Analysis
- max time kernel
148s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/09/2026, 01:59
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
27 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
33 signatures
150 seconds
General
- Target 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
- Size 6.0MB
- Sample260928-cedvda115m
- SHA256 fa0af2b1ccf80c29b353b80c046eea75567b0c6f810c4bf7d91845fa3240d2c0
- MD5 a3f2a16654c8c473af3c1da3b24374d9
- SHA1 a31afa9cdf78ca3e1e9d4f8f8ffc135142ac4c3b
- SHA512 ceb5f39654d1f2c5df6e1be0e731bcd6dedfcf604c6fbfd4dd22fa053e4a6ed9ee82a6278f07ace43f98baf23a988370f62ad0a06908d69722fb07b741030a95
- SSDEEP 98304:8QAdm22GGvXuIaIP4e18frP3wbzWFimaI7dlougI:ol2GGvXuR/gbzWFimaI7dlKI
- TLSH T1B3569C51BE4D8176D90B1172472D9F2A102ABD287B3865D3B2B43E7EEC323C16D3961B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Floxif payload 1 IoCs
resource yara_rule behavioral1/files/0x00070000000004ea-1.dat floxif - Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 4 IoCs
resource yara_rule behavioral1/memory/2724-21-0x0000000000540000-0x0000000000B33000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2724-387-0x0000000000540000-0x0000000000B33000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2724-406-0x0000000000540000-0x0000000000B33000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2724-705-0x0000000000540000-0x0000000000B33000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers - Detects executables containing SQL queries to confidential data stores. Observed in infostealers 4 IoCs
resource yara_rule behavioral1/memory/2724-21-0x0000000000540000-0x0000000000B33000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/2724-387-0x0000000000540000-0x0000000000B33000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/2724-406-0x0000000000540000-0x0000000000B33000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/2724-705-0x0000000000540000-0x0000000000B33000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore - UPX dump on OEP (original entry point) 7 IoCs
resource yara_rule behavioral1/files/0x00070000000004ea-1.dat UPX behavioral1/memory/2724-3-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/2724-17-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/2724-25-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/2724-368-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/2724-388-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/2724-706-0x0000000010000000-0x0000000010030000-memory.dmp UPX - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x00070000000004ea-1.dat acprotect - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Loads dropped DLL 1 IoCs
pid Process 2724 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe /onboot" 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\e: 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe -
resource yara_rule behavioral1/files/0x00070000000004ea-1.dat upx behavioral1/memory/2724-3-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/2724-17-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/2724-25-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/2724-368-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/2724-388-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/2724-706-0x0000000010000000-0x0000000010030000-memory.dmp upx - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\System\symsrv.dll 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe File created \??\c:\program files\common files\system\symsrv.dll.000 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Checks processor information in registry 2 TTPs 20 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A} 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe" 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe" 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243" 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Low Rights 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm" 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3" 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3" 