Analysis
- max time kernel
148s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/10/2026, 18:40
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
27 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
33 signatures
150 seconds
General
- Target 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
- Size 6.0MB
- Sample261024-xbbwtsbw91
- SHA256 2f0a2d7de6fd1821aaa5ca2b46cb49350f467abf04f8c2ac0009b616392fdfc4
- MD5 272b09a5372b78a9646382ad80a81e57
- SHA1 b59869ebbb9664b68c8be7b0b64c83cc96a767e8
- SHA512 598f751bc55f161be9af0b0696189be72fd3ad77ce060e73664bd24dbb027a0b1744ca5203d625378508c39b189acd7cd888b5b3cfc89def9ef0d50435870163
- SSDEEP 98304:w/hm22GGvXuJa+P4e18frP3wbzWFimaI7dlougb:Yl2GGvXuQ9gbzWFimaI7dlKb
- TLSH T135569D51BE4D8176D90B1172472D9F2A102ABD287B3865D3B2B43E7EEC363C16D3960B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Floxif payload 1 IoCs
resource yara_rule behavioral1/files/0x000e000000024121-1.dat floxif - Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 4 IoCs
resource yara_rule behavioral1/memory/2900-24-0x00000000002C0000-0x00000000008B3000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2900-487-0x00000000002C0000-0x00000000008B3000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2900-497-0x00000000002C0000-0x00000000008B3000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2900-849-0x00000000002C0000-0x00000000008B3000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers - Detects executables containing SQL queries to confidential data stores. Observed in infostealers 4 IoCs
resource yara_rule behavioral1/memory/2900-24-0x00000000002C0000-0x00000000008B3000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/2900-487-0x00000000002C0000-0x00000000008B3000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/2900-497-0x00000000002C0000-0x00000000008B3000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/2900-849-0x00000000002C0000-0x00000000008B3000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore - UPX dump on OEP (original entry point) 7 IoCs
resource yara_rule behavioral1/memory/2900-3-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/files/0x000e000000024121-1.dat UPX behavioral1/memory/2900-19-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/2900-25-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/2900-459-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/2900-488-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/2900-850-0x0000000010000000-0x0000000010030000-memory.dmp UPX - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000e000000024121-1.dat acprotect - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Loads dropped DLL 1 IoCs
pid Process 2900 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe /onboot" 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\e: 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe -
resource yara_rule behavioral1/memory/2900-3-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/files/0x000e000000024121-1.dat upx behavioral1/memory/2900-19-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/2900-25-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/2900-459-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/2900-488-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/2900-850-0x0000000010000000-0x0000000010030000-memory.dmp upx - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\System\symsrv.dll 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe File created \??\c:\program files\common files\system\symsrv.dll.000 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Checks processor information in registry 2 TTPs 20 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A} 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006} 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243" 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe" 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Software\Microsoft\Internet Explorer\Low Rights 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe" 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3" 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe" 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm" 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4} 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3" 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3" 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Modifies registry class 17 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1" 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan" 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings