Analysis
- max time kernel
148s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
12/09/2026, 16:22
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
27 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
34 signatures
150 seconds
General
- Target 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
- Size 6.0MB
- Sample260912-tvb46aee28
- SHA256 235fab12b509c0fb7e4e9b215ae6d205b2a0e1a08419f1c8cd20ade528ed2482
- MD5 dbea41d61168570c6e7b9681e50c145f
- SHA1 44a52f4087983e39abd8fe2a3ddf4f7ecd06dc0d
- SHA512 552a54da3473a56351646230120fb0f81928a33e6349fbb11ec5a4ef2624440651bc69cc6ad2b9113893010dc1096e2af7b4d59d4bf6e1cc6942c91f3362f789
- SSDEEP 98304:pS0hHtf+NA9XuGqqP4C18frP3wbzWFimaI7dlo5gw:FHF+NA9XujVgbzWFimaI7dlvw
- TLSH T1A5569D51BE4D8176D90B1132472D9F2A102ABD287B3865D3B2B43E7EEC363C16D3961B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Floxif payload 1 IoCs
resource yara_rule behavioral1/files/0x0010000000024324-1.dat floxif - Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 4 IoCs
resource yara_rule behavioral1/memory/2352-23-0x00000000009D0000-0x0000000000FC3000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2352-424-0x00000000009D0000-0x0000000000FC3000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2352-433-0x00000000009D0000-0x0000000000FC3000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2352-727-0x00000000009D0000-0x0000000000FC3000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers - Detects executables containing SQL queries to confidential data stores. Observed in infostealers 4 IoCs
resource yara_rule behavioral1/memory/2352-23-0x00000000009D0000-0x0000000000FC3000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/2352-424-0x00000000009D0000-0x0000000000FC3000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/2352-433-0x00000000009D0000-0x0000000000FC3000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/2352-727-0x00000000009D0000-0x0000000000FC3000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore - UPX dump on OEP (original entry point) 17 IoCs
resource yara_rule behavioral1/files/0x0010000000024324-1.dat UPX behavioral1/memory/2352-3-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/1104-12-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/1104-14-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/2352-16-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/2352-24-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/2412-400-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/2412-402-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/836-404-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/836-406-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/1736-408-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/1736-410-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/2416-412-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/2416-413-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/2352-425-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/2352-434-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/2352-700-0x0000000010000000-0x0000000010030000-memory.dmp UPX - Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x0010000000024324-1.dat acprotect - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Loads dropped DLL 6 IoCs
pid Process 2352 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 1104 regsvr32.exe 2412 regsvr32.exe 836 regsvr32.exe 1736 regsvr32.exe 2416 regsvr32.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe /onboot" 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\e: 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe -
resource yara_rule behavioral1/files/0x0010000000024324-1.dat upx behavioral1/memory/2352-3-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/1104-12-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/1104-14-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/2352-16-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/2352-24-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/2412-400-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/2412-402-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/836-404-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/836-406-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/1736-408-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/1736-410-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/2416-412-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/2416-413-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/2352-425-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/2352-434-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/2352-700-0x0000000010000000-0x0000000010030000-memory.dmp upx - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\System\symsrv.dll 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe File created \??\c:\program files\common files\system\symsrv.dll.000 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Checks processor information in registry 2 TTPs 20 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe" 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe" 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3" 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4} 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006} 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3" 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Low Rights 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3" 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A} 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm" 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243" 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe" 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Modifies registry class 16 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan" 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User" 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1" 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Therad = "1" 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7} 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter" 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe" 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings firefox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Model = "255" 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2352 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 2352 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 2352 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 2352 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 2352 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 2352 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 2352 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Token: SeRestorePrivilege 2352 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Token: SeDebugPrivilege 1104 regsvr32.exe Token: SeDebugPrivilege 4368 firefox.exe Token: SeDebugPrivilege 4368 firefox.exe Token: SeDebugPrivilege 2412 regsvr32.exe Token: SeDebugPrivilege 836 regsvr32.exe Token: SeDebugPrivilege 1736 regsvr32.exe Token: SeDebugPrivilege 2416 regsvr32.exe Token: SeDebugPrivilege 4368 firefox.exe Token: SeDebugPrivilege 4368 firefox.exe Token: SeDebugPrivilege 4368 firefox.exe - Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 4368 firefox.exe 4368 firefox.exe 4368 firefox.exe 4368 firefox.exe 4368 firefox.exe 4368 firefox.exe 2352 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2352 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 2352 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 2352 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 2352 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 4368 firefox.exe 2352 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 