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3" 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4} 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006} 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe" 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Modifies registry class 17 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD} 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Model = "270" 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan" 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1" 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\WOW6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D} 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Therad = "1" 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter" 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User" 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings firefox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe" 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2724 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 2724 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 2724 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 2724 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 2724 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 2724 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 2724 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 2724 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 2724 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Token: SeRestorePrivilege 2724 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Token: SeDebugPrivilege 3848 firefox.exe Token: SeDebugPrivilege 3848 firefox.exe Token: SeDebugPrivilege 3848 firefox.exe Token: SeDebugPrivilege 3848 firefox.exe Token: SeDebugPrivilege 3848 firefox.exe - Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 3848 firefox.exe 3848 firefox.exe 3848 firefox.exe 3848 firefox.exe 3848 firefox.exe 3848 firefox.exe 2724 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2724 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 2724 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 2724 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 2724 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 3848 firefox.exe 2724 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 2724 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 2724 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 2724 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 2724 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 2724 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 2724 wrote to memory of 3756 2724 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 88 PID 2724 wrote to memory of 2504 2724 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 98 PID 2504 wrote to memory of 3848 2504 firefox.exe 99 PID 2504 wrote to memory of 3848 2504 firefox.exe 99 PID 3848 wrote to memory of 880 3848 firefox.exe 100 PID 3848 wrote to memory of 880 3848 firefox.exe 100 PID 3848 wrote to memory of 880 3848 firefox.exe 100 PID 3848 wrote to memory of 4600 3848 firefox.exe 101 PID 3848 wrote to memory of 4600 3848 firefox.exe 101 PID 3848 wrote to memory of 4600 3848 firefox.exe 101 PID 3848 wrote to memory of 4600 3848 firefox.exe 101 PID 3848 wrote to memory of 3884 3848 firefox.exe 102 PID 3848 wrote to memory of 3884 3848 firefox.exe 102 PID 3848 wrote to memory of 3884 3848 firefox.exe 102 PID 3848 wrote to memory of 3884 3848 firefox.exe 102 PID 3848 wrote to memory of 3192 3848 firefox.exe 103 PID 3848 wrote to memory of 3192 3848 firefox.exe 103 PID 3848 wrote to memory of 3192 3848 firefox.exe 103 PID 3848 wrote to memory of 2312 3848 firefox.exe 105 PID 3848 wrote to memory of 2312 3848 firefox.exe 105 PID 3848 wrote to memory of 2312 3848 firefox.exe 105 PID 3848 wrote to memory of 2312 3848 firefox.exe 105 PID 3848 wrote to memory of 5884 3848 firefox.exe 106 PID 3848 wrote to memory of 5884 3848 firefox.exe 106 PID 3848 wrote to memory of 5884 3848 firefox.exe 106 PID 3848 wrote to