Analysis
- max time kernel
148s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/09/2026, 21:09
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
26 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
33 signatures
150 seconds
General
- Target 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
- Size 6.0MB
- Sample260922-zzyfvaff45
- SHA256 6c2c1632ee3db496b333201f2eba1647245deb7aa0488938c84a2aabfb18e614
- MD5 3b94bc716292cd3486771899a8d0722b
- SHA1 b1d5473239dbc880c403711c930912d27f3a7a51
- SHA512 d1f6d0e5645fc60deecef4ae2d5659bb88a5ade1684f00aa6d198af81916bfc437f4b4c0988ae31ea856f9dc73f35c4491fe75f7d3e2abf9757346b327cc4fee
- SSDEEP 98304:JP0hHtf+NA9Xu4qqP4C18frP3wbzWFimaI7dlo5go:6HF+NA9XuRVgbzWFimaI7dlvo
- TLSH T15C569D51BE8D8176D90B1132472D9F2A1029BD287B3865D3B2B43E7EEC363C16D3961B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Floxif payload 1 IoCs
resource yara_rule behavioral1/files/0x000a00000001e6c0-1.dat floxif - Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 4 IoCs
resource yara_rule behavioral1/memory/1836-21-0x0000000000F00000-0x00000000014F3000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1836-413-0x0000000000F00000-0x00000000014F3000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1836-725-0x0000000000F00000-0x00000000014F3000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/1836-734-0x0000000000F00000-0x00000000014F3000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers - Detects executables containing SQL queries to confidential data stores. Observed in infostealers 4 IoCs
resource yara_rule behavioral1/memory/1836-21-0x0000000000F00000-0x00000000014F3000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/1836-413-0x0000000000F00000-0x00000000014F3000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/1836-725-0x0000000000F00000-0x00000000014F3000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/1836-734-0x0000000000F00000-0x00000000014F3000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore - UPX dump on OEP (original entry point) 8 IoCs
resource yara_rule behavioral1/files/0x000a00000001e6c0-1.dat UPX behavioral1/memory/1836-3-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/1836-17-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/1836-22-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/1836-394-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/1836-414-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/1836-726-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/1836-737-0x0000000010000000-0x0000000010030000-memory.dmp UPX - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000a00000001e6c0-1.dat acprotect - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Loads dropped DLL 1 IoCs
pid Process 1836 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe /onboot" 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\e: 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe -
resource yara_rule behavioral1/files/0x000a00000001e6c0-1.dat upx behavioral1/memory/1836-3-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/1836-17-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/1836-22-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/1836-394-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/1836-414-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/1836-726-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/1836-737-0x0000000010000000-0x0000000010030000-memory.dmp upx - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\System\symsrv.dll 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe File created \??