firefox.exe Key created \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\WOW6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D} 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Therad = "1" 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter" 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe" 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User" 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD} 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Model = "296" 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2900 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 2900 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 2900 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 2900 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 2900 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 2900 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 2900 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 2900 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 2900 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Token: SeRestorePrivilege 2900 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Token: SeDebugPrivilege 1676 firefox.exe Token: SeDebugPrivilege 1676 firefox.exe Token: SeDebugPrivilege 1676 firefox.exe Token: SeDebugPrivilege 1676 firefox.exe Token: SeDebugPrivilege 1676 firefox.exe - Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 1676 firefox.exe 1676 firefox.exe 1676 firefox.exe 1676 firefox.exe 1676 firefox.exe 1676 firefox.exe 2900 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2900 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Suspicious use of SetWindowsHookEx 11 IoCs
pid Process 2900 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 2900 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 2900 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 1676 firefox.exe 2900 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 2900 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 2900 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 2900 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 2900 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 2900 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 2900 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 2900 wrote to memory of 2276 2900 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 84 PID 2900 wrote to memory of 1688 2900 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 90 PID 1688 wrote to memory of 1676 1688 firefox.exe 91 PID 1688 wrote to memory of 1676 1688 firefox.exe 91 PID 1676 wrote to memory of 4484 1676 firefox.exe 92 PID 1676 wrote to memory of 4484 1676 firefox.exe 92 PID 1676 wrote to memory of 4484 1676 firefox.exe 92 PID 1676 wrote to memory of 1216 1676 firefox.exe 93 PID 1676 wrote to memory of 1216 1676 firefox.exe 93 PID 1676 wrote to memory of 1216 1676 firefox.exe 93 PID 1676 wrote to memory of 1216 1676 firefox.exe 93 PID 1676 wrote to memory of 212 1676 firefox.exe 94 PID 1676 wrote to memory of 212 1676 firefox.exe 94 PID 1676 wrote to memory of 212 1676 firefox.exe 94 PID 1676 wrote to memory of 212 1676 firefox.exe 94 PID 1676 wrote to memory of 4652 1676 firefox.exe 95 PID 1676 wrote to memory of 4652 1676 firefox.exe 95 PID 1676 wrote to memory of 4652 1676 firefox.exe 95 PID 1676 wrote to memory of 2072 1676 firefox.exe 98 PID 1676 wrote to memory of 2072 1676 firefox.exe 98 PID 1676 wrote to memory of 2072 1676 firefox.exe 98 PID 1676 wrote to memory of 2072 1676 firefox.exe 98 PID 1676 wrote to memory of 5392 1676 firefox.exe 99 PID 1676 wrote to memory of 5392 1676 firefox.exe 99 PID 1676 wrote to memory of 5392 1676 firefox.exe 99 PID 1676 wrote to memory of 5392 1676 firefox.exe 99 PID 1676 wrote to memory of 5684 1676 firefox.exe 100 PID 1676 wrote to memory of 5684 1676 firefox.exe 100 PID 1676 wrote to memory of 5684 1676 firefox.exe 100 PID 1676 wrote to memory of 5684 1676 firefox.exe 100 PID 1676 wrote to memory of 5852 1676 firefox.exe 101 PID 1676 wrote to memory of 5852 1676 firefox.exe 101 PID 1676 wrote to memory of 5852 1676 firefox.exe 101 PID 1676 wrote to memory of 5852 1676 firefox.exe 101 PID 1676 wrote to memory of 5892 1676 firefox.exe 102 PID 1676 wrote to memory of 5892 1676 firefox.exe 102 PID 1676 wrote to memory of 5892 1676 firefox.exe 102 PID 1676 wrote to memory of 5892 1676 firefox.exe 102 PID 1676 wrote to memory of 5908 1676 firefox.exe 103 PID 1676 wrote to memory of 5908 1676 firefox.exe 103 PID 1676 wrote to memory of 5908 1676 firefox.exe 103 PID 1676 wrote to memory of 5908 1676 firefox.exe 103 PID 2900 wrote to memory of 2316 2900 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 105 PID 2900 wrote to memory of 4916 2900 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 106 PID 2900 wrote to memory of 1324 2900 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 107 PID 2900 wrote to memory of 3376 2900 2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 108 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_272b09a5372b78a9646382ad80a81e57_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:2276
