege 4708 firefox.exe Token: SeDebugPrivilege 4708 firefox.exe Token: SeDebugPrivilege 4708 firefox.exe - Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 4708 firefox.exe 4708 firefox.exe 4708 firefox.exe 4708 firefox.exe 4708 firefox.exe 4708 firefox.exe 4708 firefox.exe 2320 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2320 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 2320 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe 2320 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe 2320 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe 4708 firefox.exe 2320 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe 2320 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe 2320 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe 2320 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe 2320 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe 2320 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe - Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 2320 wrote to memory of 2632 2320 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe 89 PID 2320 wrote to memory of 2604 2320 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe 90 PID 2604 wrote to memory of 4708 2604 firefox.exe 91 PID 2604 wrote to memory of 4708 2604 firefox.exe 91 PID 4708 wrote to memory of 4824 4708 firefox.exe 92 PID 4708 wrote to memory of 4824 4708 firefox.exe 92 PID 4708 wrote to memory of 4824 4708 firefox.exe 92 PID 4708 wrote to memory of 3200 4708 firefox.exe 93 PID 4708 wrote to memory of 3200 4708 firefox.exe 93 PID 4708 wrote to memory of 3200 4708 firefox.exe 93 PID 4708 wrote to memory of 3200 4708 firefox.exe 93 PID 4708 wrote to memory of 1564 4708 firefox.exe 94 PID 4708 wrote to memory of 1564 4708 firefox.exe 94 PID 4708 wrote to memory of 1564 4708 firefox.exe 94 PID 4708 wrote to memory of 1564 4708 firefox.exe 94 PID 4708 wrote to memory of 1624 4708 firefox.exe 95 PID 4708 wrote to memory of 1624 4708 firefox.exe 95 PID 4708 wrote to memory of 1624 4708 firefox.exe 95 PID 4708 wrote to memory of 4080 4708 firefox.exe 96 PID 4708 wrote to memory of 4080 4708 firefox.exe 96 PID 4708 wrote to memory of 4080 4708 firefox.exe 96 PID 4708 wrote to memory of 4080 4708 firefox.exe 96 PID 4708 wrote to memory of 5172 4708 firefox.exe 97 PID 4708 wrote to memory of 5172 4708 firefox.exe 97 PID 4708 wrote to memory of 5172 4708 firefox.exe 97 PID 4708 wrote to memory of 5172 4708 firefox.exe 97 PID 4708 wrote to memory of 5508 4708 firefox.exe 98 PID 4708 wrote to memory of 5508 4708 firefox.exe 98 PID 4708 wrote to memory of 5508 4708 firefox.exe 98 PID 4708 wrote to memory of 5508 4708 firefox.exe 98 PID 4708 wrote to memory of 5844 4708 firefox.exe 99 PID 4708 wrote to memory of 5844 4708 firefox.exe 99 PID 4708 wrote to memory of 5844 4708 firefox.exe 99 PID 4708 wrote to memory of 5844 4708 firefox.exe 99 PID 4708 wrote to memory of 5852 4708 firefox.exe 100 PID 4708 wrote to memory of 5852 4708 firefox.exe 100 PID 4708 wrote to memory of 5852 4708 firefox.exe 100 PID 4708 wrote to memory of 5852 4708 firefox.exe 100 PID 4708 wrote to memory of 5860 4708 firefox.exe 101 PID 4708 wrote to memory of 5860 4708 firefox.exe 101 PID 4708 wrote to memory of 5860 4708 firefox.exe 101 PID 4708 wrote to memory of 5860 4708 firefox.exe 101 PID 2320 wrote to memory of 6120 2320 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe 116 PID 2320 wrote to memory of 2684 2320 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe 117 PID 2320 wrote to memory of 3196 2320 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe 118 PID 2320 wrote to memory of 3132 2320 2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe 119 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-15_67cf8bec6f11a7149a1937fb4452b11c_darkgate_elex_floxif_glassworm_remcos_stop.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:2632