\c:\program files\common files\system\symsrv.dll.000 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Checks processor information in registry 2 TTPs 20 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243" 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Low Rights 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe" 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3" 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm" 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4} 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe" 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3" 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006} 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A} 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe" 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3" 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Modifies registry class 16 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan" 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User" 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1" 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings firefox.exe Key created \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7} 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Model = "264" 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Therad = "1" 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter" 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe" 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1836 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 1836 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 1836 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 1836 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 1836 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 1836 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 1836 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 1836 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 1836 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Token: SeRestorePrivilege 1836 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Token: SeDebugPrivilege 3400 firefox.exe Token: SeDebugPrivilege 3400 firefox.exe Token: SeDebugPrivilege 3400 firefox.exe Token: SeDebugPrivilege 3400 firefox.exe Token: SeDebugPrivilege 3400 firefox.exe - Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 3400 firefox.exe 3400 firefox.exe 3400 firefox.exe 3400 firefox.exe 3400 firefox.exe 3400 firefox.exe 1836 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1836 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 1836 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 1836 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 1836 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 3400 firefox.exe 1836 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 1836 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 1836 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 1836 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 1836 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 1836 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 1836 wrote to memory of 1336 1836 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 89 PID 1836 wrote to memory of 3540 1836 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 90 PID 3540 wrote to memory of 3400 3540 firefox.exe 91 PID 3540 wrote to memory of 3400 3540 firefox.exe 91 PID 3400 wrote to memory of 4484 3400 firefox.exe 92 PID 3400 wrote to memory of 4484 3400 firefox.exe 92 PID 3400 wrote to memory of 4484 3400 firefox.exe 92 PID 3400 wrote to memory of 1884 3400 firefox.exe 93 PID 3400 wrote to memory of 1884 3400 firefox.exe 93 PID 3400 wrote to memory of 1884 3400 firefox.exe 93 PID 3400 wrote to memory of 1884 3400 firefox.exe 93 PID 3400 wrote to memory of 1576 3400 firefox.exe 94 PID 3400 wrote to memory of 1576 3400 firefox.exe 94 PID 3400 wrote to memory of 1576 3400 firefox.exe 94 PID 3400 wrote to memory of 1576 3400 firefox.exe 94 PID 3400 wrote to memory of 2272 3400 firefox.exe 95 PID 3400 wrote to memory of 2272 3400 firefox.exe 95 PID 3400 wrote to memory of 2272 3400 firefox.exe 95 PID 3400 wrote to memory of 2664 3400 firefox.exe 96 PID 3400 wrote to memory of 2664 3400 firefox.exe 96 PID 3400 wrote to memory of 2664 3400 firefox.exe 96 PID 3400 wrote to memory of 2664 3400 firefox.exe 96 PID 3400 wrote to memory of 5360 3400 firefox.exe 97 PID 3400 wrote to memory of 5360 3400 firefox.exe 97 PID 3400 wrote to memory of 5360 3400 firefox.exe 97 PID 3400 wrote to memory of 5360 3400 firefox.exe 97 PID 3400 wrote to memory of 5388 3400 firefox.exe 98 