Analysis
- max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/09/2026, 02:55
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
26 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
33 signatures
150 seconds
General
- Target 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe
- Size 5.8MB
- Sample260905-des5qsbe79
- SHA256 fcaab121d8608deb838394475f5e1736e0175016d7e9ade239d57acef8cd0b72
- MD5 96258a8456a9c323e0cfe8a7f4fa0def
- SHA1 65117d5e72dba8a2b2318685e9576279e788e7ed
- SHA512 b96cfaeb616398554ef627c4ba7f754a512b4bca1fb1108dac09ce7ff5d86a72df9f4d1c46da5fd702aeef94ef252d98b3ee733e6fcfb78035d43995dc10ee25
- SSDEEP 98304:nLx/yZfUwPTiRuf5P4fmY18frP3wbzWFimaI7dloYiu:nEUGTicTgbzWFimaI7dlX
- TLSH T1C7569D51BF8D817AC95A1130172DAF2A402ABCA8773465D3B2743E7DEC753C26C3A61B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Floxif payload 1 IoCs
resource yara_rule behavioral1/files/0x000b00000002430a-1.dat floxif - Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 5 IoCs
resource yara_rule behavioral1/memory/1120-11-0x0000000000E40000-0x0000000001411000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1120-332-0x0000000000E40000-0x0000000001411000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1120-356-0x0000000000E40000-0x0000000001411000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1120-720-0x0000000000E40000-0x0000000001411000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1120-735-0x0000000000E40000-0x0000000001411000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers - Detects executables containing SQL queries to confidential data stores. Observed in infostealers 5 IoCs
resource yara_rule behavioral1/memory/1120-11-0x0000000000E40000-0x0000000001411000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/1120-332-0x0000000000E40000-0x0000000001411000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/1120-356-0x0000000000E40000-0x0000000001411000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/1120-720-0x0000000000E40000-0x0000000001411000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/1120-735-0x0000000000E40000-0x0000000001411000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore - UPX dump on OEP (original entry point) 8 IoCs
resource yara_rule behavioral1/files/0x000b00000002430a-1.dat UPX behavioral1/memory/1120-3-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/1120-10-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/1120-12-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/1120-300-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/1120-334-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/1120-357-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/1120-549-0x0000000010000000-0x0000000010030000-memory.dmp UPX - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000b00000002430a-1.dat acprotect - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe - Loads dropped DLL 1 IoCs
pid Process 1120 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe /onboot" 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\e: 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe - Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe -
resource yara_rule behavioral1/files/0x000b00000002430a-1.dat upx behavioral1/memory/1120-3-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/1120-10-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/1120-12-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/1120-300-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/1120-334-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/1120-357-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/1120-549-0x0000000010000000-0x0000000010030000-memory.dmp upx - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\System\symsrv.dll 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe File created \??