2352 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 2352 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 2352 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 2352 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 2352 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 2352 wrote to memory of 1104 2352 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 84 PID 2352 wrote to memory of 736 2352 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 85 PID 736 wrote to memory of 4368 736 firefox.exe 86 PID 736 wrote to memory of 4368 736 firefox.exe 86 PID 4368 wrote to memory of 4764 4368 firefox.exe 87 PID 4368 wrote to memory of 4764 4368 firefox.exe 87 PID 4368 wrote to memory of 4764 4368 firefox.exe 87 PID 4368 wrote to memory of 4756 4368 firefox.exe 88 PID 4368 wrote to memory of 4756 4368 firefox.exe 88 PID 4368 wrote to memory of 4756 4368 firefox.exe 88 PID 4368 wrote to memory of 4756 4368 firefox.exe 88 PID 4368 wrote to memory of 3508 4368 firefox.exe 89 PID 4368 wrote to memory of 3508 4368 firefox.exe 89 PID 4368 wrote to memory of 3508 4368 firefox.exe 89 PID 4368 wrote to memory of 3508 4368 firefox.exe 89 PID 4368 wrote to memory of 1088 4368 firefox.exe 90 PID 4368 wrote to memory of 1088 4368 firefox.exe 90 PID 4368 wrote to memory of 1088 4368 firefox.exe 90 PID 4368 wrote to memory of 4664 4368 firefox.exe 91 PID 4368 wrote to memory of 4664 4368 firefox.exe 91 PID 4368 wrote to memory of 4664 4368 firefox.exe 91 PID 4368 wrote to memory of 4664 4368 firefox.exe 91 PID 4368 wrote to memory of 3384 4368 firefox.exe 92 PID 4368 wrote to memory of 3384 4368 firefox.exe 92 PID 4368 wrote to memory of 3384 4368 firefox.exe 92 PID 4368 wrote to memory of 3384 4368 firefox.exe 92 PID 4368 wrote to memory of 3132 4368 firefox.exe 93 PID 4368 wrote to memory of 3132 4368 firefox.exe 93 PID 4368 wrote to memory of 3132 4368 firefox.exe 93 PID 4368 wrote to memory of 3132 4368 firefox.exe 93 PID 4368 wrote to memory of 744 4368 firefox.exe 94 PID 4368 wrote to memory of 744 4368 firefox.exe 94 PID 4368 wrote to memory of 744 4368 firefox.exe 94 PID 4368 wrote to memory of 744 4368 firefox.exe 94 PID 4368 wrote to memory of 4504 4368 firefox.exe 95 PID 4368 wrote to memory of 4504 4368 firefox.exe 95 PID 4368 wrote to memory of 4504 4368 firefox.exe 95 PID 4368 wrote to memory of 4504 4368 firefox.exe 95 PID 4368 wrote to memory of 2408 4368 firefox.exe 96 PID 4368 wrote to memory of 2408 4368 firefox.exe 96 PID 4368 wrote to memory of 2408 4368 firefox.exe 96 PID 4368 wrote to memory of 2408 4368 firefox.exe 96 PID 2352 wrote to memory of 2412 2352 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 97 PID 2352 wrote to memory of 836 2352 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 98 PID 2352 wrote to memory of 1736 2352 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 100 PID 2352 wrote to memory of 2416 2352 2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 101 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1104
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html2⤵
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2004 -prefsLen 27099 -prefMapHandle 2008 -prefMapSize 270279 -ipcHandle 2084 -initialChannelId {d26626b6-c3dc-4cdc-ac48-8993c897d225} -parentPid 4368 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4368" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu4⤵PID:4764
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2484 -prefsLen 27135 -prefMapHandle 2488 -prefMapSize 270279 -ipcHandle 2496 -initialChannelId {cfcc73fc-4434-4ba3-a2b1-25bf2b9f65e9} -parentPid 4368 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4368" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket4⤵PID:4756