PID 3400 wrote to memory of 5388 3400 firefox.exe 98 PID 3400 wrote to memory of 5388 3400 firefox.exe 98 PID 3400 wrote to memory of 5388 3400 firefox.exe 98 PID 3400 wrote to memory of 5400 3400 firefox.exe 99 PID 3400 wrote to memory of 5400 3400 firefox.exe 99 PID 3400 wrote to memory of 5400 3400 firefox.exe 99 PID 3400 wrote to memory of 5400 3400 firefox.exe 99 PID 3400 wrote to memory of 5408 3400 firefox.exe 100 PID 3400 wrote to memory of 5408 3400 firefox.exe 100 PID 3400 wrote to memory of 5408 3400 firefox.exe 100 PID 3400 wrote to memory of 5408 3400 firefox.exe 100 PID 3400 wrote to memory of 5964 3400 firefox.exe 101 PID 3400 wrote to memory of 5964 3400 firefox.exe 101 PID 3400 wrote to memory of 5964 3400 firefox.exe 101 PID 3400 wrote to memory of 5964 3400 firefox.exe 101 PID 1836 wrote to memory of 4612 1836 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 106 PID 1836 wrote to memory of 3724 1836 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 107 PID 1836 wrote to memory of 4476 1836 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 108 PID 1836 wrote to memory of 4084 1836 2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 109 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:1336
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html2⤵
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2024 -prefsLen 27099 -prefMapHandle 2028 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {08cfe7bd-7640-4891-b7fd-0c3380283329} -parentPid 3400 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3400" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu4⤵PID:4484
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2500 -prefsLen 27135 -prefMapHandle 2504 -prefMapSize 270279 -ipcHandle 2512 -initialChannelId {46b7551e-5d9e-4076-b60d-85e0e3dbeb51} -parentPid 3400 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3400" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket4⤵PID:1884
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3816 -prefsLen 25164 -prefMapHandle 3820 -prefMapSize 270279 -jsInitHandle 3824 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3832 -initialChannelId {7292cadc-4b23-4f0e-af7c-acfcbb4ba4aa} -parentPid 3400 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3400" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab4⤵
- Checks processor information in registry
PID:1576
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4008 -prefsLen 27276 -prefMapHandle 4012 -prefMapSize 270279 -ipcHandle 4080 -initialChannelId {38ae6ab5-9350-4c57-8457-f481a20f74e6} -parentPid 3400 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3400" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd4⤵PID:2272
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3348 -prefsLen 34775 -prefMapHandle 3660 -prefMapSize 270279 -jsInitHandle 4356 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4364 -initialChannelId {ce2dd66a-dafb-4160-994e-a7882bebef7f} -parentPid 3400 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3400" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab4⤵
- Checks processor information in registry
PID:2664
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4224 -prefsLen 35012 -prefMapHandle 4244 -prefMapSize 270279 -ipcHandle 2976 -initialChannelId {02a81b3c-5d78-4b85-a18b-fce74c5b0877} -parentPid 3400 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3400" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility4⤵
- Checks processor information in registry
PID:5360
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1640 -prefsLen 32900 -prefMapHandle 5104 -prefMapSize 270279 -jsInitHandle 5108 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4852 -initialChannelId {87e751c8-acb4-4d43-8a31-19c3900bc643} -parentPid 3400 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3400" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab4⤵
- Checks processor information in registry
PID:5388