\c:\program files\common files\system\symsrv.dll.000 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Checks processor information in registry 2 TTPs 20 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243" 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3" 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3" 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4} 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe" 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3" 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm" 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\Low Rights 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006} 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe" 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A} 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe" 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe - Modifies registry class 16 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe" 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan" 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1" 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7} 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Model = "247" 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings firefox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter" 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User" 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Therad = "1" 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1120 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe 1120 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe 1120 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe 1120 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe 1120 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe 1120 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 1120 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe Token: SeRestorePrivilege 1120 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe Token: SeDebugPrivilege 4836 firefox.exe Token: SeDebugPrivilege 4836 firefox.exe Token: SeDebugPrivilege 4836 firefox.exe Token: SeDebugPrivilege 4836 firefox.exe Token: SeDebugPrivilege 4836 firefox.exe - Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 4836 firefox.exe 4836 firefox.exe 4836 firefox.exe 4836 firefox.exe 4836 firefox.exe 4836 firefox.exe 4836 firefox.exe 1120 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1120 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 1120 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe 1120 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe 1120 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe 4836 firefox.exe 1120 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe 1120 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe 1120 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe 1120 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe 1120 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe 1120 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe 1120 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe 1120 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe - Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 1120 wrote to memory of 4432 1120 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe 96 PID 1120 wrote to memory of 64 1120 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe 99 PID 64 wrote to memory of 4836 64 firefox.exe 100 PID 64 wrote to memory of 4836 64 firefox.exe 100 PID 4836 wrote to memory of 4020 4836 firefox.exe 101 PID 4836 wrote to memory of 4020 4836 firefox.exe 101 PID 4836 wrote to memory of 4020 4836 firefox.exe 101 PID 4836 wrote to memory of 1264 4836 firefox.exe 102 PID 4836 wrote to memory of 1264 4836 firefox.exe 102 PID 4836 wrote to memory of 1264 4836 firefox.exe 102 PID 4836 wrote to memory of 1264 4836 firefox.exe 102 PID 4836 wrote to memory of 3868 4836 firefox.exe 103 PID 4836 wrote to memory of 3868 4836 firefox.exe 103 PID 4836 wrote to memory of 3868 4836 firefox.exe 103 PID 4836 wrote to memory of 3868 4836 firefox.exe 103 PID 4836 wrote to memory of 1124 4836 firefox.exe 104 PID 4836 wrote to memory of 1124 4836 firefox.exe 104 PID 4836 wrote to memory of 1124 4836 firefox.exe 104 PID 4836 wrote to memory of 4500 4836 firefox.exe 105 PID 4836 wrote to memory of 4500 4836 firefox.exe 105 PID 4836 wrote to memory of 4500 4836 firefox.exe 105 PID 4836 wrote to memory of 4500 4836 firefox.exe 105 PID 4836 wrote to memory of 5624 4836 firefox.exe 106 PID 4836 wrote to memory of 5624 4836 firefox.exe 106 PID 4836 wrote to memory of 