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html2⤵
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2008 -prefsLen 27100 -prefMapHandle 2012 -prefMapSize 270279 -ipcHandle 2096 -initialChannelId {64cec353-ac6d-4de4-9214-073ce8786aef} -parentPid 1676 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1676" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu4⤵PID:4484
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2500 -prefsLen 27136 -prefMapHandle 2504 -prefMapSize 270279 -ipcHandle 2512 -initialChannelId {4fcca09e-41fa-4dfe-a773-e1847b466f0f} -parentPid 1676 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1676" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket4⤵PID:1216
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3808 -prefsLen 25164 -prefMapHandle 3812 -prefMapSize 270279 -jsInitHandle 3816 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3824 -initialChannelId {48b0c41f-85ab-4908-8571-ca91e0643394} -parentPid 1676 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1676" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab4⤵
- Checks processor information in registry
PID:212
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3996 -prefsLen 27276 -prefMapHandle 4000 -prefMapSize 270279 -ipcHandle 3808 -initialChannelId {1aaf4d98-0f78-41e2-8479-4c81fb602de3} -parentPid 1676 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1676" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd4⤵PID:4652
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2988 -prefsLen 34775 -prefMapHandle 2932 -prefMapSize 270279 -jsInitHandle 2700 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1548 -initialChannelId {8ac1b55b-8c08-4fe8-a0f2-980b93ad4c30} -parentPid 1676 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1676" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab4⤵
- Checks processor information in registry
PID:2072
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4800 -prefsLen 35012 -prefMapHandle 4804 -prefMapSize 270279 -ipcHandle 4812 -initialChannelId {b8e5e913-e747-48cc-a22f-4b5e163d8aa3} -parentPid 1676 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1676" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility4⤵
- Checks processor information in registry
PID:5392
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5196 -prefsLen 35064 -prefMapHandle 5200 -prefMapSize 270279 -jsInitHandle 5204 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5212 -initialChannelId {ac43d373-e67a-44f6-8dc9-18b9ec85758e} -parentPid 1676 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1676" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab4⤵
- Checks processor information in registry
PID:5684
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3820 -prefsLen 32952 -prefMapHandle 5224 -prefMapSize 270279 -jsInitHandle 5356 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3876 -initialChannelId {5c7ba365-ddf9-41ac-8fa9-7bca83382894} -parentPid 1676 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1676" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab4⤵
- Checks processor information in registry
PID:5852
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5360 -prefsLen 32952 -prefMapHandle 3880 -prefMapSize 270279 -jsInitHandle 3864 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3944 -initialChannelId {669b7ca8-35f3-4f57-97ee-19c14c216e33} -parentPid 1676 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1676" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab4⤵
- Checks processor information in registry
PID:5892
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5676 -prefsLen 32952 -prefMapHandle 5680 -prefMapSize 270279 -jsInitHandle 5684 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5692 -initialChannelId {da61c002-74a8-45f4-970a-000ee0837951} -parentPid 1676 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1676" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab4⤵
- Checks processor information in registry