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5312 -prefsLen 32900 -prefMapHandle 5316 -prefMapSize 270279 -jsInitHandle 5320 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5328 -initialChannelId {6d370858-fad2-4477-818d-8ad155681f7d} -parentPid 3400 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3400" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab4⤵
- Checks processor information in registry
PID:5400
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5372 -prefsLen 32900 -prefMapHandle 5376 -prefMapSize 270279 -jsInitHandle 5380 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5384 -initialChannelId {5ff88fae-a77b-4baf-be88-c4bc58fab942} -parentPid 3400 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3400" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab4⤵
- Checks processor information in registry
PID:5408
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5840 -prefsLen 32952 -prefMapHandle 5940 -prefMapSize 270279 -jsInitHandle 5944 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5884 -initialChannelId {7c518198-723d-48e4-965b-2907a9caf718} -parentPid 3400 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3400" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab4⤵
- Checks processor information in registry
PID:5964
-
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:4612
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:3724
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:4476
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:4084
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\System\symsrv.dll
- Size 67KB
- SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
- MD5 7574cf2c64f35161ab1292e2f532aabf
- SHA1 14ba3fa927a06224dfe587014299e834def4644f
- SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
- SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
- TLSH T17863F1372AB5807DDD210D37949F835AB771E5A76C20643FC25907D988B8DD0E3239AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\System\symsrv.dll.000
- Size 114B
- SHA256 aefc503b1ed462d7b6280228a7b5b710792273b78934426f88325341ac5b5a92
- MD5 e609411db8aa6775d0344c75c23ae79b
- SHA1 1d2ff6194bf159ce36cd0461cd3da29486d1e97d
- SHA512 6884ff5c07bc687132c965a59cb8c5a898a25da74c6c846c1d6089ddca8007cb7e4d2f8520bdce9fbcf6e2f9c9e5c28d8c8d6d049d3522470bdc7d38bbfa0ad0
- TLSH T1FFB09262AA2791EAE1AA224505A0248C1ED0B62AB48638002EBA5A4E93256A85916147
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
- Size 16KB
- SHA256 4da3212043fbfc0ed566819f2acfe0973953b64b3172b68f631d854129452295
- MD5 2f030b22e234e2936acfc2f865836f90
- SHA1 18bb737764d1ade1632bf351aa6de05a335ca833
- SHA512 810ae106c2792ae105e7e86e79c486cf19fd98ac3d355c30c97f44d5f7c91ecdf69de9df167115c0b8270b01cf51fe2eee6d882713e5d7b22a9e52241bb2334a
- SSDEEP 384:HalwSiO024YCDL84KKDL849B7SOEAd9KVRaAcP+AWRMAFL+iS+L:6l8ZYCDL8lKDL8CB7S/AmVAf+hRM8Llr
- TLSH T1A0728E3D8F013CEC1597C0E8C4B982A58D18B7A7DFE6806D21583D0ECBA4A69B4F548F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 502KB
- SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
- MD5 e690f995973164fe425f76589b1be2d9
- SHA1 e947c4dad203aab37a003194dddc7980c74fa712
- SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
- SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
- TLSH T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 11KB
- SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
- MD5 25e8156b7f7ca8dad999ee2b93a32b71
- SHA1 db587e9e9559b433cee57435cb97a83963659430
- SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
- SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
- TLSH T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\db\data.safe.tmp
- Size 3KB
- SHA256 0a523cf46a44298b91b98ad1069a4bcff6ac21672c9fb145b7dea2f8ec21662a
- MD5 4f2206d1504de8e13446fed8f8c8542e
- SHA1 8c83b1d686fc2a9508c5cae43d2273152e694cb1
- SHA512 59f764d1f3665befef31b8d92ca91879eb674061b11271aff2512d4b4411a91ba3ab6d8712a19fbed29049bbe7ccbbbbfd6ac0fb9541f6e6951ccd32bee94d65
- TLSH T134619758F228863FE048413ACCA21B412F343496A8AE7F2A39AD614D1E573CD77CD17E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 5b60f6c1b41a20ef65b77d327af400ad09c0765e9c79ac2b495f0f3ba6abdb3f
- MD5 8ae3892565031dc6c8aed3bf6a6eb17a
- SHA1 7861f20e42698dfca7155dd6493a9d4951f70210