memory of 5884 3848 firefox.exe 106 PID 3848 wrote to memory of 5896 3848 firefox.exe 107 PID 3848 wrote to memory of 5896 3848 firefox.exe 107 PID 3848 wrote to memory of 5896 3848 firefox.exe 107 PID 3848 wrote to memory of 5896 3848 firefox.exe 107 PID 3848 wrote to memory of 5924 3848 firefox.exe 108 PID 3848 wrote to memory of 5924 3848 firefox.exe 108 PID 3848 wrote to memory of 5924 3848 firefox.exe 108 PID 3848 wrote to memory of 5924 3848 firefox.exe 108 PID 3848 wrote to memory of 5944 3848 firefox.exe 109 PID 3848 wrote to memory of 5944 3848 firefox.exe 109 PID 3848 wrote to memory of 5944 3848 firefox.exe 109 PID 3848 wrote to memory of 5944 3848 firefox.exe 109 PID 3848 wrote to memory of 3428 3848 firefox.exe 110 PID 3848 wrote to memory of 3428 3848 firefox.exe 110 PID 3848 wrote to memory of 3428 3848 firefox.exe 110 PID 3848 wrote to memory of 3428 3848 firefox.exe 110 PID 2724 wrote to memory of 4228 2724 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 116 PID 2724 wrote to memory of 3368 2724 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 117 PID 2724 wrote to memory of 4612 2724 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 118 PID 2724 wrote to memory of 2700 2724 2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 119 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-27_a3f2a16654c8c473af3c1da3b24374d9_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:3756
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html2⤵
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2028 -prefsLen 27099 -prefMapHandle 2032 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {8d6e37ed-0e3a-474a-bb70-6e322bb1c663} -parentPid 3848 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3848" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu4⤵PID:880
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2500 -prefsLen 27135 -prefMapHandle 2504 -prefMapSize 270279 -ipcHandle 2512 -initialChannelId {38bf38cd-3274-480f-9111-fd68a207d701} -parentPid 3848 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3848" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket4⤵PID:4600
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3880 -prefsLen 25164 -prefMapHandle 3884 -prefMapSize 270279 -jsInitHandle 3888 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3896 -initialChannelId {fc77325a-d7ed-4820-89a9-c1eff44a806d} -parentPid 3848 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3848" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab4⤵
- Checks processor information in registry
PID:3884
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4072 -prefsLen 27276 -prefMapHandle 4076 -prefMapSize 270279 -ipcHandle 4144 -initialChannelId {971557e1-d86b-418d-8766-6d7e5fa5dada} -parentPid 3848 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3848" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd4⤵PID:3192
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3352 -prefsLen 34775 -prefMapHandle 2948 -prefMapSize 270279 -jsInitHandle 3008 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3084 -initialChannelId {efc50f4f-747e-4550-8d38-bdcec3039efb} -parentPid 3848 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3848" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab4⤵
- Checks processor information in registry
PID:2312
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3300 -prefsLen 35012 -prefMapHandle 3400 -prefMapSize 270279 -ipcHandle 4944 -initialChannelId {f28a9360-a652-441a-a655-f6c0fb55f71c} -parentPid 3848 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3848" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility4⤵
- Checks processor information in registry
PID:5884
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5164 -prefsLen 32952 -prefMapHandle 5168 -prefMapSize 270279 -jsInitHandle 5172 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5180 -initialChannelId {2a9a609c-6c5a-49ec-b5ca-922d67d8e4fd} -parentPid 3848 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3848" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab4⤵