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3652 -prefsLen 25164 -prefMapHandle 3656 -prefMapSize 270279 -jsInitHandle 3660 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3664 -initialChannelId {c789460e-c099-4bfc-8fda-f130835e8631} -parentPid 4368 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4368" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab4⤵
- Checks processor information in registry
PID:3508
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3812 -prefsLen 27276 -prefMapHandle 3816 -prefMapSize 270279 -ipcHandle 3908 -initialChannelId {3267c358-717f-4266-baea-2363fb1822b7} -parentPid 4368 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4368" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd4⤵PID:1088
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4276 -prefsLen 34775 -prefMapHandle 4268 -prefMapSize 270279 -jsInitHandle 4284 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4412 -initialChannelId {da8a7129-0b5e-4a55-9ba3-cf08bc43a8f1} -parentPid 4368 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4368" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab4⤵
- Checks processor information in registry
PID:4664
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2744 -prefsLen 35012 -prefMapHandle 4996 -prefMapSize 270279 -ipcHandle 4988 -initialChannelId {0a2830b0-db02-408c-9142-f31904609e83} -parentPid 4368 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4368" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility4⤵
- Checks processor information in registry
PID:3384
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5160 -prefsLen 32952 -prefMapHandle 5164 -prefMapSize 270279 -jsInitHandle 5168 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5176 -initialChannelId {506dda86-d54b-4796-bf85-a643e930cdc1} -parentPid 4368 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4368" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab4⤵
- Checks processor information in registry
PID:3132
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5192 -prefsLen 32952 -prefMapHandle 5196 -prefMapSize 270279 -jsInitHandle 5200 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5208 -initialChannelId {ce443e63-91f1-426c-8c5e-1a5b4fa4a318} -parentPid 4368 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4368" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab4⤵
- Checks processor information in registry
PID:744
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5544 -prefsLen 32952 -prefMapHandle 5548 -prefMapSize 270279 -jsInitHandle 5552 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5560 -initialChannelId {9be3f98f-6862-491a-b0b9-f5ce702c37a3} -parentPid 4368 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4368" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab4⤵
- Checks processor information in registry
PID:4504
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5192 -prefsLen 32952 -prefMapHandle 5196 -prefMapSize 270279 -jsInitHandle 5200 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5704 -initialChannelId {fc5ebaf7-57f7-446d-9a13-b9ccd4d7896f} -parentPid 4368 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4368" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab4⤵
- Checks processor information in registry
PID:2408
-
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2412
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:836
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1736
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2416
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Event Triggered Execution
1AppInit DLLs
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1AppInit DLLs
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\System\symsrv.dll
- Size 67KB
- SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
- MD5 7574cf2c64f35161ab1292e2f532aabf
- SHA1 14ba3fa927a06224dfe587014299e834def4644f
- SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
- SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