5624 4836 firefox.exe 106 PID 4836 wrote to memory of 5624 4836 firefox.exe 106 PID 4836 wrote to memory of 5752 4836 firefox.exe 107 PID 4836 wrote to memory of 5752 4836 firefox.exe 107 PID 4836 wrote to memory of 5752 4836 firefox.exe 107 PID 4836 wrote to memory of 5752 4836 firefox.exe 107 PID 4836 wrote to memory of 5760 4836 firefox.exe 108 PID 4836 wrote to memory of 5760 4836 firefox.exe 108 PID 4836 wrote to memory of 5760 4836 firefox.exe 108 PID 4836 wrote to memory of 5760 4836 firefox.exe 108 PID 4836 wrote to memory of 5876 4836 firefox.exe 109 PID 4836 wrote to memory of 5876 4836 firefox.exe 109 PID 4836 wrote to memory of 5876 4836 firefox.exe 109 PID 4836 wrote to memory of 5876 4836 firefox.exe 109 PID 1120 wrote to memory of 3380 1120 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe 112 PID 1120 wrote to memory of 3728 1120 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe 113 PID 1120 wrote to memory of 3608 1120 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe 114 PID 1120 wrote to memory of 5136 1120 2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe 115 PID 4836 wrote to memory of 5424 4836 firefox.exe 117 PID 4836 wrote to memory of 5424 4836 firefox.exe 117 PID 4836 wrote to memory of 5424 4836 firefox.exe 117 PID 4836 wrote to memory of 5424 4836 firefox.exe 117 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-04_96258a8456a9c323e0cfe8a7f4fa0def_darkgate_elex_floxif_glassworm_remcos_stop.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:4432
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html2⤵
- Suspicious use of WriteProcessMemory
PID:64 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2020 -prefsLen 27099 -prefMapHandle 2024 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {70d91fc1-f966-4c07-98e2-2912bcb843cb} -parentPid 4836 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4836" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu4⤵PID:4020
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2500 -prefsLen 27135 -prefMapHandle 2504 -prefMapSize 270279 -ipcHandle 2512 -initialChannelId {2cdd83d1-53bc-44f1-80c7-b2ba47ec42c8} -parentPid 4836 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4836" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket4⤵PID:1264
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3784 -prefsLen 25164 -prefMapHandle 3788 -prefMapSize 270279 -jsInitHandle 3792 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3800 -initialChannelId {a959cae6-f183-4b7a-bfd3-3fa5fc01a4a1} -parentPid 4836 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4836" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab4⤵
- Checks processor information in registry
PID:3868
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3948 -prefsLen 27276 -prefMapHandle 3952 -prefMapSize 270279 -ipcHandle 4036 -initialChannelId {fc39ccbf-ae8c-4f71-a3f0-1af1fb53d4cb} -parentPid 4836 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4836" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd4⤵PID:1124
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4320 -prefsLen 34775 -prefMapHandle 4324 -prefMapSize 270279 -jsInitHandle 4328 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4336 -initialChannelId {3c55f7f1-a819-4e58-ae31-01688c0f3ceb} -parentPid 4836 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4836" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab4⤵
- Checks processor information in registry
PID:4500
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 1520 -prefsLen 35012 -prefMapHandle 3256 -prefMapSize 270279 -ipcHandle 4892 -initialChannelId {5e46d639-4b82-49ef-ae9e-16e9b50a355a} -parentPid 4836 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4836" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility4⤵
- Checks processor information in registry
PID:5624
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5032 -prefsLen 32952 -prefMapHandle 5000 -prefMapSize 270279 -jsInitHandle 5012 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5044 -initialChannelId {d274d7ff-0385-4f89-9440-6ff147c4f7a7} -parentPid 4836 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4836" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab4⤵