- SHA512 44aaad0531265b55934c2712764e9c79f9d8833edeab5b98d8ddc4952c07fc5a48a633bd25b20afde8a8f3090d2da938e10af69ff06b18aa6267d09b6b38aaa1
- SSDEEP 192:tX9Ov5zboVZOVZyjifc791d66JozGzgCl6mc0dz:UboVZO7yjbd66JozGzgC1jd
- TLSH T12AE11064E629863FC008023BCDA21F554F35389A9C4E7F2935AD65082D6B3CE768D1BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\events\events
- Size 1KB
- SHA256 64a298d7ac4141b4a5652da3b7bfe624b76237e88a58a69a6085e9dd04068c22
- MD5 dd0c88d038529d328ce8b4c0557986bf
- SHA1 2f2b9626bf9aecec73c9168d10c26ef30948949e
- SHA512 3fa77a212585c5c690da7ef7ca9975b7eb9d7b88ace3a554b6b025d712b7dd9875ce6d66f5b800d77b056da3bf8379a39705ed64fcd7a5741972fc9e21e3e412
- TLSH T16721458D3FF84D6A68CFE69CB48002CE53D58A0F04871D431E12DF8DCD92ADA31AA46C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\0cd857cd-ac86-4e3e-8027-1b57542d9694
- Size 2KB
- SHA256 117fd0ab1de5c83745665d821a6075fe8da79d66df5cda3cfc6332d96e7c5bed
- MD5 a4f63a9513fec61e814d3344582bde3a
- SHA1 5978277562b86866d7200d6c0cf8545e7d5fee02
- SHA512 f56f42b12852106118c12e2c443d665a5a2d9ae901ecd3edb4789eae4f5f003df45a8f9420caf64f6350c868d506a0093e01fb881d133c57005296a4a1b611cf
- TLSH T18241431C75B85C775CDBE18C9452338E57648E8600C26C832E51EF0CCDB6B9937AA46B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\2b51ac87-536a-4fc1-a9d5-c96d69a4439d
- Size 235B
- SHA256 23dce3dc95fac855de3e3747a50b56a537fa2d3ae2733f3fa68e8ce73e11294b
- MD5 962625f71159b71571be303bea1ccaa9
- SHA1 cefcf6277d60f724a3f28c40e7b59026815188ba
- SHA512 757e5d752e3b178142da9fc604576c3605ae298de10e50e66bfa908c7aabf7b5dc22e071e1a4458253db72e4b94f3302cbb6255cdc3dc2d9e52513e2f3bb0ab1
- TLSH T1DFD09780A4982B2D88102F02B0B0B9C230994C3B247CAC20DA6189B689BE9C4025282B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\6c568129-112f-4a3d-844f-c925aadc8480
- Size 235B
- SHA256 282f6a0cf31325c948634067e1e6fbe41ed66c3d22a4e146e894baf957e03c49
- MD5 e0922aea53cd19073e6dd68a9e88eb8e
- SHA1 218a6bdfff96c3881ca143b61129d3211e80938f
- SHA512 065d5432e35ece663c347288f22b001a62087ed477f418a4d843a5df788d8167d4ed7d6e8883982c93a55df40a944c54ff11214a74f9715b583a804839c9b23f
- TLSH T1CDD0A7D034A8675D0C140F46F0B4B9CA705D8C7754B49820D5B1457599FABC9816191B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\8312fa77-c5e6-42b3-98d6-9594421b4c7b
- Size 886B
- SHA256 ddf43f0ca1507fbdb8fc6d65109b5d651e89cf8e56014191d5edf369b225b244
- MD5 0bc438704ce10be45020119b26deca26
- SHA1 c639f7271decdca792455bbf4ca42339094ddfa0
- SHA512 f6d088fb9e5f7e2607ae6295031cbebb01cb2de666b837b5d31b02bb0fae033a85ca5b7b93c445281bd95ad28e7db10984ba4e15c7c5c68aededdb1998706b2f
- TLSH T147114440A63578B2CD3CD24BC6A137528FD070B380C559143E555F084CBE70D6366707
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\c52c9bfb-a8e9-4883-9490-a1cd05672299
- Size 883B
- SHA256 1fec0b870c1c2463d271a31ec498b8a1430f2e368a5f4ce53a16c94bebabb10f
- MD5 fd79172b5489660ae287d9acababaa83
- SHA1 6788a9c242c3bf49d1bbfbd2daed1e0d11c527d1
- SHA512 2b7635ab40b7d022fdaafd92eeae063dbec7625b6cf5693f36c05fa244f282875a96b5830d355e0a6171cb64f96c27fa6b91786f8e5d76383968d51793e50323
- TLSH T180114040A23678B3CC6CD14BC9613B028BE4782380C594142FA55E044C7EB1EA367247
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\d76def7f-a1db-46a6-88a6-d16ee4785980
- Size 15KB
- SHA256 73e3c3771a165732c4733e1a07931e349d606d0ec13df7c8d909fba3f9f3237a
- MD5 d01982cac5d4b5d8bac4484a18718396
- SHA1 cbc8900bf7392846f34cca3c50749b9a8cfae107
- SHA512 8f0f3ebbc0a668a49d3d4f3a32dfe39c2677bcbc9c6e7fd6fb260ed32114446e9790797f926f3e146fca060b6d0618e3cf4dd5db6b8294acd59e589920b84e6c
- SSDEEP 192:1nLBmsw09otklGPs6l/pg6xVDZR3wt97Hnz4RGiSce/5j/e1LPiRBtlCsuwixL4j:dLBVYhg6a7HnkRGiSce/5j/FluVsj
- TLSH T1AE72DA552820497A8251E36994ECBFC3E5F538CF4C419FCADBE4BE086DDE0AE512784B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\extensions.json
- Size 16KB
- SHA256 86432338417ba44810dd3e801d48a4cd8a4a6d93412ae2fad316960a4da11f93
- MD5 cd36bd5b065df643e4beaa9532c49b5d
- SHA1 a3847e4579fde4cd010339a39add0192656e94d5
- SHA512 b80f14401cab7e00065b1c10129ea40da42f6d73daa9b1be7cc904eedbb2819ea565e93ff40770889133778bfc312920809a2cf33483293391a88b6403f95ded
- SSDEEP 384:mkI4vfUmldvBM8dhW+94zO96otXL4HpL4P1L4HDL4HTL4HvYV4hi2:pI4XRfbXT4e6Yb4h4d4P4/4QV4w2
