Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
26/10/2026, 02:51
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
28 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
33 signatures
150 seconds
General
- Target 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
- Size 6.0MB
- Sample261026-dcdbhaac97
- SHA256 aafcfafa60daf584fd75788c6828d12414b4ba21ec4bb14ddc03cf4c029ff3df
- MD5 bfceec6bbf954a0f7b968548ea19a0b3
- SHA1 40f12f95d9bab127e026a2bfdfa91cafe9a8f7c2
- SHA512 8772fa29290c71b2b510da5810b812d8e87a75069827f89dd7bb2bf476ddf9441bffafcf5d797d2b1a491b9c11776ec30cedc2f664093f32a6a9e8751fb99c7e
- SSDEEP 98304:LFDYAvYBpKEY/GXP4Aj18frP3wbzWFimaI7dloCF:hzABpKEYO6gbzWFimaI7dlVF
- TLSH T105569D51BE4E8176D91B1132472D9F291029BD283B3865D3B2B43E7EEC363C16D3A61B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Floxif payload 1 IoCs
resource yara_rule behavioral1/files/0x0008000000022adf-1.dat floxif - Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 4 IoCs
resource yara_rule behavioral1/memory/5880-28-0x00000000006B0000-0x0000000000CA3000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/5880-460-0x00000000006B0000-0x0000000000CA3000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/5880-831-0x00000000006B0000-0x0000000000CA3000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/5880-834-0x00000000006B0000-0x0000000000CA3000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers - Detects executables containing SQL queries to confidential data stores. Observed in infostealers 4 IoCs
resource yara_rule behavioral1/memory/5880-28-0x00000000006B0000-0x0000000000CA3000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/5880-460-0x00000000006B0000-0x0000000000CA3000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/5880-831-0x00000000006B0000-0x0000000000CA3000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/5880-834-0x00000000006B0000-0x0000000000CA3000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore - UPX dump on OEP (original entry point) 17 IoCs
resource yara_rule behavioral1/files/0x0008000000022adf-1.dat UPX behavioral1/memory/5880-3-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/3240-12-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/3240-14-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/5880-17-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/5880-29-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/5880-417-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/4924-430-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/4668-432-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/4668-436-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/4036-438-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/4036-440-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/4924-434-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/932-442-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/932-444-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/5880-461-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/5880-832-0x0000000010000000-0x0000000010030000-memory.dmp UPX - Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x0008000000022adf-1.dat acprotect - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Loads dropped DLL 6 IoCs
pid Process 5880 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 3240 regsvr32.exe 4924 regsvr32.exe 4668 regsvr32.exe 4036 regsvr32.exe 932 regsvr32.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe /onboot" 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\e: 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe -
resource yara_rule behavioral1/files/0x0008000000022adf-1.dat upx behavioral1/memory/5880-3-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/3240-12-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/3240-14-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/5880-17-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/5880-29-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/5880-417-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/4924-430-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/4668-432-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/4668-436-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/4036-438-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/4036-440-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/4924-434-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/932-442-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/932-444-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/5880-461-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/5880-832-0x0000000010000000-0x0000000010030000-memory.dmp upx - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\System\symsrv.dll 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe File created \??