- Checks processor information in registry
PID:5896
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5400 -prefsLen 32952 -prefMapHandle 5404 -prefMapSize 270279 -jsInitHandle 5408 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5412 -initialChannelId {1d9b244e-3890-4980-a194-9448f66cc1ce} -parentPid 3848 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3848" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab4⤵
- Checks processor information in registry
PID:5924
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5600 -prefsLen 32952 -prefMapHandle 5604 -prefMapSize 270279 -jsInitHandle 5608 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5616 -initialChannelId {1183cfac-2ba0-4756-a3da-1e80fe9a8c23} -parentPid 3848 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3848" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab4⤵
- Checks processor information in registry
PID:5944
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3988 -prefsLen 32952 -prefMapHandle 3972 -prefMapSize 270279 -jsInitHandle 3976 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4276 -initialChannelId {4cae1f06-9f44-447f-876d-336f8932d517} -parentPid 3848 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3848" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab4⤵
- Checks processor information in registry
PID:3428
-
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:4228
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:3368
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:4612
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:2700
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\System\symsrv.dll
- Size 67KB
- SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
- MD5 7574cf2c64f35161ab1292e2f532aabf
- SHA1 14ba3fa927a06224dfe587014299e834def4644f
- SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
- SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
- TLSH T17863F1372AB5807DDD210D37949F835AB771E5A76C20643FC25907D988B8DD0E3239AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\System\symsrv.dll.000
- Size 114B
- SHA256 aefc503b1ed462d7b6280228a7b5b710792273b78934426f88325341ac5b5a92
- MD5 e609411db8aa6775d0344c75c23ae79b
- SHA1 1d2ff6194bf159ce36cd0461cd3da29486d1e97d
- SHA512 6884ff5c07bc687132c965a59cb8c5a898a25da74c6c846c1d6089ddca8007cb7e4d2f8520bdce9fbcf6e2f9c9e5c28d8c8d6d049d3522470bdc7d38bbfa0ad0
- TLSH T1FFB09262AA2791EAE1AA224505A0248C1ED0B62AB48638002EBA5A4E93256A85916147
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
- Size 16KB
- SHA256 661642f0fc59346443d75eaa0d6abaf7d18cc2577f35297431c6c25424330463
- MD5 321398517cf9235bcfd7dbe20ff7b981
- SHA1 8ac3e54fccfdf7b62a78eb79418ecc81703b5b05
- SHA512 f3bd3aebc970aa34f59142ac4b37fabd23b43e6befbd7c2ecb68e729ceb742e34494c019fcd05db1522279a20330ac7b68b4d8d02030a3eecec785f529d0847f
- SSDEEP 384:HalwSiO024Y7WTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMArL+rS+J:6l8ZY7WTToXJWTTogB7S/AmVAf+hRMoA
- TLSH T1D0727D7D8F013CAC2657D0E8C8BA43558D1CB6A7DFF5C06D129C3E09CA84A5A71F985E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 11KB
- SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
- MD5 25e8156b7f7ca8dad999ee2b93a32b71
- SHA1 db587e9e9559b433cee57435cb97a83963659430
- SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
- SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
- TLSH T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 502KB
- SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
- MD5 e690f995973164fe425f76589b1be2d9
- SHA1 e947c4dad203aab37a003194dddc7980c74fa712
- SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
- SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
- TLSH T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\db\data.safe.tmp
- Size 28KB
- SHA256 79dbf8fbac8e9f1ce01e964e2f0189ae955561dbe917ac508e7c5a4cfb6bfd1a
- MD5 a4a856daa20f7958c22d66396b38a4bf
- SHA1 02b340504fa025cc58e2752f853ae7415821a8ed
- SHA512 0dfd82ee8e95eb563e80741cb17a45b7b97b381e519c42156a00c6e9acf8190fabea47dc53c93b65e9db7388c8f0398be7b9e2504e377f32d2b76d3c6c9158c6