- TLSH T11472421545448EB8298EA79BAA367E01C37D473B60845C38F4DD8FC802FB5B902FB65B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
- Size 1.1MB
- SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
- MD5 626073e8dcf656ac4130e3283c51cbba
- SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
- SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
- SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
- TLSH T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
- Size 116B
- SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
- MD5 ae29912407dfadf0d683982d4fb57293
- SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
- SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
- TLSH T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
- Size 1002B
- SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
- MD5 dcffff15fa618a53834ee4ae8673bd23
- SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
- SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
- TLSH T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
- Size 21.6MB
- SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
- MD5 d14dd3f0107ff91c3e21f301d83f82b0
- SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
- SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
- SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
- TLSH T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\prefs-1.js
- Size 6KB
- SHA256 c0e1a1d4a346b0c2d3bb77638be80d78673f6c662bddb9cb2108eed9db38a6d0
- MD5 03b1418e2b9da609ffc0add55f207478
- SHA1 d58ad39fe09f81c260b4973a042c996ced419165
- SHA512 a99ba707555d235ec676a38ae1c835b1847c73bd17249726bfef8a8d76849b7c4ab092418e17573c8b0b464965593c22c9b2cf20645d0fac18b3b9345b66ae86
- SSDEEP 96:xHYUTUzqGqZEfUVMObzS2aSSlSdv9jonvHhW/YBw88n8L4cntGUI6:KORZEfUVM4aSSTo/YBw88n6
- TLSH T154E130789108CB6F65B6776CAC688D316AB2413B7BBF68C750B584C4015CF3842F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\prefs-1.js
- Size 8KB
- SHA256 991159f0ad8925abcbc8396ded641f04e366175e28634dba2a07ce54878cd9fd
- MD5 f89997331411c0689d6732aa887d94e6
- SHA1 4d5599a47a26442ad6391dabf9e05c8176b658ba
- SHA512 098027f8513796f7f0e55c5439df036a6719626e63c74436afc2126b339dbb972c7e2497f58828888895292c1114f0f2acb9a871508258ee00b8c6a77b71ed27
- SSDEEP 96:xHYhTUzqGqZEffVMObzS2aSSlSdv9jonvWRbb9W/OBw88t98/8L4cntGUI6:KHRZEffVM4aSSaRbA/OBw88MP6
- TLSH T162020E789504CB7F64FA766CAC244A746AA2013F7BBF68C750B984C9015CF3441FA6EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\prefs-1.js
- Size 6KB
- SHA256 84d01202d60b89afd9fed9e9570dae1b3997aac249cea3c0335baf0b1d447214
- MD5 81b3cad1e2bdf47be92f14889144cf5d
- SHA1 e175d010c348f9796b99813b71e345f7b0434491
- SHA512 ab5ee61d57831fbfd37dd9ca87a9845b2682748382606f93f180aa76a12c497f57173ff20a35d7a95f6e41ebcb88d9ccc598663546c687015742441a6cf5f786
- SSDEEP 96:xHYUTUzqGqZEfUVM1zS2aSSlSdv9jo8HnvHhW/YBw88n8L4cntGUI6:KORZEfUVMHaSSb4o/YBw88n6
- TLSH T17AE12F789108CB6F64B6776CAC688C316AB2417B7BBF68C750B584C5015CF3842F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\prefs.js
- Size 6KB
- SHA256 170955e94b509d5188361abd105571649cac1167cc2b0753af6ac398270c152c
- MD5 df253bfa6d605868b85fadb27db47b6a
- SHA1 3e0752238c0c48ac9e89e1c1e090d71875ba4c0b
- SHA512 7a94c9a072f2c5def31aa68a98868c7ddd42d5eadc03cc735c31d43e796d17ff043dd5a11db9dd8b1108371e776f400f7f27aba76b9da165544f6e3ed32cc06e
- SSDEEP 96:xHYUTUzqGqZEfUlE1zSSSSSlSdv9jo8HnvHhW/YBw88n8L4cntGUI6:KORZEfUlE7SSSb4o/YBw88n6
- TLSH T1BEE13F7890088B6F64B6776CAC688C316AB2457B7BBF68C750B584C5051CF3842F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\sessionstore-backups\recovery.baklz4
- Size 4KB
- SHA256 1705737cb169225bd2200d32f152e0dbd5379e2a84c3af9bdbbf371d15eb0b6f
- MD5 b66c7d5a90b5ca93839325862f9bec99
- SHA1 8b0c2b1078c2458771b460c969ddb68dd3537d17
- SHA512 ffb98104ccb9a202e91aedc2296f70fdfaf58d3e4361b41ba83eab6ee00d8f8a92a62094f1d4960587373a82169c869cb0840d160065976edfd5f21a2e3344fe
- SSDEEP 96:eKzf6wrz+FD+QeW9jILA0NjoB8kMJttn0YJZQBVAr:tZ1IOnNcB85JttnTZEVA
- TLSH T181916D01371B68B7FD5A85CFEE594CE104F4310A588188EC90CF661AB7AFB4B394E475
- MD5 SHA1 SHA512 SSDEEP TLSH