- Checks processor information in registry
PID:5752
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5108 -prefsLen 32952 -prefMapHandle 5112 -prefMapSize 270279 -jsInitHandle 5116 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5080 -initialChannelId {c944321e-9449-4e5e-9961-ff7b7d46acf1} -parentPid 4836 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4836" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab4⤵
- Checks processor information in registry
PID:5760
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5492 -prefsLen 32952 -prefMapHandle 5496 -prefMapSize 270279 -jsInitHandle 5500 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5032 -initialChannelId {e55b3d38-f85d-4123-a417-a84427138724} -parentPid 4836 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4836" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab4⤵
- Checks processor information in registry
PID:5876
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2980 -prefsLen 32952 -prefMapHandle 3916 -prefMapSize 270279 -jsInitHandle 3900 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3888 -initialChannelId {5edc0003-b54d-441d-8887-6b5f759a3f37} -parentPid 4836 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4836" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab4⤵
- Checks processor information in registry
PID:5424
-
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:3380
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:3728
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:3608
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:5136
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\System\symsrv.dll
- Size 67KB
- SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
- MD5 7574cf2c64f35161ab1292e2f532aabf
- SHA1 14ba3fa927a06224dfe587014299e834def4644f
- SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
- SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
- TLSH T17863F1372AB5807DDD210D37949F835AB771E5A76C20643FC25907D988B8DD0E3239AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\System\symsrv.dll.000
- Size 114B
- SHA256 aefc503b1ed462d7b6280228a7b5b710792273b78934426f88325341ac5b5a92
- MD5 e609411db8aa6775d0344c75c23ae79b
- SHA1 1d2ff6194bf159ce36cd0461cd3da29486d1e97d
- SHA512 6884ff5c07bc687132c965a59cb8c5a898a25da74c6c846c1d6089ddca8007cb7e4d2f8520bdce9fbcf6e2f9c9e5c28d8c8d6d049d3522470bdc7d38bbfa0ad0
- TLSH T1FFB09262AA2791EAE1AA224505A0248C1ED0B62AB48638002EBA5A4E93256A85916147
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pltyyssw.default-release\cache2\entries\5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
- Size 16KB
- SHA256 3afecf13396fdedb99b5e226a89f75cf227aa94361c24d1fa9628a4a3d947daf
- MD5 4c44cc29efb4b1fd17c10f8c2092ea00
- SHA1 ce662620d3e6a4f23ba1f366a2856f112735f0d9
- SHA512 4faf97c63256a7072effb9a1c9c4f12acd25f0796031a7b8bdc287c0e22fb159129aca3b55fcc01c8d5756024ae784674321804b043ce3f3f4c3b37fac4fa099
- SSDEEP 384:HkCjiO024YgDL84KKDL849B7SOEAd9KVRaAcP+AWRMAj:EzZYgDL8lKDL8CB7S/AmVAf+hRMW
- TLSH T17C728D795F003CBC1597C0E8C5F9929A8D1CB7A7CFE6806D21583D0DCA98AA9B0F548F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 11KB
- SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
- MD5 25e8156b7f7ca8dad999ee2b93a32b71
- SHA1 db587e9e9559b433cee57435cb97a83963659430
- SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
- SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
- TLSH T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 502KB
- SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
- MD5 e690f995973164fe425f76589b1be2d9
- SHA1 e947c4dad203aab37a003194dddc7980c74fa712
- SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
- SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
- TLSH T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\db\data.safe.tmp
- Size 28KB
- SHA256 a7672addc95642e24e51fcb03060788c412aa8d14d0e52fca7c03a8fed138220
- MD5 3bd041ae1b22e751975a3a653270ccbb
- SHA1 ca75af1f3836e8a03b299bf8921b7ad873af76c6
- SHA512 b377b6b0bc9d98b53abbaa163c9a50143cf7f8cad70d0db5a111d3ee73b066a26b332da06e43b8a98c572fced4a2ce1b5bf6eb33437491a70f8bc751470ded8f
- SSDEEP 384:Ld66JozGzgC1jJUY3CkUZXwuhFbGcmhuUbFRaQ5ij0b9bnbWbS7vbowbVtyj1:EELUmAhxGcmhueRaQ5ij0b9bnbWbKz7u