- TLSH T17863F1372AB5807DDD210D37949F835AB771E5A76C20643FC25907D988B8DD0E3239AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\System\symsrv.dll.000
- Size 114B
- SHA256 aefc503b1ed462d7b6280228a7b5b710792273b78934426f88325341ac5b5a92
- MD5 e609411db8aa6775d0344c75c23ae79b
- SHA1 1d2ff6194bf159ce36cd0461cd3da29486d1e97d
- SHA512 6884ff5c07bc687132c965a59cb8c5a898a25da74c6c846c1d6089ddca8007cb7e4d2f8520bdce9fbcf6e2f9c9e5c28d8c8d6d049d3522470bdc7d38bbfa0ad0
- TLSH T1FFB09262AA2791EAE1AA224505A0248C1ED0B62AB48638002EBA5A4E93256A85916147
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\cache2\entries\5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
- Size 16KB
- SHA256 fc5ad77d4bd966aaf2dc7085bffa426a094f357088190208970c65ab0a403fbd
- MD5 d026544d2aef68986c75fd3258243629
- SHA1 4cc4183611fcd589e0c04e2b540875c79d9aed00
- SHA512 477629f5806a70890fb125c18b147a129de7490a8eb98b4e1066b5d076ddd6d286f1c8d70fb761434a1fcbc1cffe7b7db3036615bd23ff87ed03a7772c2beda1
- SSDEEP 384:HkCjiO024YJDL84KKDL849B7SOEAd9KVRaAcP+AWRMAy:EzZYJDL8lKDL8CB7S/AmVAf+hRML
- TLSH T18C728D3D5F013CBC15A7C0E8C5F9929A8D18B7A7CFE6806D21583D0DCA98A69B0F548F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y8u24m4i.default-release\startupCache\webext.sc.lz4
- Size 104KB
- SHA256 7a564c288533a35be984c303be40d4f70c1e95d616a375b8a5818d53806d7efb
- MD5 b171641b521a984bff195dcd7b0602ef
- SHA1 6ec1e56d4a0b25996b53fefb2bdeb1310d96cbe9
- SHA512 c32f5acba04d8a685334db9de4f8bf9bde068903ee7432d22df4be7be6564c78655c7184ea600c8e0498ff5b9cb9e17ab30ea570118b361504a9336401c149d0
- SSDEEP 1536:jTrli7mHDDewVSMzKrV1uRvRgHrmSM2oTUSf3Hgpu4FUyIfKoyk75MC6mtwkY1Am:j3l3VSMzHUlc3gzUy+K+irmtwZ1V
- TLSH T191A3AFF6EFB2897C64FFD4286B82883EFD366404B3973009C953671462C6BB46779648
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 11KB
- SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
- MD5 25e8156b7f7ca8dad999ee2b93a32b71
- SHA1 db587e9e9559b433cee57435cb97a83963659430
- SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
- SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
- TLSH T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
- Size 502KB
- SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
- MD5 e690f995973164fe425f76589b1be2d9
- SHA1 e947c4dad203aab37a003194dddc7980c74fa712
- SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
- SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
- TLSH T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\datareporting\glean\db\data.safe.tmp
- Size 28KB
- SHA256 d0e35091dffd7e70c7e49a8d19326e39fa0817ed5521cf9ee28cd7d7f4025767
- MD5 4819af95d599dc1b2ae9a6f8a37bbeed
- SHA1 b061ac499c4e3c459cb78ba86e37e01b894b8bfc
- SHA512 77d9301c5fc156b2217efbc4385cf461b68fab677da33b6ee7504f5d4cf1f59fe1a6607f9a3267541e82b00257374dbda11bb23f82c4d489d65b51ddda4b91dd
- SSDEEP 768:c+kpIRGcmhuud1PROLsE46bobzbfbpVOKE/:c+kpH7nq
- TLSH T189D20244FB2E913FD42912BBDCA54B002F79B88A58192F573A4C64686C872DC3D9E17F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\datareporting\glean\db\data.safe.tmp
- Size 24KB
- SHA256 8a9d30bb908aeda6f5fef2c08aadb2d8ba1fb2f0cd6907030169862f44da258a
- MD5 b8cc222ee9cc37b4ba42640407b506cf
- SHA1 07be3ddc0479eeddc7ff9a4be05acc7f5069092e
- SHA512 3d34324db5b14b5cf82cebc1ee6ec0e6b270c7535ff38691bfd01f37f5ca0ea71335468e32d04227bffcd65d342d6fcd1a043821b7246708f71c3ba61615893f
- SSDEEP 768:c+kpIRGcmhuud1PROLsE46bobzbfbpCEtB:c+kpH7n/
- TLSH T181B2EE84FB1A953FD42912BADCA547002F78F88959192FA73A4C646C6C872DC3D9E07F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\datareporting\glean\events\events
- Size 1KB
- SHA256 45ed864e2f9139abbab67bd653d92e24c417db13b71f42fedd634d1c3d6806b6
- MD5 b70db3701fe6d83df6381d38abaf370f
- SHA1 c5a1857370c06f7de36db828a907c75890bb2a7e
- SHA512 89d3dd58747ee94b6548a1bb328793e6a30103a2bd314e4631787eee940bcbbfe2abf6da01ac0e6710bd8df2defc5d8757b8ab01b5ed14ef44b4dc924f0b2a22