PID:5908
-
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:2316
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:4916
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:1324
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:3376
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\System\symsrv.dll
- Size 67KB
- SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
- MD5 7574cf2c64f35161ab1292e2f532aabf
- SHA1 14ba3fa927a06224dfe587014299e834def4644f
- SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
- SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
- TLSH T17863F1372AB5807DDD210D37949F835AB771E5A76C20643FC25907D988B8DD0E3239AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\System\symsrv.dll.000
- Size 114B
- SHA256 aefc503b1ed462d7b6280228a7b5b710792273b78934426f88325341ac5b5a92
- MD5 e609411db8aa6775d0344c75c23ae79b
- SHA1 1d2ff6194bf159ce36cd0461cd3da29486d1e97d
- SHA512 6884ff5c07bc687132c965a59cb8c5a898a25da74c6c846c1d6089ddca8007cb7e4d2f8520bdce9fbcf6e2f9c9e5c28d8c8d6d049d3522470bdc7d38bbfa0ad0
- TLSH T1FFB09262AA2791EAE1AA224505A0248C1ED0B62AB48638002EBA5A4E93256A85916147
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\sln8pgmh.default-release\activity-stream.contile.json
- Size 4KB
- SHA256 6203bba4111d012b32c7d5bc16a4ee7722a22b0c45bc838f9377fffca6fd8f7b
- MD5 b6a534ffa33d8d230d02650df81f3e2c
- SHA1 2e4619ff180d603d0b1f19bcf7dfe058cacef9f3
- SHA512 472a5d2f6a1ae4feb1e7e8577ec74fb2094b2e910ce67d88b228839f0c49e4be0414993df86bc852e8367b99031759dcd6994d6229930c751ee3103ccc89d5f4
- SSDEEP 96:T9GoMbgXLmb6DnQz+WT+mRcvLEn4KYDAyHzmW6D5Zolz:5RMaLOaQazmRcIYAKCWw5ZoF
- TLSH T1729198ABC57484521B30B6E16C4737ECF10B7006DAE18F6871699CA1995C7BF90DE988
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\sln8pgmh.default-release\activity-stream.discovery_stream.json
- Size 75KB
- SHA256 0d8869d57b462d630adc76c5b8b4bd51d375d33cae5482def998b894cd1a5164
- MD5 2c9ddc064325996d32f53af45682c543
- SHA1 561416bcdf8e584143ec940ebc7ed360d6efb50b
- SHA512 087f49127eb8f74e598cb39610adcb599d698d9e627dc17452efadec451def139c099a7a2edf8bce1f1269effcda10104b87d79626c215d7106e70e41c5f32dc
- SSDEEP 768:zyEKSQsDAKnDcMri+C51DO37hyBKiBNBokL4XZ7obHOOryn+GkLGNwii:OEKJMCa7hEK2IkL4XZ7obPGk5
- TLSH T15E73E9A396E8B1BF0BD037C72C0FB95B66F20195E38206C9FCA9C91D819D754133A5AD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\sln8pgmh.default-release\cache2\entries\E9338C5CCF1E2FCF149487351399F198A4F9FCD6
- Size 16KB
- SHA256 ebae8354efc86f64dfcc5d016188d91dc2e88934e18d40a30dfb4f095d60c7c2
- MD5 7ec01c26227b728ed9beec7b54a58302
- SHA1 83b620f96914950cdab731f308a8a31b58611a1f
- SHA512 0e6196cf76f0dbcf6e1131380a168f126c478dac262c0beaa2cc3111ce49713e54e0031913fbeb44724cf80d15d2622882891cb1655a1a99e340876491acc1d9
- SSDEEP 384:HGNQiO024YvWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMA8:mDZYvWTToXJWTTogB7S/AmVAf+hRMB
- TLSH T10E729E7D8F013CBC2B5790E9C8B583548D18B7ABDFB6C06D25883D09C988A1A71F945F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\sln8pgmh.default-release\startupCache\webext.sc.lz4
- Size 104KB
- SHA256 2a49c2cf5aa5faf38bb86e03c9c97f0ba0d69cd84ffd17bf74119f882d3baf6e
- MD5 a3ced574e4a32f1d3198943977458dab
- SHA1 53236df81045fdc69c0c3d78b26e8f87404eee57
- SHA512 9ea55e4d3bb38fbce75ca6078096f7cbb4ad04ca871448a6f686ecd359807dab343ac4a5a127761039cb14ca1ad0985301ac72b0a408f2713482759bf85c2802
- SSDEEP 3072:j3lWHwMzowwtoSTWADcM7fp98xT3ALt9e:pWVo5oSak7x98VktA
- TLSH T112A3AFF6DFA28D3D64FFD42D9A82C43EFD262414B3A7200ACD63236561C6B746778648
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\sln8pgmh.default-release\startupCache\webext.sc.lz4
- Size 105KB
- SHA256 65b1924a0ecf076c37098d75e1f6403c6cba7bd3f327193b4b69e7ed27bedb63
- MD5 65cc4cb2ce8672f95c45f0b4e13f86fb
- SHA1 31d5f801321344e59c23a09d511db5cce897c11e
- SHA512 657073171692e686a3c5e30aad11c9b20fc4ccbf5d57300030510ee0be3aee56984c762f28c4cab494ce892d73515cf7166e2d3b2c6981e13898bd182fbc23d7
- SSDEEP 3072:X3lWHwMz9UV+a0sSb0azMzfp98xT3ALt9D:FWV9lhsSb6zx98Vktl
- TLSH T190B3AFF6DFA6CD3D64FFD42DAA82843EFD262414B3A7201AC923231461C6B746779648
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 11KB
- SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
- MD5 25e8156b7f7ca8dad999ee2b93a32b71
- SHA1 db587e9e9559b433cee57435cb97a83963659430
- SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
- SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
- TLSH T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 502KB
- SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
- MD5 e690f995973164fe425f76589b1be2d9