- TLSH T1FFD20144EB1E953FD41812BBDDA54B002F79B88998092FA73B5C64686C872DC3D9E07F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\db\data.safe.tmp
- Size 28KB
- SHA256 b618ea7884b1dc0da84783e7386805f37729ae7b2f4ea0508ad5f0ec624d541a
- MD5 42e9dcb3e5120234d6d49029228b1684
- SHA1 e39f7f907a6423887e8ac04ed4fbc5816fdc17a7
- SHA512 fa4f867bca065a0797e643a5b9befe4bd8eb65084c01583e5ce860099f03f847568edfaed9261809559eff273e6a7f49c8cd0b07e019fa90c5bf9614b0e04559
- SSDEEP 384:cUY3CkUZXwuhFbGcmhuUbFRaQ5ij0b9bnbWbS78boeZVtyjUd66JozGzgC1jd:cUmAhxGcmhueRaQ5ij0b9bnbWbK0DgE/
- TLSH T1A2D2EF44EB1E953FD41812BBDDA54B002F79B88998092FA73A5C64686C872DC3D9E07F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\events\events
- Size 1KB
- SHA256 5c630f02e089bfa7dd824683d3244d05a97402cebf755c2a2b4ab1850d863894
- MD5 fd5a8c66f7df2043f0966588b0a58044
- SHA1 dda0c7737d746bbbbfe8477d551ee88c49fc964a
- SHA512 806fed3ebb83536b3965627ffa73eecb9c981811978e7956befd1a61bc33e7ce77d4f5149028a3f5d375842f5b3c9d8bab1317f458b408a4d9dbd9ba2336c99e
- TLSH T11E214C6C39FA4D6A5FC7FA9C7441028E57218B4644871D434D62EF8DCEC1ADA326A439
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\5176d674-f7e4-4398-9e5b-e7aba220b3c8
- Size 2KB
- SHA256 541487ae192c3f5a572d77259e82a318b590a23bcabf6b89b8bf494fc6f93513
- MD5 803d3675a6a748a40c5dedfc962fa674
- SHA1 f1db45868e3e9d1ab76126074c03d8f4131eb7aa
- SHA512 65a2a5ff72aa76f822cc91fff236328fe912cb415b01539b5e228c8ab41d3fdf2d90c4438d69e125aa2ee0b4c890459bf85e8ec4a13adff627ab82b00233562c
- TLSH T16141645C35789CB78CDAE69DDC81238D57248F1300C66D432E52EE0C8C9AF5E276B43A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\5cbcedf2-1d8d-4a84-a1b7-9f452769dffd
- Size 871B
- SHA256 24d673c4233ad3d815580f360b31f0afccf41f99da29d49ee6b9930bdc6ecf95
- MD5 06f279a61946d7490ce2a3b1ea06adf4
- SHA1 ed3a11a58b632794b7a8e363b2a7f2774d4b9d52
- SHA512 0e4fb177050e000b6290780486ab737821c66a6695724fa5842941055e08dcb6ff79527b53d0838ec836d5b77e7ea9c6f10a554dd4d58d86658fbec6dc154a56
- TLSH T1B411E355A734FAB3CC68C34BCA513B065FE4B62380C995147FA419180D7A91EA3BA70B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\7e9ec23e-cdee-480e-b2e9-001d398e4fd3
- Size 886B
- SHA256 19be893d04baf9b26ec52f7d5b8fbfe8f38ec5faf8bb924a9997e1380b7a30f3
- MD5 df1a421113f5141a65d76c71d4155a44
- SHA1 281a6bd7accac06cd8bc68f5cac723253685dd80
- SHA512 f8e95d579781a881bfd9ae0a2618c6b533b0acac6490708568981942b9fbe818d21a187bb87f0065cee296fcc7f401ba9b547529d13749490a8e73f8a9b764cd
- TLSH T1721144514774B5B2CC24D28BC8A077014FD4B923C0CD49147F940A084CBA81EB36A207
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\82fdcf1f-0630-4971-88bd-823e7b4c4638
- Size 235B
- SHA256 bf5342b45ba3cc7abdecbc0ebd8da95acf7c5b80d365e9facd140a8c8cdbc711
- MD5 4e6e7f3461c09507afe16bf0956fc407
- SHA1 769851ea25c8be8f8bffdd0458d3eab03af51f77
- SHA512 d5255b7ac5f7cd3f0e0bfbe63825a31b1faade2021bcbc1722f99a5acd3572e97bd44b078202fc4e7b55324c9b3eaf3bb1011123764b0300ef057c16b1f9ca46
- TLSH T1D9D0978064ECA33D28100F03F0B16AC631844C3358B1A820A66109B499BEEC842A1D5A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\bb172300-1311-4930-96ad-7797c27c61a6
- Size 235B
- SHA256 dfcd0a24efa6d90501f86a72f388e3b321ccd3cb152955f87cafac85766d5da9
- MD5 8e2d9264e1063f60cc5f5b872929e700
- SHA1 d72c65cb1a5989f556e5920922df3f020bdcfeec
- SHA512 5038c62f6dc44e3448a74a26679994c924b30e89e5df568d813f7e588d9e231494d79bee872f9157ba85009a1e0b22c82c178334eb3ee5d63e7770f63c114555
- TLSH T187D097C058A8AB2D68180F1AF0E06DD630A88C336070682099A081788DB8EC612A28A6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\extensions.json
- Size 16KB
- SHA256 647c7816e1de5f2e21f0350250d813576f765567705d75754b15cb3481bacdb9
- MD5 621b93c545938730a13929cfd27d8052
- SHA1 cbdb3119fe231d39964f722fbb08af0998641dc9
- SHA512 5ad343f12916cf19fbcc5c23ca4c149d5840a98836ede8f5cb9cb9d7b67b3d8800e5d3894c2e1508e67ffd5a3fe040538e5ab6a0119b0afb2de0283a68187ca6
- SSDEEP 384:xzkI4vlUmldvc8dhWt94zT96osL4HdL4PHL4HxL4HEL4H7C4hR:mI4dRfFXQ4d614d4D4J4+4+4r
- TLSH T1EE72431545049EB8298F979AAA367E01C37D433B60845C38F4DD8FC842FB5B902FB66B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
- Size 1.1MB
- SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
- MD5 626073e8dcf656ac4130e3283c51cbba
- SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
- SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
- SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
- TLSH T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
- Size 116B
- SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
- MD5 ae29912407dfadf0d683982d4fb57293
- SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
- SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
- TLSH T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
- Size 1002B
- SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
- MD5 dcffff15fa618a53834ee4ae8673bd23
- SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
- SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
- TLSH T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
- Size 21.6MB
- SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
- MD5 d14dd3f0107ff91c3e21f301d83f82b0
- SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
- SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
- SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
- TLSH T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs-1.js
- Size 6KB
- SHA256 20afa3d909edf6ebfb69de20368128a9b80a015cbb147367ab15d9b81a0a18f4
- MD5 499c7a6ace4f77f1da7201a88149fa6e
- SHA1 0950ef0e8a60b730aa0e4b6088178b552bd6182c
- SHA512 0bc0d7bb2192e3c6b94e4ab3823e54fe8bceccdbe74808ebd21628ef90eceeb66dc947c439dad744d9a96bc709f917fc92c4856ead84c86688fec5a052eda678
- SSDEEP 96:xH4fUTUOPqGqsWf2471zS1pSSladv9jhnIHeABw88n8L4cnTDEx:mf5RsWf247GSSDeABw88qY
- TLSH T185E120789518CB7F74B677ACAC6888316AB2413B7BBF68D710B95484050CF3442F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs-1.js
- Size 7KB
- SHA256 ceb5ee3ee3ff63bf0b737fda8acfbfc4fbf63bcef28ce5a7b1d7d89daa7d0979
- MD5 9effc8d2a14c431c27cf327cc27f60a2
- SHA1 4c4b799c9beba68ce0edfa572c9bfdb9c9164250
- SHA512 7683b7803f4c642336ea2e96db2c988a5ecf11cc1b3bc3eb20895a826122f5d4b7302dc898baa93a9e01d6077c552c6c04beae87745742bf995899479f7ea9b5
- SSDEEP 96:xH4f1TUOPqGqsWf247ObzS1pSSladv9jhnIWRgKYXBw88VH8L4cnTDEx:mfkRsWf247NSSKR/YXBw88oY
- TLSH T1F3F1FE789104CB7F75B676ACAC2488316AB2023B76BF6CD610B95485050CF3546FAAEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs.js
- Size 6KB
- SHA256 a5f00a3ac1ef83c65f6dd07f6679ecd00ff22388adf22f22adb83af362ca5796
- MD5 b2aff1ee72bed980fe935a066a301698
- SHA1 a144e28c73a50a3fdf215edc691f5475fe9f59c8
- SHA512 3b6b4d161fb0a6cbcfba062b92e05e04fe75b11a62b451cdde325a69f85d86b5efbdcd50955f85b6c11704bb16c842bc11666a49cd90cacd97c60234e868f4c2
- SSDEEP 96:xH4fUTUOPqGqsWf24P1zS+XSSladv9jO8nIHeABw88n8L4cnTDEx:mf5RsWf24PPXSS9eABw88qY
- TLSH T16DE1207895188F6F74B677ACAC6888716AB2413B7BBF68D710B954C4010CF3442F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\sessionstore-backups\recovery.baklz4
- Size 1KB
- SHA256 9334d250c4cbd6fe1d2fcf0cfcd59adb6d5c919f82536412d1ca3459f33400f4
- MD5 0b3446c4bd2d02d367d6b1ee01e09ba1
- SHA1 bb59b9ffebb524821154d7f89d5c698ad52deff2
- SHA512 8775f342f03b05dc7db84d7640d3dce4dc007d4375d65478fed7a898a32f40007b0f91ce31d7c35dcb5defc1c18261424c92ffd346650c36af6a101780587220
- TLSH T169212B6352B73EB97E335055C845C7F5C157343044314CE0C1A92E69B1FD40A734E01E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\sessionstore-backups\recovery.baklz4
- Size 4KB
- SHA256 cfb6b294bec8c42ff26b43416e3c0fbfff8af75cfef0164a062c0a66cbf2d882
- MD5 f9e3980ab9ae23081a09b0ba2132e780
- SHA1 0e4b5d0fc869e57b1d80ede032d0ff19ecf274b5
- SHA512 573394ae9a566c5305234880ee03dc9040b1f93c28c7412c7d1c9cddf98fd5321d7549539f49bb0c7ffb579854222221f60cb61473928652ab42f8b7202ee146
- SSDEEP 96:eAfX+xRYJSQeW9jILA0NjoB8kMJttn0YJZQB1:vXyIOnNcB85JttnTZE1
- TLSH T13D915B06371B396BFDAB858E9E4988F140A4350A998188D890CF3E29B36BB4B755C475
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 4.1MB
- SHA256 48de272a9f9736a7e474168e8ef6fa7624d3b6c4194396ece9328a80581f1ac7
- MD5 9ea339820c75619beb5e574765e90e66
- SHA1 81ef10c8bf8f0ef0362f115b4f94644a95ad1e9b
- SHA512 ec4daeea79cfc50114c3589ccd8f72dd3beb869186f3c9e0fb5a03a334e16cb646b866474b3448f2456643d65b22399743b9301888457043a69a02617cf6fc3f
- SSDEEP 49152:gDmggukjA5lUM2D8pcNeaKvgmRBbFOY2g/:Ymhuk856M2o6eaKvgmT/
- TLSH T19A1639F824D1A257F3818037668563EF21AFD00C6467DD484BE966F990B8CDF9E05B2E
- MD5 SHA1 SHA512 SSDEEP TLSH