- SSDEEP 768:DEL/0xuUXzJJGcmhu+/XA/RtcCs5KbmbPbSblrLw:A/0xuUXzO4/Xw
- TLSH T14AD2F084EB1E953FD42452BBDCA10B002F79B88A59192F673A5C64686C872DC3D9E07F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\db\data.safe.tmp
- Size 26KB
- SHA256 f939fb5f2123a800cbd9d06c34dfe331033147e13ddcf83af78d764a213435d6
- MD5 8160c2c17771e5f6830c0e528ec253dc
- SHA1 9490dcfd328f7fa6211ec55eaaa4c07f376974ac
- SHA512 044e6213c7fd9532e26c8e8b2d49ca41af0598cf34369193f7a3c98a1c4679e2e344d13e163831914b62fb0c6124d2e5afad321a4c2a718bb2231b5c707fa8eb
- SSDEEP 768:e25EL/0xuUXzJJGcmhu+/XA/RtcCs5KbmbPbSbl:g/0xuUXzO4/X
- TLSH T10AC2EE44FB1E953FD42952BADCA10B002F79B88959192FA73A4C64686C872DC3D9E07F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\5d415f3e-5ecd-4794-8a1e-aee6bc57beef
- Size 871B
- SHA256 6420d6afe0668883616d2acc2aff6b7c5a81c89f90b0887e05516b07f57ee49b
- MD5 3a7ac416785e2c2ac8f778d96eea776a
- SHA1 39acedc4907fe764a77390f0a9414731a7848ad3
- SHA512 32cb15506d372f00b81ff96f94687f0d5e8b1afee36492ed3ab164c055de0bef0e12fa2e3dae04b2a7d830b8e9cf32d07782e4246828833fdf8dd8ef4ee7d27f
- TLSH T18D1100549235B9B3DC6CD24BC96137119BE0752384C994043EA85E040D7E61DA3A6687
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\a321fe08-a7ef-4767-93d2-2e8c140f6d32
- Size 235B
- SHA256 8693b15895165af86e55ab1a8169f7a931cf65bccc80b05db30ca2e3cf5d9d29
- MD5 2ba5853cd7bddebbeb1be14a489ba509
- SHA1 eb3b5f51239263869eeea13a7b1d1adf71b03d11
- SHA512 128ffd9bd36eb066e53c480094db9211068833dc6570cf10041c1fac1a4851cb57a50f4dd87953e3c6f2a30ecf1c7e8494d5c940a7c300db2b5b418efe43ecd5
- TLSH T109D097C024D8277D4C000F17F1B029C630AE4C3310745820D5A181748AFCAC9C19681A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\a73aaef6-d4f4-49f5-beef-740e788808a2
- Size 2KB
- SHA256 f02ec2d19f6f0dc1acd0ea8a3c310175a801416edf375affe6b0d0ed2089a1ce
- MD5 fcbde47949a42fd83b7e8c65c4e2d2a8
- SHA1 125b5baae84ffee74751fd951b249cfa47ced016
- SHA512 3af0e88b1cad89946e7990e11680c3f3029b2d5662418fc524368e455088ef493b43830466f42c1c65a4e2c7d2ad0775a626ef1397c9a147d9d2f545da23242b
- TLSH T14841306C35B84C769CDAE14D9582238D53A08E4300862C436E41EE4C8DE679D337A46A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\b7a92b29-76a5-4068-b16c-e065a2c144e5
- Size 235B
- SHA256 ed3ba35759c6f918acffe330a97b1bdab350e586823da4caed01b4d634a358a1
- MD5 7fcc4a25ba584936bcd2f4ab21dbd77a
- SHA1 edcbd5c94d2febf4cab0f37a0887f52566381dda
- SHA512 8b5259f5702e86dec5dd2db5b8600ec6015fee29205f59dd403af9663d00513f8138413249ec726746c98b9a13aadf473eb7546ff7be0e5cce6a5cc212056150
- TLSH T1E3D0978554E86B5D08044F23B0F06CC630844C3324A598609AA1007C8EB8BC8129190B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\bccdb1d4-5384-4e8e-ae06-976367d0c3c7
- Size 886B
- SHA256 7e75208351d0052e5ad9b7e84d898f594a073d4ef91a7ffc5d2845b89f9697b5
- MD5 e0f693a5f635335725c5ab0755844e12
- SHA1 78ec941073a8e6834090bd683baaf48eab3436ca
- SHA512 c1dbb9ff3296a36482dd95c8a3c611799978a1c63080ae8203079da2eaa732f657b41b6df07024b7ae23e68e52de8639c8e3eb827f11a528957d2e393448b55e
- TLSH T10E1100809739B9B3CC6C924BD9E137428AD0742380C999147E585F184DBA20EA36B687
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\extensions.json
- Size 16KB
- SHA256 fedf2edb3e309b268caebdaf16db101827ae321c7b81e73c930ff5ca6439c9b3
- MD5 1d9f7fb8be03b24e4e703cf375bad87e
- SHA1 8cd27101896413591f7bd5080230ea1db12f4fca
- SHA512 539ff696adee00f83f38e01a524174f500b2b1e7b4f0d62c4d781bdf32af8ee4d14af0ba1a9d1ef590cf10de979a24009146897de0cf6c1dc0ff0853256f9fdf
- SSDEEP 384:mkI4vfUmldvBM8dhW+94zO96otXL4HpL4P1L4HDL4HTL4HN7lO4h5:pI4XRfbXT4e6Yb4h4d4P4/464D
- TLSH T12872421545448EB8298FA79BAA367D02C37D473B60855C38F4DD8FC802FA5B902FB61B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
- Size 1.1MB
- SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
- MD5 626073e8dcf656ac4130e3283c51cbba
- SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
- SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
- SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
- TLSH T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
- Size 116B
- SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