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html2⤵
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html3⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2020 -prefsLen 27099 -prefMapHandle 2024 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {94dad922-1a81-4a21-b339-6b323802cdf5} -parentPid 4708 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4708" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu4⤵PID:4824
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2496 -prefsLen 27135 -prefMapHandle 2500 -prefMapSize 270279 -ipcHandle 2508 -initialChannelId {86abd0b9-f539-41d2-a440-12efe94ad2c1} -parentPid 4708 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4708" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket4⤵PID:3200
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3996 -prefsLen 25164 -prefMapHandle 4000 -prefMapSize 270279 -jsInitHandle 4004 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4012 -initialChannelId {c8564f55-b971-4bad-9003-be14732c2fa7} -parentPid 4708 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4708" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab4⤵
- Checks processor information in registry
PID:1564
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4188 -prefsLen 27276 -prefMapHandle 4192 -prefMapSize 270279 -ipcHandle 4276 -initialChannelId {16766014-5335-4246-80d9-c8b0696d866f} -parentPid 4708 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4708" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd4⤵PID:1624
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3944 -prefsLen 34775 -prefMapHandle 4564 -prefMapSize 270279 -jsInitHandle 4568 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3376 -initialChannelId {2231888d-eac3-42e2-a8a1-616d260534ef} -parentPid 4708 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4708" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab4⤵
- Checks processor information in registry
PID:4080
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2836 -prefsLen 35012 -prefMapHandle 4832 -prefMapSize 270279 -ipcHandle 4868 -initialChannelId {bbee1779-2a64-4ea6-b7e8-8101cf04726f} -parentPid 4708 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4708" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility4⤵
- Checks processor information in registry
PID:5172
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5104 -prefsLen 35064 -prefMapHandle 5108 -prefMapSize 270279 -jsInitHandle 5112 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5080 -initialChannelId {46cf02af-f116-4c81-bb4a-06b5cd138fd5} -parentPid 4708 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4708" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab4⤵
- Checks processor information in registry
PID:5508
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5484 -prefsLen 32952 -prefMapHandle 4076 -prefMapSize 270279 -jsInitHandle 4104 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4412 -initialChannelId {937b0667-c615-4437-95fa-c37b194148c1} -parentPid 4708 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4708" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab4⤵
- Checks processor information in registry
PID:5844
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4068 -prefsLen 32952 -prefMapHandle 4016 -prefMapSize 270279 -jsInitHandle 4064 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4056 -initialChannelId {12c1fe2c-6b4c-4fbb-9db0-371aa27bb00b} -parentPid 4708 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4708" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab4⤵
- Checks processor information in registry
PID:5852
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5812 -prefsLen 32952 -prefMapHandle 5816 -prefMapSize 270279 -jsInitHandle 5820 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5828 -initialChannelId {395fd00d-3aa9-4212-9142-20dcb4c762b4} -parentPid 4708 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4708" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab4⤵