\c:\program files\common files\system\symsrv.dll.000 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Checks processor information in registry 2 TTPs 20 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm" 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Low Rights 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A} 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe" 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3" 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe" 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe" 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243" 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4} 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3" 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3" 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006} 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Modifies registry class 17 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\WOW6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D} 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe" 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan" 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Model = "298" 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Therad = "1" 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1" 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings firefox.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD} 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter" 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User" 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 5880 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 5880 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 5880 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 5880 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 5880 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 5880 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 5880 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 5880 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 5880 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Token: SeRestorePrivilege 5880 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Token: SeDebugPrivilege 3240 regsvr32.exe Token: SeDebugPrivilege 4580 firefox.exe Token: SeDebugPrivilege 4580 firefox.exe Token: SeDebugPrivilege 4924 regsvr32.exe Token: SeDebugPrivilege 4668 regsvr32.exe Token: SeDebugPrivilege 4036 regsvr32.exe Token: SeDebugPrivilege 932 regsvr32.exe Token: SeDebugPrivilege 4580 firefox.exe Token: SeDebugPrivilege 4580 firefox.exe Token: SeDebugPrivilege 4580 firefox.exe - Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 4580 firefox.exe 4580 firefox.exe 4580 firefox.exe 4580 firefox.exe 4580 firefox.exe 4580 firefox.exe 5880 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 5880 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Suspicious use of SetWindowsHookEx 11 IoCs
pid Process 5880 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 5880 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 5880 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 4580 firefox.exe 5880 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 5880 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 5880 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 5880 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 5880 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 5880 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 5880 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 5880 wrote to memory of 3240 5880 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 85 PID 5880 wrote to memory of 3380 5880 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 94 PID 3380 wrote to memory of 4580 3380 firefox.exe 95 PID 3380 wrote to memory of 4580 3380 firefox.exe 95 PID 4580 wrote to memory of 5892 4580 firefox.exe 96 PID 4580 wrote to memory of 5892 4580 firefox.exe 96 PID 4580 wrote to memory of 5892 4580 firefox.exe 96 PID 4580 wrote to memory of 2192 4580 firefox.exe 97 PID 4580 wrote to memory of 2192 4580 firefox.exe 97 PID 4580 wrote to memory of 2192 4580 firefox.exe 97 PID 4580 wrote to memory of 2192 4580 firefox.exe 97 PID 4580 wrote to memory of 4168 4580 firefox.exe 99 PID 4580 wrote to memory of 4168 4580 firefox.exe 99 PID 4580 wrote to memory of 4168 4580 firefox.exe 99 PID 4580 wrote to memory of 4168 4580 firefox.exe 99 PID 4580 wrote to memory of 2928 4580 firefox.exe 100 PID 4580 wrote to memory of 2928 4580 firefox.exe 100 PID 4580 wrote to memory of 2928 4580 firefox.exe 100 PID 4580 wrote to memory of 2544 4580 firefox.exe 101 PID 4580 wrote to memory of 2544 4580 firefox.exe 101 PID 4580 wrote to memory of 2544 4580 firefox.exe 101 PID 4580 wrote to memory of 2544 4580 firefox.exe 101 PID 4580 wrote to memory of 4720 4580 firefox.exe 102 PID 4580 wrote to memory of 4720 4580 firefox.exe 102 PID 4580 wrote to memory of 4720 4580 firefox.exe 102 PID 4580 wrote to memory of 4720 4580 firefox.exe 102 PID 4580 wrote to memory of 2528 4580 firefox.exe 103 PID 4580 wrote to memory of 2528 4580 firefox.exe 103 PID 4580 wrote to memory of 2528 4580 firefox.exe 103 PID 4580 wrote to memory of 2528 4580 firefox.exe 103 PID 4580 wrote to memory of 4816 4580 firefox.exe 104 PID 4580 wrote to memory of 4816 4580 firefox.exe 104 PID 4580 wrote to memory of 4816 4580 firefox.exe 104 PID 4580 wrote to memory of 4816 4580 firefox.exe 104 PID 4580 wrote to memory of 3632 4580 firefox.exe 105 PID 4580 wrote to memory of 3632 4580 firefox.exe 105 PID 4580 wrote to memory of 3632 4580 firefox.exe 105 PID 4580 wrote to memory of 3632 4580 firefox.exe 105 PID 4580 wrote to memory of 916 4580 firefox.exe 106 PID 4580 wrote to memory of 916 4580 firefox.exe 106 PID 4580 wrote to memory of 916 4580 firefox.exe 106 PID 4580 wrote to memory of 916 4580 firefox.exe 106 PID 5880 wrote to memory of 4924 5880 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 107 PID 5880 wrote to memory of 4668 5880 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 108 PID 5880 wrote to memory of 4036 5880 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 109 PID 5880 wrote to memory of 932 5880 2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 111 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-26_bfceec6bbf954a0f7b968548ea19a0b3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5880 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3240