- TLSH T156112B5C3AB94D6B9987E6DCB441018E53924F0A05872E434D92EECCCE81ADD326A93D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\datareporting\glean\pending_pings\2b903d02-b8a9-410c-b633-e7ae8a12ac1c
- Size 235B
- SHA256 8e092025247d9254eb1ca2049ed6f93efacb70c58ce3ae2347cf01def15ae5e5
- MD5 1bd796175a56e5a43754bb3c1d57486d
- SHA1 842f7df75547776959f44075d529a22e095fef3e
- SHA512 67e461ace39d14b11b0a6faaa972ddde0b55164433b12f0e41f2102d279dacc08aade253e959cc75e9f6660c8c050faf74d87336eda153bb1616d6cc9a86e166
- TLSH T15DD0978024D86B6D08144F03B0A17EC634E44C33146898A0EBB980B4DDB8AC64292807
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\datareporting\glean\pending_pings\68088feb-31c7-4464-8442-e88b95e836f1
- Size 2KB
- SHA256 00bfe99c240aeee993ad4ed7638c18d993d18a39bfbf7844f2a07ea67a45ab5f
- MD5 f4882e829687148ecb963d69729f5796
- SHA1 a0d9afd6a6aaaec209304950f50fa95ab588e2be
- SHA512 4f52c0b9384b159a2f15b43942504f1d416bf00538340bfff12854eb389de0edede20a6f1da87f8ab11d9fb8d542a1deed3a0fbc315fef4044b37c7793b9dd68
- TLSH T1BE41545C79B88D7B5CDAE14D984123CE5BB44A4300821CC32E41EE4CCDB26AA3B6E52B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\datareporting\glean\pending_pings\c3ea9b75-f0ea-46ec-9931-7b7472ea2008
- Size 871B
- SHA256 bc2187ad6ac24959c076fb330fdb7339baa4028193117de8b01ca63482afca2b
- MD5 bf1c10ffbc574bba6da6a416a0c616b3
- SHA1 cac39659bfc425ad41cde9ff51e7c12953c987cd
- SHA512 cbe389002de9db76acfc6229bdb2f7ba4e787f0b5cf239c71b9f01b259c0e4f89b1f53b3ff34d995c9f145026c407559c302d1afa622b536d0c37531ff5ac391
- TLSH T1EC112F81AA74B9F3CC7CC24F889137465BE8712380CB82143E645D144D7EA2EB3AA30B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\datareporting\glean\pending_pings\d88a63b1-e587-49a7-850f-8b06171ce4ce
- Size 886B
- SHA256 858ac3ba2d18bc192df6f736caa50051ba6e7ce57408ee0cb050dfc9ffe127ac
- MD5 6bd76ed694c84a2fff01656a0f8f4d77
- SHA1 68b778181e42b351801bb6de20d878ac32ebfd1f
- SHA512 e49a818ada179ed0f31958e0a17b368f6db8884e42502ea2a4ea4265173b3d03b33ea94d3f37430b16f575fb3b30c30ac344b898ca67f346d0205be5aad33c65
- TLSH T176110080AB74B5F2CD38D28F98A0774247D43123C0CA4A147E545E284DBA52D63AB307
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\datareporting\glean\pending_pings\da669634-9427-4104-8521-a71ad1315423
- Size 235B
- SHA256 f432a67bb95677136f1c91ee6509545183bf0b63d0a2d60075b923a5ad5473b0
- MD5 a5c44abaebe4c8ee55c46f69b20aede9
- SHA1 9b6a9e902fd36220bd4bf7eb809dd20037dbbe87
- SHA512 0848fa0c2b622bf65422554c7d46e6f8af7eddce3adc9a6f0e0d404e9284c0620adc42703346c3c023bfc910649291cdeca499ebd182a855815959c8748e68f7
- TLSH T11AD097882C98736C48040F12B0E028EA705A8C3714749820CAA046B88ABEECAD251816
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\extensions.json
- Size 16KB
- SHA256 9cddeec52076b0f704a25401e6704592851c8d133f4782c5b1e0cdff424ac694
- MD5 a75a181a10a9a43106e9bb49bca9cc28
- SHA1 8b8230a88dc9bbb1541c128f438f751afc3eb0d7
- SHA512 0d96abd03f4b381a9f25886f14f50b4824d38cd9204644098fe62869cae647657d4b3c8c98f8a0a342f55a504d71aa497e32fb4d64215575e26bd65ee1fdf75f
- SSDEEP 384:IkI4vB9UmldvB8dhWR94zv96oSL4HPL4PCL4HoL4H6L4HqH4h6:fI459RfyXM4h6/4z4I4K4o4A4c
- TLSH T11372421545048EB8294EA79BAA36BE01C37D473B60845C78F4DD8FC802FB5B902BB65B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
- Size 1.1MB
- SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
- MD5 626073e8dcf656ac4130e3283c51cbba
- SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
- SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
- SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
- TLSH T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
- Size 116B
- SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
- MD5 ae29912407dfadf0d683982d4fb57293
- SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
- SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
- TLSH T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
- Size 1002B
- SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
- MD5 dcffff15fa618a53834ee4ae8673bd23
- SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
- SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
- TLSH T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
- Size 21.6MB
- SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
- MD5 d14dd3f0107ff91c3e21f301d83f82b0
- SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
- SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
- SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
- TLSH T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\prefs-1.js
- Size 8KB
- SHA256 548787d9f1b7c72de654be15e9368a401330a0c8c76feeab7941cf9908bc142d
- MD5 88eed5f403fda5bb2dace95818815b5d
- SHA1 bb8ee0474acbc24c0ed0bd8e3b32a1dcd40b1be0
- SHA512 d95b0c5a9a13b134860fa3389b5c0424cdd2bd3d5c89be59de3256bc6feb621456a0a90e508abd363b57e43c411bddb5c55e8985537f4378b44b4ab0bdc18cb3
- SSDEEP 96:xH+kmhTUhvqGqpfK2ZObzSHSSlSdv9jXnhWR+e7QDEoBw88zowM8L4cncV3+U:RmZRpfK2ZFSSzRjULBw88NYkU
- TLSH T1C9021238A504CF7F64B676ACAC6449315AA2033BB7BF68D710B954C5051CF3442FAAEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\prefs.js
- Size 6KB
- SHA256 e3e890d0c9692408ba80acd7fb0bee0676ee59b11a5799cd24e80bfc733eef05
- MD5 ba1434b3f51567a4d20d3664c72dbbd9
- SHA1 861af2b7723b62ecea1050b3e3608f915be4324a
- SHA512 806bcffdb63eebab8c92042427dc9343f2398b049533622322184198a6e1665334273a80898ce90218ebe537d081dc5ba64624498b8a81ce20b85bf18430f883
- SSDEEP 96:xH+kmUTUhvqGqpfq2Z1zSHSSlSdv9jXnhHa7QDkBw88n8L4cncV3+U:RmkRpfq2ZOSSWaUkBw88ZkU
- TLSH T1DAE13F7895088B6F64B677AC6C688C316AB2013B77BF68D710B954C5051CF3442F9AEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\prefs.js
- Size 6KB
- SHA256 222c1d49ab641b5e9c6464f765522eb7907e4e7f4015d7e65fb7c52d9ef2467a
- MD5 839b9210944396f7c38556f09f254c95
- SHA1 d42747e45f67ead780d0f9bb7a1646cd42d5d894
- SHA512 c60c68575fb56265036d1ea094f5c3efead1e8339e0947ff57690871ff669a7d8848ea7f6e69b63d9258bbfec75258262cdfa7bd6ce5d3ba61dc0caca64507b6
- SSDEEP 96:xH+kmUTUhvqGqpfqrq1zS2SSlSdv9janhHa7QDkBw88n8L4cncV3+U:RmkRpfqrq/SSnaUkBw88ZkU
- TLSH T14BE140789408CB6F74B676ACAC688C316AB2013B77BF68D750B954C5011CF3446F9AEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\prefs.js
- Size 6KB
- SHA256 c88408ce1fdaa828ed77df2ae08b91ab4c01c9d82eafad4670afcf11df25e80b
- MD5 71c23a2f7315246ce18c091bd72fde6f
- SHA1 e75e0ddb2cdb07cb5724fde6f1d74ebe51bca66b
- SHA512 5d96035e86f1a5cc455b99772ba2862ce00fe09adbd152db3009dd8b02d5e00e9947e36a5d0e516bd30cfc62a9456a3562083473855167591a529e56b151fd16
- SSDEEP 96:xH+kmUTUhvqGqpfqrq1zSHSSlSdv9janhHa7QDkBw88n8L4cncV3+U:RmkRpfqrqOSSnaUkBw88ZkU
- TLSH T15AE140789408CB6F74B676AC6C688C316AB2013B77BF68D750B954C9051CF3442F9AEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\sessionstore-backups\recovery.baklz4
- Size 4KB
- SHA256 8837b5e692fa31629041b8c9cc3734f585d0279b30ac0e595a551daaf57c2a90
- MD5 4bd809be25051cba26e51ee99aa56c58
- SHA1 060bda01c67f60f664be7dd7efe69a2306332514
- SHA512 61e38acfe52f3ca612c7a1be50d3dbc7383e2e426a11e83bd7e0d1dd73b44b6259069aa8fdb6000df1685fbe5cfd85a84e67312d612f65a18f88381d1aa4c010
- SSDEEP 96:Yk9f91nrCJz/eW9jILA0NjoB8kMJttn0YJZQKe:P9DneJDOnNcB85JttnTZRe
- TLSH T18C917C46770F64ABFEABC1CB99598CF184E83119998048DD90CE2F17762BF4B7058876
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y8u24m4i.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 7.4MB
- SHA256 2f7de983cfad874ed9e8e1dfbe7abea4ff78fe2398c2adfc3c23f18c887de9e2
- MD5 e0d166fb9b7546fa595086499315716c
- SHA1 cbbca1eb7f70caeff7068ec72efb823daae0e07d
- SHA512 d6a810d749d98b1c57f4b8b35a0ee1d1ad95e77034b6f3480aed7cedfc959c8efed8edfd7e794c6b25e510c9b4e9034cea48c9c812f03cdc4f4f5377ff327628
- SSDEEP 49152:/vgqHfCYRW6ajsR1s7OE/RmeP6hOxQW1CxUpxi5ISlEqXbg01aSZPUZg4WXAsN/b:XZWBjsR1s7tRme8
- TLSH T1E9764BE420E1D253E38644B3718993FB21EFC01C6036CF48579496EAA9748EB8E577BD
- MD5 SHA1 SHA512 SSDEEP TLSH