- Checks processor information in registry
PID:5860
-
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:6120
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:2684
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:3196
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:3132
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\System\symsrv.dll
- Size 67KB
- SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
- MD5 7574cf2c64f35161ab1292e2f532aabf
- SHA1 14ba3fa927a06224dfe587014299e834def4644f
- SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
- SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
- TLSH T17863F1372AB5807DDD210D37949F835AB771E5A76C20643FC25907D988B8DD0E3239AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\System\symsrv.dll.000
- Size 114B
- SHA256 aefc503b1ed462d7b6280228a7b5b710792273b78934426f88325341ac5b5a92
- MD5 e609411db8aa6775d0344c75c23ae79b
- SHA1 1d2ff6194bf159ce36cd0461cd3da29486d1e97d
- SHA512 6884ff5c07bc687132c965a59cb8c5a898a25da74c6c846c1d6089ddca8007cb7e4d2f8520bdce9fbcf6e2f9c9e5c28d8c8d6d049d3522470bdc7d38bbfa0ad0
- TLSH T1FFB09262AA2791EAE1AA224505A0248C1ED0B62AB48638002EBA5A4E93256A85916147
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5hc785nf.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
- Size 16KB
- SHA256 73e76d9425497f7d29e86fecf96fae4397cb6840b8d8f7c40091ca9dfea07523
- MD5 35acb3d60388dad9067bc5c737c28470
- SHA1 6dad2b1e0e044d3d64c47bbe662b78e7024e3a69
- SHA512 bdb444765627c6433f35ef4601c811d65e6a7a1a719f4c75d6792d24d8a34de513b9d0153b5395d50bc437ebdfa9bc2f720ab7f06324e93018a5d6cb0e8765ea
- SSDEEP 384:HXkRyiO024YuDL84KKDL849B7SOEAd9KVRaAcP+AWRMAV:3mZYuDL8lKDL8CB7S/AmVAf+hRMs
- TLSH T1CC727D3D5F003CAC25A7C0E8C5A992AA4D08B7A7DFE6C0AD21183D0DC798969B5F548F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 11KB
- SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
- MD5 25e8156b7f7ca8dad999ee2b93a32b71
- SHA1 db587e9e9559b433cee57435cb97a83963659430
- SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
- SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
- TLSH T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 502KB
- SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
- MD5 e690f995973164fe425f76589b1be2d9
- SHA1 e947c4dad203aab37a003194dddc7980c74fa712
- SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
- SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
- TLSH T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 c0ccbe1ea6f9c01801fe43096f4236f0c1dd7fe6a0d1f0380e1c815a24f621b8
- MD5 6f31de524115042e401174c801b5163b
- SHA1 051b5537c7f53ff274a2c02657115baba9cac4e0
- SHA512 a2a31114632769a46865577c511cb5530b06553848b61c90d7b71935dd277dd488188c5c6a3c7bcf4222f397824cc6d324dd1b0872abbc3dbed2fcdf235ece22
- SSDEEP 192:d1d66JozGzgCl6mc0dLOv5zborZbWyjO3P:7d66JozGzgC1j+borZbWyjS
- TLSH T184E10D64F628867FC404027BCCA61F814F3A389B984E3F15359C64482D5B6DE7A8D1BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\db\data.safe.tmp
- Size 3KB
- SHA256 b645309c90c144ee1bead1e06e3017e2f610b8abe88f6ad1e45efd8ba7ca835a
- MD5 5527d37241fec65cdc0d82da1f22e3da
- SHA1 1caceeaa7a25c038589fdb8b3fef8d80350936c9
- SHA512 60001a4d4966a4330fba3ccac135ce0280c7ae9fe26d73ccb99cff15e97c9c0981a3825185cb69109624f2a6deae02c3a45537dd696540debab111802c306501
- TLSH T1D661D95CF629863FE445413ACC965B411F347857A8AF3F2A39ACA08D1E5B2CD368D07E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\events\events
- Size 1KB
- SHA256 fa2144df51039c5dda56f1d5159778a064e28635f8fc496f3fb99c4b58cb198a
- MD5 2fee959c6268d2b922218e79d7fa925b
- SHA1 954eed3185d5355e206813a329779bfac3787365