- SHA1 e947c4dad203aab37a003194dddc7980c74fa712
- SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
- SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
- TLSH T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 21.6MB
- SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
- MD5 40bf410fa9ef0d5499907e34885af6f4
- SHA1 4d7722337a0e26bf4a1c6478129356acb2f7b720
- SHA512 b763712aa4bd9819b7972a40216c08fd32338b14fab7ce4b166e39ce441ad62678bf0e1f25da436ffdb56ff1b1a21e3dbbaf47c0f5918c252e70656f5d0307ac
- SSDEEP 393216:KYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHY:3mghF5QDwWCm/2YU8Ivq9u5P
- TLSH T14F37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\IDM\DwnlData\Admin\www_internetdownload_1\www_internetdownload
- Size 9KB
- SHA256 5b462f6871410ba49ff47a42bc44d8451f93f60a1ece48381a912ac3519ef51d
- MD5 aac4518aa1126176803781ab9d7a54d3
- SHA1 a1804bdc2bde93ac5c6a693f2176d381cbbdbc67
- SHA512 ccff9383a3b665e8ddf8cb769d684698a8b84a5a3498df1e8288a49bfa22b9f98f9f3364f5c4d3cbf7642fd008a65bec5e7956a18bea96cb7b7163f92cc1b132
- SSDEEP 96:hpK4+cLOruFL1macbpFS02HxQfErjpkB/WRXZksDaRMb4Fw9HM0:jN4eOZEJG+ZkcaRLGFM0
- TLSH T17522DD2F5004B23501521009ABB6A3F2BB1EB03AA74592A648CB946C7737E7EDB7D1D7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\addonStartup.json.lz4
- Size 4KB
- SHA256 1ab2307f67eb47c467cc94067dd59a9ecd7a171a876e69fdda782cb0b459358b
- MD5 ce26bd43a46feccd5103d39feeee3d8c
- SHA1 cde07d286e9c65561c7cac6caa274b2c9350a26a
- SHA512 375119c5bcd16f03a4894ffc964d652fb02efa8ae1f76d82c20688e344da73047b188aa13565740682a88f7abe8bca01006983b35246df47ec81658fd7e85364
- SSDEEP 96:NIM4sHNw6M2xWGhD41MgGvmHhF+rUpO1LnOYvhQhIRhN:NM52xxhD8rGvm6ApwnHUuhN
- TLSH T123A17E79D581EFA2FE32C04258D97FB2EA99AB3414B9C4D4F1AE71154D749735700340
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\crashes\store.json.mozlz4
- Size 66B
- SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
- MD5 a6338865eb252d0ef8fcf11fa9af3f0d
- SHA1 cecdd4c4dcae10c2ffc8eb938121b6231de48cd3
- SHA512 d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c
- TLSH T175A022C28E0C83BACF000833008AF00300E83B020B8B0F882AC2AEF8200200C8082082
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\datareporting\glean\db\data.safe.tmp
- Size 7KB
- SHA256 edd3d2fb9978c9ecc3808dd3221ff12a69bda849addde46805ffa2a98f3018b2
- MD5 38d9bf2a767590d78fc2e42a80358df7
- SHA1 9d9c1c63a5a5d36a094ee2de3e6a4b1faf662a9e
- SHA512 fddf547acc239fb7be2b19a7518f009e0464aa60b0341e0d2dea3910c23933580a1f6b49c4bd821aebb806e740900aef710ae825fbb81c619d9c684214236ea6
- SSDEEP 192:qOv5zboPKHlyjsMd1d66JozGzgCl6mc0d:JboSHlyj5d66JozGzgC1j
- TLSH T1EAE10054E628863FC408027BDCA61F414F3A389BD84E3F1975AD65182C5B3DD768E17E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\datareporting\glean\db\data.safe.tmp
- Size 7KB
- SHA256 e2cbfb89f1080d9f2e30082498c4eaf9dc27df9aefd00b58268e59da798cc93a
- MD5 2a5766305eca1c9f4e7746fc909d51f0
- SHA1 170d8cccba17f20ba44ac7ac534e39c710b4a971
- SHA512 107b3575ded0ad5b6614f77ceca45590f92dae714a3caef8ccbc40201272662031a0205d68667befe77fff05c83a66c50fb7edc87269d3cfff4a5f62e6f252bd
- SSDEEP 192:y1d66JozGzgCl6mc0dVOv5zbooZHlyjsM:8d66JozGzgC1jUbooZHlyj
- TLSH T1A7E1FF68E628463FC408127BDCA61F410F3A389BDC4E3F2975AD65182C5B2DD768E17E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 6f80858a97bafdf9ba976ea28002037ecc391558ff223207437127ea30bf2d10
- MD5 2766654ca36fafdcc9e2a4acc2389c42
- SHA1 08c9bb83f84bcc850e91d07e73c3b1f097be6ca2
- SHA512 8742da7634f4daedd569b6fdba3e4a04ddedc9d8936fdffbbe06e71b24b1e2fc43671d0aefc8acabbb09c09ae4da7a50476fe6a1aab33ece7fb42c74b0df3652
- SSDEEP 192:y1d66JozGzgCl6mc0dVOv5zbooZHlyjsM:8d66JozGzgC1jUbooZHlyj
- TLSH T1F8E1EF68E628463FC408027BDCA61F414F3A389BD84E3F2975AD65182C5B3DD768E17E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\datareporting\glean\events\events
- Size 1KB
- SHA256 d7372a5c241b4edd6b593241e4d7b066f586cae4934c621780bd0f070a312704
- MD5 8f519d81a10c1cc042a063dcd2ed7761
- SHA1 938fc861ebbec54eee29b872811b48dccf64c256
- SHA512 8c1552afac43c393cd18fc7316b99d2aa11d504b851949eb466950cf4f9e381f0d34a17aa8133744af5bb10dc34e00b081d13f2a62c5ea84a2748be5e06f594b
- TLSH T1C6217C5C3DBC4D2A99C7F6AC7481028E63558E0B14871C435E12EECECD81ADD32AA4BD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\datareporting\glean\events\events
- Size 2KB
- SHA256 ccaad8975cc4bf2a69dda0025d5edb15d7d2abc64d536d9c30c3b4bee27de936
- MD5 85d8699afc8603bffa31702eeabc7435
- SHA1 99cac2e355bb6400805023d9bad1631abbf6030d
- SHA512 4a8ee5f65cd841e46a6607730e971d8ddea0babe966b93722b0205cea89ab64858f72040b46beb0a59a789f424377d1dd04e35d132bbdfd52a49b059905be9a5