- MD5 ae29912407dfadf0d683982d4fb57293
- SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
- SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
- TLSH T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
- Size 1002B
- SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
- MD5 dcffff15fa618a53834ee4ae8673bd23
- SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
- SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
- TLSH T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
- Size 21.6MB
- SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
- MD5 d14dd3f0107ff91c3e21f301d83f82b0
- SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
- SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
- SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
- TLSH T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\prefs-1.js
- Size 6KB
- SHA256 fc9b29b677ae7ea42402614f5112ee7d66f2a72d75f5201bfe7477392eea7e01
- MD5 126e4f8925a9a4ab3f5c03556166377e
- SHA1 80347afbdf395c81a85ebca60b0fb3e8d7bbba40
- SHA512 12d45c499821662e57ce9f7545bd85cb99254eff94ab7fe5fdeea50e952417bbdba428fd6d1e05dca5b0614d33ef7907b0dba5e4f6f938f5580ba19c1da3e16a
- SSDEEP 96:xHYUTUzqGqZEfUiF1zS1SSlSdv9jhfnvHhW/YBw88n8L4cntGUI6:KORZEfUiFUSSio/YBw88n6
- TLSH T163E11F7891088B6F74B6776CAC688C316AB2413BBBBF68C750B584C4055CF3442F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\prefs.js
- Size 8KB
- SHA256 bccb5f0dacd24eceae3f373e16ec0d061aa21a6424fcd70d93862098e9cb8411
- MD5 f480da11e1fc9eaaa987bd8226511d53
- SHA1 90c80aa6a6648713067dc75223a0320dbd33ba3c
- SHA512 da293543e06f6d4bcef8eafcde54f261d28317c8f3040f1f505b2ed3f925243adaf4475800e430bdc6f6a0b0ed6facd33483a25df603cc6d77d6cb9c017e4ac8
- SSDEEP 96:xHYlTUzqGqZEfIZiFObzS1SSlSdv9jhfnvWRTR59W/UqbiBw88UMOM8L4cntGUI6:KDRZEfIZiFDSSnRg/7biBw88WW6
- TLSH T1D102107C9108CB7F64B2766CAC248D306AA2013B7BBF68D750B984C5451CF3945FA6EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\prefs.js
- Size 7KB
- SHA256 f1e3774a65e0c72e317f077583c231b98f5f7ff7e65fd0066c8973a1687715f8
- MD5 1cc4a5b4f08b78b26058d14ae3557f10
- SHA1 62e0112a9f5dc3d0d000ab61d202d2c92c854f45
- SHA512 cd0b74dcc33f2c95c25517ee63239c0633ab2b2010ec958a986b1e8590a6258a8e06063ce90ae495c7d744bd2225f5f18271ec3c42c0b24f89a54ea23b873710
- SSDEEP 96:xHYlTUzqGqZEfUiFObzS1SSlSdv9jhfnvHhW/YBw88u8L4cntGUI6:KDRZEfUiFDSSio/YBw88U6
- TLSH T183F1FF7C9108CB6F74B6766CAC2488316AB2013BBBBF68C750B954C4455CF3845FA6EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\prefs.js
- Size 6KB
- SHA256 82e6d8ef94d844964fb893b4e495661c46f2db6a390f79235cf22d41ef2e8d7d
- MD5 7c24250d8288dfa52f21691e19c1b067
- SHA1 ab3da194c556e8abb4dc3fee29657621f58f1152
- SHA512 775f3b462ba1572b3de5388c9e54172f2bef8bf98d5c9d3b7eb7510c1ad9c0a41e44bbb5566afd5f874ffbcad9438440feb53189755ada1abcf350e26901f5c9
- SSDEEP 96:xHYUTUzqGqZEfUlU1zS+SSlSdv9jcnvHhW/YBw88n8L4cntGUI6:KORZEfUlU/SSTo/YBw88n6
- TLSH T13AE12E789008CB6F74B6766CAC688C316AB2413B7BBF28D750B594C4015CF3442FA6EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\sessionstore-backups\recovery.baklz4
- Size 4KB
- SHA256 02d71ee501f41ec51d048ab4affae443a64dcb8b4e0e02a746396da956ee3d66
- MD5 feaf3114065218c12555712d6b5f9386
- SHA1 db427d3354a9e5503790c05603eb6ebeeda0ac7d
- SHA512 62d551e6ef10a0c1643c6d56df89a5ade77659e3709b62412eba1d61f80042e9cf13a5cbd428f402dee525d7017a6ffa3d295e564a776906a0b792a67a632232
- SSDEEP 96:eMf6wrUnKfyQeW9jILA0NjoB8kMJttn0YJZQBs:LF6IOnNcB85JttnTZEs
- TLSH T1AB916C02361B68A7FE5B85CBEE584CE145B4310E598188EC90CF662AF76FB47354D076
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 6.6MB
- SHA256 21105f17cbc36bd9440f18499fe99a0ce08a4eb9e7fa806f88d5074c30d6cbfa
- MD5 94aebe142448503156513b3243ab361d
- SHA1 4436ecf656435870119274ca41367f2ecebfd12e
- SHA512 de55a16a11ef7a2df665d1ca8587c57906709369d3f2d1026ccfd39b24f088a17ab31221aa49fcd8cbb3306710f856b43b1b451c1f41a64f8a5d3279d21d2628
- SSDEEP 24576:fFjFK9/mdUjyNEaYy2f2HYwM72bWEfWoC2670HT7a2mT+pvj5EcUg54k6VMIpud6:fFw4SGNbYbL267ijQ+plEzbkI0pmzBR
- TLSH T1F7664BE860D09243F3428073B18993EB21EFD01D607BDA4857A45BE9A5748EF8E177BD
- MD5 SHA1 SHA512 SSDEEP TLSH