- SHA512 271e4edd1d7d117e771292283f7fa9f6f2146bd6614dcbd321b7ca51be00435cf6554998f2462ae5dd8629a5394389bf0aef2ace84994f0ca6d6a7868197ed94
- TLSH T110214B9C39B88D3AB987F65C7441228E93514A0B04471C578E12EF8DCED1ADD326F469
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\11e12d6b-324c-46e3-8cb5-ee484dec8e91
- Size 15KB
- SHA256 3dabc88859a3981b861423d3841fad6432f6f4ec1aeeb57c1a8aa89287241d69
- MD5 fdaabf6149b56bab6a69ac4637a9009f
- SHA1 0d9a0728b7ca0ed17617cd188ae7a5c01cd4eb22
- SHA512 6f41e4b5dba1e4eefaa3321f61780170f59b319e3636d2a389e00f2610b55531886159bdfb8ab054c1b494fbb4aeff46d4b36d282efd8ee894a21033481806fe
- SSDEEP 384:mfyyPxcjKxiRlKkS7i0tPXTHkOF2gH5xZDbKj0iv:mJ5cWPtF2gvZ3zi
- TLSH T10B72C8562820497E8691E36994FCBFC7E5F528CF4C418FCA9BE0BD086DDE06E112784B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\35519fbd-94b2-4549-a192-86e53def2c2c
- Size 883B
- SHA256 26839799d4f6187dd326eee9f000ad9e0df8f17e4308edf6cca22bc6a9bc5c76
- MD5 066ff222cc13996a44ed0eae50cac4ae
- SHA1 318fcb109d75ba56220596974f1d27b2b111da92
- SHA512 9cea412cd970e49fec8455f362abeec6b2290587f632863ea303a1d9c93d46dbb91e2a0ce0c1214b6c7cbef7b424efadb3447a684165a1eca9e324b927c06d88
- TLSH T153110440D6357AF2CC68924FC55537428FF4751384C954143ED40E040D7ED1EA666307
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\355ebc43-222e-4f0b-8d4c-07b8216ae961
- Size 886B
- SHA256 92e5a982214956bb61949105890892e511c3d501294b53805e3c507f09ff63d7
- MD5 af414cec21e486f66279644cb5ad676c
- SHA1 5afa5c515ad3c532f79652f3d14c60839b21750e
- SHA512 6badcb683633da90d3c7ab08fa4bf7de55cd45f79ba4c363638c6def03c17ed07d39719498179823efb20b4bd2768606aba1a34c97fb49308099817ef5339ac8
- TLSH T16911E3D0EA38FEF2CC78928BD5B17B428BF4786380CA58547E945E080DBA51E6766347
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\893ad68d-33ed-4746-b6bb-2444c9a510ce
- Size 2KB
- SHA256 4d0642ceb2a296d23944ca8f86a1e058ed603ffe08a9d4191faae9d92599ca43
- MD5 e8270b85b0a6800093d2d220cc594838
- SHA1 c5d1361f38e9ddc70ccd869c9da00c5fac3e8f54
- SHA512 b0caca011f97b69e5ec568075ee4bdb5f296c530e4b144880526e625fa3d700ae9e4e0b42c090c7fbb0e3634ff511f786a394e5868fd096f5eb18afaae8e6a37
- TLSH T1E141435935784DB69CEAE58DE442338E43708A0300C62C836D61DE0CCE97AAD337A577
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\cf912e76-46c1-405a-a82b-98c049b440e2
- Size 235B
- SHA256 87ff09f653ed29dcd951e5cb1243e9725893b22c96f42e1bacf9fcc4a2225ee1
- MD5 fb96254a5016d4a123d3ed737ed5dc84
- SHA1 4aacaf7a51f0f83b7aa2624100f84841f66fdda4
- SHA512 7ba79efedb9b082167656b739ead1407ae37ffb2cc564d6ca85f430c7e7f9ef104cf0e38fcacc195db0935c32e0b1748c09d255f51ae6f084f8497a8d5903fbb
- TLSH T114D0A780649867AD08181F47F0E06EC672494C3328755C10D6615A749AFDEC94751977
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\datareporting\glean\pending_pings\ecc51ef6-b3b7-4db7-9059-d53fc4ef5324
- Size 235B
- SHA256 efe69f24473cddb863fbf065a113bd1cb846b6b27964b347729c1bdc37ef6c32
- MD5 3d346f5a503e7dbfb677ea6a73dd6689
- SHA1 47bae17835bb5b9bb40f07a24a7f6cbf6cae761f
- SHA512 d6afde32ade0fd3ffae05bfad078c6e68897cb873c79042fe1fe2e146be2366092145fb6d822537b18f64724667c91aca96e0dfd6345d3e3b97a4ad28b5dfd55
- TLSH T1DBD097C0589823AC0C140F06B0B06AD270488C3B24699820D6910638EABE9C4432294A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\extensions.json
- Size 16KB
- SHA256 cb332b294078b0d26148e7d2bd83d507c03335b8b9b1d885d247aae2762448f4
- MD5 c66b2672b5a424984bf1149293eddf2a
- SHA1 aaa8f1157afca3733749c3f5eea9340ace7c8feb
- SHA512 2d34396ef0a004d69fa223b32017f3ac5a1a0e5f7c0c6b8ad0f4b502c45834992f77830d5bc9c81ef53a23bd0491af6a5012dd26a78b145bf83bcf0d7121695a
- SSDEEP 384:AkI4vyUmldvXf8dhWnV94z6196opL4HBL4PlL4HDL4HfL4HwF4h8:nI4qRf/0Xen4K6W454d4P4j4s4W
- TLSH T1EE72521545048EB8294FA79BAA367E02C37D533B60845C78B4DD8FC842FB5B902FB65B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
- Size 1.1MB
- SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
- MD5 626073e8dcf656ac4130e3283c51cbba
- SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
- SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
- SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
- TLSH T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
- Size 116B
- SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
- MD5 ae29912407dfadf0d683982d4fb57293
- SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
- SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
- TLSH T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
- Size 1002B
- SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
- MD5 dcffff15fa618a53834ee4ae8673bd23
- SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
- SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
- TLSH T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
- Size 21.6MB
- SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
- MD5 d14dd3f0107ff91c3e21f301d83f82b0
- SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
- SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
- SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
- TLSH T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs-1.js
- Size 8KB
- SHA256 fe83d790569a108733cb5ea78f9ed4a103c4eba56e6c846a65570aeca38b7b3b
- MD5 63959bf586954961731462496f20d5ad
- SHA1 556a33046fb38a40448700dd6fe6796576c0226c
- SHA512 a174f8be4341cf850382a8694ae3ff4153ff188d04d8c03892152fe8ab426b8c502b90194df6b039a4f1579e0016e85181aacdff9720217a2686748fe9ceba06
- SSDEEP 96:xHHdTUZfvqGqqkf20zObzSsSSlDdv9jrnLWR+L4/37cBw886jC8L4cn/MVzW:9dRFf20zmSSERm4/3wBw88k+g
- TLSH T1FA02FE385004CB7FB4B6366CAC288D315AB2023BB7BF68D715B95485055CF3446FA6EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs.js
- Size 6KB
- SHA256 fda0e9efe41355d761543f9f2e856620eea5c0323dc16dd808756c5e6dfa28f5
- MD5 291121c0c9fbefd493dfff53a8738b36
- SHA1 b6a6abe42d7f0718242529647b20ca22efc51893
- SHA512 89a2897663827852302b572957034d969db0b227238a5f2e8df8c5ab66ca4fc68092a6826a9096b50541af18b7fe871b664f12c6cf314cac53cedb95487f69d1
- SSDEEP 96:xHHUTUZfvqGqqkf+Rt1zSYSSlDdv9j4nLHH4/39Bw88n8L4cn/MVzW:9QRFf+RtFSSWH4/39Bw889g
- TLSH T180E12E7891088F7F64B677ACAC688D316AB2013BB7BF68D650B65484054CF3442F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs.js
- Size 6KB
- SHA256 9f0067e75ac73085d33ac2319041e22b2c61bc483176c8eae6eb729793826e1d
- MD5 ef546c629cb33cb685eee853abc69008
- SHA1 32b63cf0222efa62df1dfb6fdf0300f1a9c1adc2
- SHA512 8a6f9af937f3684996cef7b74594ba490abb259a9a4bbb2ca7d6e2d8bbb2b5e68ac0d2f9e85fa621818168df2237e7cc876a140ace359043e60e247577be443c
- SSDEEP 96:xHHUTUZfvqGqqkf+0z1zSsSSlDdv9j4nLHH4/39Bw88n8L4cn/MVzW:9QRFf+0z9SSWH4/39Bw889g
- TLSH T1FCE13E7891088F7FB4B6776CAC288D316A72013BB7BF68D650B55484055CF3442F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\prefs.js
- Size 7KB
- SHA256 61edddf3a89d49534bbc0f297a4aa1f4af5a7918bfd50d2510d821b044f25efb
- MD5 23a6fc12218c11d43cdfa54fb2ea4193
- SHA1 32210d16f382f6cb583f11531753d621fe367a9a
- SHA512 e018d0fb1f5581e6ff97a886e1a3d7b1a37efe279612517ffa2ced5b830ff699795af2201eb5e42cca959e61eb35da8b4075b72cecb4b0fbba69550e4391c6da
- SSDEEP 96:xHHdTUZfvqGqqkf+0zObzSsSSlDdv9jrnLHH4/39Bw88M8L4cn/MVzW:9dRFf+0zmSSVH4/39Bw88Yg
- TLSH T17FF11E785108CF7FB4B6366CAC288931AA72013BB7BF68D710B95484055CF3446FA6EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5hc785nf.default-release\sessionstore-backups\recovery.baklz4
- Size 4KB
- SHA256 85b0d2c0cc5b0e79b6d06ebaf7574b2c02dc6d2b35d2ac5ee554c99b6063ddd3
- MD5 8cf6a32d194285442b20f297fe080726
- SHA1 9c3ef83a551da8e91d82d4bdff91eec8dc592328
- SHA512 a845340c06ca106af2f9725b38f72c6988596613d55343ca1c48c78870e3d3d539b93d3c8f08bbd22d142854dc792702d8bbd4fdb02f6b84ed1ca8bbf8b3afb4
- SSDEEP 96:ezfbt69H9+iEQeW9jILA0NjoB8kMJttn0YJZQBt:6xrIOnNcB85JttnTZEt
- TLSH T11F919D06330F68A7FD9B858FEE594CF105B0310A688084EC90CF7A26B36BE0BB5594B5
- MD5 SHA1 SHA512 SSDEEP TLSH