- TLSH T1BB41AC1C6AFE4D7E6887F6DCF441028DA7494B0664C31D835EC6EE89CC42A99329F47D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\datareporting\glean\pending_pings\37f19341-ee6c-49c6-8e88-aa0997623919
- Size 15KB
- SHA256 c76ea8bd88088335aad5bd579f09f8f18bb7c55211d52be42289422a96a9b683
- MD5 3052e1a5101950b5ef77878da9fa7813
- SHA1 59f66f237e4515e06f198cbf654555b6005740b8
- SHA512 d11deeaa8f33a0109eb688679f5239585f974aabfc286123e7b383382996de92d43440bcbb0d2dafa86ad2687319ec3600a26cb5fde5472f13c729f52b0257d3
- SSDEEP 192:Jhi7teYwJKIu1rf2r6LE6sbBKag7pJdAdoCQ/ps6ub4rREjYpBvKHO2zxUQ1kYDt:Ju1+89CKps6uEkWoHO2lUQ1HDpX
- TLSH T12662D9566470597A8691E368D4EC7FC3E2F618CF8C029FCA9BE47D0869EF06D1127847
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\datareporting\glean\pending_pings\56a03a54-adff-4b3f-a98f-ef44f59efd2c
- Size 2KB
- SHA256 034c84bf1d4e256ed8b50fce3e608547ad7a3561438eead1c2088ad7e41ce05a
- MD5 022f42373b58a4559c908539d512b6f3
- SHA1 dc2a87e01c79b1c344cfc07d509cead1b45d615b
- SHA512 37ffacace826c8dd778590d65ebcea211bb12717cbc376644c34abc3285431ab910bd820e49504e7bff1d782f760df88c302a605210e1c5fe911a7bb28e77b06
- TLSH T19541625C75B88C379CEAE14D9081334A53B48E5340C52C837EA1EF0CCDA679D23AA52B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\datareporting\glean\pending_pings\6005e050-9332-40ad-a30f-9a60bc196933
- Size 883B
- SHA256 ffbeca7cfcfefb55108ea5bdcdcf869123397a4ba19021504b9d5710c7cae4d9
- MD5 67421c27434b79a61230b3be45d13668
- SHA1 ddde6536087fa107fb03f38a516bbcb0987c48c2
- SHA512 4386652219910e026148f4d0c151edeec6d945352200459ca7a64ab04853412496cb701051f7dedd420d0d64becea9eaa4cc7d4a782d451649ff5e5280539431
- TLSH T1FE11C041E67179B2CE6C920B85E537038BF83933D0C995143EB59A140C7E61D939A64B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\datareporting\glean\pending_pings\ac15f145-b0fe-46e9-84df-5744a2538ba6
- Size 235B
- SHA256 24c9819d4f069973a689bbe82e0d367cc4efa3822f2c4419f20ea7e95ad6455d
- MD5 4e69bc3ebfc9db0b1fb61d2870e680ba
- SHA1 c23e26846f02b6aa5d30cbbb2325ee7a2e347f5a
- SHA512 ec478120bedd380a56e423b74ec335cc352137b39c1d1bef6f9af6282163e3adc107c6d8adcff6e88b784d9f6d86736ea561eff7763c259008c5a989fca2dc5e
- TLSH T160D09780248C27BC08180F06F0E0A9C630588C332464A868C6A0407899BCFC401A2807
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\datareporting\glean\pending_pings\f1341486-f84f-4b30-859d-3dd623033397
- Size 235B
- SHA256 3eb0a66d0631e0ab25c7c651ccd7b1fae2f23fe07187e99387b0eb770de2eb55
- MD5 9af3d04ff708e7ce6327bacb87932d18
- SHA1 6d65b727eadd731da9f19f5c296922bac64bc4b5
- SHA512 4659c2675861815d6f292d86cab046140e8de45e3171d7ae9c0818970251d64556e98ed0e34386d921ab6c29477c0e04ef519b04d267a9648d759d3bea5229ab
- TLSH T179D0A7C4589C679D08150F16B0E179C675888C331474A8559AA146B89DFEEC941A2C6B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\datareporting\glean\pending_pings\f7cb034b-a449-424c-889e-9824deb3fa00
- Size 886B
- SHA256 5fbaa3cf524a5f1bc305b87e18d828bcf72b65acaf7401ed3eec0398db9e3a54
- MD5 3868b608413bd51b97b690de9aa36122
- SHA1 b82162358d4c26f1a6298f77d3638500a1d56d1f
- SHA512 ddc438f5586e7eaefe7cd55d78b6a415766ba4e5d419703b828f2492dc1d6a004f908053555c46122e8094491411b027461b85bdbfbfd57b272213424d8590cc
- TLSH T11D110041C63179B2CE28928799E13B0287F82433D0C949143EA49B2C0CAF22DA3AB707
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\extension-preferences.json
- Size 942B
- SHA256 cf91c5fcebee0d71d0d20ec46579b48dac36dac9f7282050c722a145290a6686
- MD5 049e3f74f928fcd7fdc29233b7326c88
- SHA1 a99947bcaf045b7bdea588d5c76c3407f1ebfcea
- SHA512 362cce92211768838d31b556e22e7810357b52caebefacee6ba05228fcc4dccd813bc40a19bded3ac3a8bf886bb7310ea7fd46cce5f599de9891df53813558b6
- TLSH T14311F13A640B6EB01E8E5625FE384A92E791111B50B7F2E47E69934A13D3970C1ED39C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\extensions.json
- Size 14KB
- SHA256 b03b35c68cdc22db5c819f8c505a972e8832d130bc0e034bb0bd71527cb697b3
- MD5 a703452cf7b0d35730edf2668d284723
- SHA1 fc4b2c23bee560c937481e88471c953b86c7a5c3
- SHA512 aa9a306ac7b5033f1bffe9d6d9332a9d077a695985c46f20656530a603a367a9bba8c58c44a17797257bb80017dcf589dfdbd49876b1ef4fe845d67c30ea584c
- SSDEEP 384:XkI4vMUmldvS8dhWA94zs96oxL4Hb9L4PdL4HXL4HoL4HC:0I4ERf3Xp486y454V474K4i
- TLSH T12262421545048EB8298FA79BAA367E01C37D473B60845C78F4DD8FC802FA5B902FB61B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
- Size 1.1MB
- SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
- MD5 626073e8dcf656ac4130e3283c51cbba
- SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
- SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
- SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
- TLSH T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
- Size 116B
- SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
- MD5 ae29912407dfadf0d683982d4fb57293
- SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
- SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
- TLSH T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE
- Size 473B
- SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
- MD5 7406820f5d56fda6baffa951c60679d2
- SHA1 e7d4894993e506e235d55b3e47aed019d0584148
- SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
- TLSH T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
- Size 1002B
- SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
- MD5 dcffff15fa618a53834ee4ae8673bd23
- SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
- SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
- TLSH T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
- Size 21.6MB
- SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
- MD5 d14dd3f0107ff91c3e21f301d83f82b0
- SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
- SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
- SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
- TLSH T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll.sig
- Size 1KB
- SHA256 c5f50bed6afd38490baca2ce8e8fdd1a39849c9f0dc06478a8a2e9226526607b
- MD5 61d51cf075ad6dcbaaebf956c6bc1dcd
- SHA1 f176331dcdb84327afd47ecf8ede3b0664c7d05a
- SHA512 de263ed43f1112786186afa7bb942f25482fe60b04e7138c3687ec09956e0247307e5a6303a4297f785a572ed9a0059747a9b870c2fb6e84483373cfe27ca6c5
- TLSH T1C421B6DDAD2426542DC0EB2D5EF8E826DD3112C2F96404BB426666C3FCA3BA038C466D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\prefs-1.js
- Size 6KB
- SHA256 68451b84b51f3750258ab8961958d097bcfa1efa08ef5b50e87a21c43d08e508
- MD5 dd47567575e1bec01543a85fc48da75f
- SHA1 afd531e9a0d40e6b2c3dda3f62e800230e656d75
- SHA512 f84804cfc7bc0bf28dca802cf2752cb09a0d5c28931369bf97dc5f0fd5e9b229e96ea16b34f3ac8641d08cfefded33d437ae2a4a916f8a20884a8a9441117bf7
- SSDEEP 96:xH5UTUGqGqFfwee1zScSSlSdv9jnRn2RHKpBw88n8L4cnEVoR:XBRFfweeZSSx9KpBw88ZG
- TLSH T1C4E11E789448CB6F74B637ACAC6888316AB2013B7BBF68D750B554C5011CF3442F9AEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\prefs.js
- Size 6KB
- SHA256 121fd05ff81ebb61d7814e8455d0d6b77a641827d9437fe242d82864145a38ba
- MD5 7fb307092e32667cfa64a1f1bd1b57bb
- SHA1 3d18515e152020080862006c9383088fff0e8791
- SHA512 e6cc7405d4193063b18b4d85c3972c1c6e456e7f2e1dee66000d75e7058cf70fd8e8f609e4da9a3d16a427d0b635e3f84a3ed0e1db7a73bd5a68849b67672459
- SSDEEP 96:xH5UTUGqGqFfwdt1zSH3SSlSdv9jnRn2RHKpBw88D8L4cnEVoR:XBRFfwdtC3SSx9KpBw88FG
- TLSH T143E11E7894488B6F74B637ACAC688C715AB2013BBBBF68D750B554C5011CF3442F9AEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\prefs.js
- Size 6KB
- SHA256 2bd46778c8436ebb7052d154a76fddaa89620c604d49efc641a51def75ac0271
- MD5 df916217104613c5afae0b8a32c7f24b
- SHA1 2253e7bb6214e5c7914a00140a53688bf3b8938d
- SHA512 29a3c8b20359239e158c4f494b20e5dd0f984ee1aeffc7f19829be559f9a44a78aa0769ecee76678a55deacec78b8a731546f99adb9fa417c3a2b4af0c3146f1
- SSDEEP 96:xH5UTUGqGqFfweeObzScSSlSdv9jbn2RHKpBw88n8L4cnEVoR:XBRFfweeCSS79KpBw88ZG
- TLSH T13DE11F7895488B7F74B6376CAC6888316AB2013BBBBF68D750B554C4011CF3442F9AEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\prefs.js
- Size 8KB
- SHA256 b16b2bca5af6b4d5193852aa7f7b13282f34b8275691ac1f7d8a9afc4a7c5ce0
- MD5 a2c102c22d55125f977e759428ff8433
- SHA1 02c8551e9ff5dffafa9996482427a223e59d9d6b
- SHA512 a7885637eeafa0a338c0dfc1ca01a6ee36805fd76b4de47673d872cba3c50b666a12095436cc241724f3eafea6471369136d10fc4cb22fd3b1852ad097d814a7
- SSDEEP 96:xH5lTUGqGqFffeeObzScSSlSdv9jbn2RWRNO0Bw88404y8L4cnEVoR:XgRFffeeCSS78Rk0Bw88gOG
- TLSH T1F2020D789408CB7F74B2367CAC2489715A62013BBBBF6CD651B954C5051CF3842FAAEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\search.json.mozlz4
- Size 327B
- SHA256 a4c8d0344cbf6e230cecbc4d989de36ec075cd8eda7ae740242e1b05b5dd3fd4
- MD5 240589068f063f8f706378168230e975
- SHA1 9531374a22dea374d032f7484567fb1b201af87d
- SHA512 6d04629da44769a64b8808d198f3b3ba6388a0cd5441269e35ca39e7595c4e9abd32618f76ff60b79df80732838ee2a67455e195a801a67334a592b6b6240da5
- TLSH T169E07D3E9C15A0B6C2AC0AC35F0F494A0F58583A9324AC8C90B49D91557FF9B5248E2B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\sessionCheckpoints.json
- Size 90B
- SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
- MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
- SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
- SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
- TLSH T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\sessionCheckpoints.json
- Size 53B
- SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
- MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
- SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
- SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
- TLSH T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\sessionstore-backups\recovery.jsonlz4
- Size 4KB
- SHA256 17dce0cf9d89755475d121c646f64c92153358295952f0c25552ae9ed7c23f90
- MD5 8a26bbaa3bd31649380cb1954e1e5e01
- SHA1 269d33c49f2c4009b385c8bf331ed0474171ee6b
- SHA512 c401b8f77725d340a74309e2d1ed042bc5bdb04ec38dcc25eb75f40779627939edf85aaec70ac092b0336bb7bb92329b45bc2ed0ce7c618e22640c3c27370eb3
- SSDEEP 96:Y+DBfI8eCgYNCz6eW9jILA0NjoB8kMJttn0YJZQJ3:FpVg5OOnNcB85JttnTZ0
- TLSH T1CA917D8A370F7873FD6B868BDF594CF185A8300A55C084DD81CF3B16B62BA477499475
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\sessionstore-backups\recovery.jsonlz4
- Size 4KB
- SHA256 fb850bc55f621b39bf3c545b12eb79daf407a458a8dc9773a5b71359d43cb4e0
- MD5 df7b03c924bb420cf9cf6cbc52f4f3d1
- SHA1 ab8c4a86997e8066bd56fc1e242583e400272b68
- SHA512 197ce2d4afb580c09228793af22905bf07fc3205d993c0391f7987ee6e87e9fb11bed9fa7560ffdb30bb30aaab4c7443825a44d8176c0dc533dc68f5a1aca688
- SSDEEP 96:Y+DBfI8eCgYNCzfeW9jILA0NjoB8kMJttn0YJZQJI:FpVg5rOnNcB85JttnTZ1
- TLSH T128916D8A370F7863FD6B868BDF594CE185E8300A55C084DD81CF2B16B62BA477499475
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 5.5MB
- SHA256 bf652e7dd116096cf4f8023798912da88c11d65117b70941ff280a8e336d1f99
- MD5 e4c1e041ac521c57de612374aec893e6
- SHA1 34a281d5f9b41df9103cc2f2af7c2b1209ab1e18
- SHA512 7b9e1fa7578047dfe4b6fd5a76037452a9fcdf0c982ffda43bcc6394bbdfd82835a702123c8126048643ef1bfbecce76037fc9f26a2f4edb8553b4063783f5ea
- SSDEEP 24576:eqJRamMRlze7GfDXY28Ym3TkdYFzDMfdDRa9uBQV0qIoIjWtR+gCoMtooDXo:eqS1Q0DXYj21GeQ/xI6tRjCoMtZU
- TLSH T1494629E820D1A297F3814073724593EB21EFD00D5037DA085BA99AE9A574CEF8E17B7D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 6.2MB
- SHA256 5270e9aeb7a45472635a81b173be5f0bdf4292bef4c22a613ce75ae65d7e0c30
- MD5 7548fe439869eed0670239723783a268
- SHA1 7f75afcd851e3a8ff3edd63558c1e8f36ca913d9
- SHA512 848239354f6e5a3c066f5ea5438c60d1b855e119b86da949f638d1d8550e020a13833e6405eaa89596cf7ad93565389a52aeecc86e8f87a67b6262f28c1f34e5
- SSDEEP 24576:AEcke7afj4ZdWhbFRR8YaXokdwkbDMfE7Ra9uBQV0qIoIjWtR+oKoOYoy1dyFp9:AEte27KdWbFRQ9dGeQ/xI6tRLKoOYKp9
- TLSH T1716629E860D1D247F3864073B24983EB21EFD00D5037DA0857A55BE9A5748EB8E27BBD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 7.4MB
- SHA256 62f887850c25e4ad1329003d9664aecb249732038b3f7f9aee66e3d24839cd4e
- MD5 9bd6eaf76661a835615b1df4062ba02a
- SHA1 d7990ced37402efeb37306d9a210642dd3ba69d5
- SHA512 1dbc6abed78f8a1879b6ae99028f451c6def45e6a4a6940bfa110beba2f1ebb55f4d0de1013fd51f73da40da83a05ad34032cb1159d20fc012055bae09950225
- SSDEEP 49152:ZOceoMSdWRUtRugQ2IyPHsTtw8r9N/21npbwQfrJ3GUvEx45ISlBqXbg02lcr+jl:kfXgQ2IGHYw8r9N/
- TLSH T10B764BE820E1D253F38640B3718993EB21EFD01C6036CE48579496FAA5748EB8E577BD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 7.4MB
- SHA256 9033b32d3939f569f788118fa44019d962dcc26e162f1f4a27490d3fd3bf9d77
- MD5 d0e3b6bef94b1308b034c3d16ad1af6a
- SHA1 da5be4d93d3c8495c0faa95a094ecbaf0c72ba2f
- SHA512 9e0c71b3032716b3ee78419a4ecaebd5db36b15af9ced0888aa1eb6a53c0918c01a07529e46cacad74af2e3a812aec85e9afa112a9bc1543aea57e09c881581d
- SSDEEP 49152:fOceoMXdWRUtRujYQkIyPHsTtXw40N/21jpbw0frJ3GUvEx45ISlBqXbg02lcr+U:W2XcQkIGHYXw40N/p
- TLSH T19B764CE820E1D253F38640B3718993EB21EFD01C6036CE48579496FAA5748EB8E577BD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\targeting.snapshot.json
- Size 3KB
- SHA256 78ad7d22399fbf1f0eacfe47f755dd68098dfb05e076ff358d685cb4d3abae70
- MD5 8fc1f197e4f2312bb6f523fc4e15d528
- SHA1 ff2f87a7621354a4112f27f1b828398e30dad6a7
- SHA512 e7104e102fd1b289000386721d76c2639baf1061a510bbf59625902632d4376268fe8d8273f42fdfc83b2f288fc89ea1836dd004ac7b27dc3fbd5a2f2b1f0bf4
- TLSH T13771710CA61CA4BEA66BC3C0D6447F978BBD053370846458DAFE460C95FB5FB122621B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\xulstore.json
- Size 167B
- SHA256 c1bed5f53e44f988d50469fe36ee52ab0bfe2215cc126514ad06b5c0c28dfd87
- MD5 2ad8b3c13995ae985a912f3297c6103d
- SHA1 45b786fb55ccbb948a89c9a233fdab1fd3c82eb9
- SHA512 c9853c003b0c9fe66ae2cd849dcf17fe1e3646520a5d2d5cf5ec1bdc1308ba504f58a248ff4b5fda487d7fd97318899e2c41ce1c628a5895aa75648d10a34ac3
- TLSH T109C08CB0216FD8487D27CBCF128D22983D3A8A54A1D0529A69EA94E018C570F9D18388
- MD5 SHA1 SHA512 TLSH