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html2⤵
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2020 -prefsLen 27099 -prefMapHandle 2024 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {aee236b7-834e-4c6f-9ee5-81827d002b7b} -parentPid 4580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4580" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu4⤵PID:5892
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2500 -prefsLen 27135 -prefMapHandle 2504 -prefMapSize 270279 -ipcHandle 2512 -initialChannelId {ca289ee4-6de6-47ab-825e-c90f4244fbae} -parentPid 4580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4580" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket4⤵PID:2192
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3640 -prefsLen 25164 -prefMapHandle 3644 -prefMapSize 270279 -jsInitHandle 3648 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3656 -initialChannelId {1f42aa87-91cd-46c1-a4d9-852fdf6d679d} -parentPid 4580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4580" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab4⤵
- Checks processor information in registry
PID:4168
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3828 -prefsLen 27276 -prefMapHandle 3832 -prefMapSize 270279 -ipcHandle 3900 -initialChannelId {5bd77a42-d6d8-4607-88c0-3aea1f3ef3bd} -parentPid 4580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4580" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd4⤵PID:2928
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4368 -prefsLen 34775 -prefMapHandle 4372 -prefMapSize 270279 -jsInitHandle 4376 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4392 -initialChannelId {6025f877-2c93-4c47-b081-fd9c3d637b97} -parentPid 4580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4580" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab4⤵
- Checks processor information in registry
PID:2544
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4828 -prefsLen 35012 -prefMapHandle 4824 -prefMapSize 270279 -ipcHandle 4664 -initialChannelId {2cd479b7-d60d-434c-9b7e-6f6b7cfec1a2} -parentPid 4580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4580" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility4⤵
- Checks processor information in registry
PID:4720
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5168 -prefsLen 32952 -prefMapHandle 5172 -prefMapSize 270279 -jsInitHandle 5176 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5184 -initialChannelId {be4ff732-dc52-4dcc-aab0-3775f09c048b} -parentPid 4580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4580" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab4⤵
- Checks processor information in registry
PID:2528
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5208 -prefsLen 32952 -prefMapHandle 5212 -prefMapSize 270279 -jsInitHandle 5216 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5224 -initialChannelId {8e9700ad-758d-414d-90c3-867403529b19} -parentPid 4580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4580" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab4⤵
- Checks processor information in registry
PID:4816
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5592 -prefsLen 32952 -prefMapHandle 5596 -prefMapSize 270279 -jsInitHandle 5600 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5608 -initialChannelId {03f1eba7-09db-4a60-94c1-c533bf7515fe} -parentPid 4580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4580" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab4⤵
- Checks processor information in registry
PID:3632
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5784 -prefsLen 32952 -prefMapHandle 5788 -prefMapSize 270279 -jsInitHandle 5792 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5636 -initialChannelId {3d473890-7af3-4c7f-8346-d9018bfbf779} -parentPid 4580 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4580" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab4⤵
- Checks processor information in registry
PID:916
-
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4924
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4668
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4036
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:932
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Event Triggered Execution
1AppInit DLLs
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1AppInit DLLs
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\System\symsrv.dll
- Size 67KB
- SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
- MD5 7574cf2c64f35161ab1292e2f532aabf
- SHA1 14ba3fa927a06224dfe587014299e834def4644f
- SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
- SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
- TLSH T17863F1372AB5807DDD210D37949F835AB771E5A76C20643FC25907D988B8DD0E3239AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\System\symsrv.dll.000
- Size 114B
- SHA256 aefc503b1ed462d7b6280228a7b5b710792273b78934426f88325341ac5b5a92
- MD5 e609411db8aa6775d0344c75c23ae79b
- SHA1 1d2ff6194bf159ce36cd0461cd3da29486d1e97d
- SHA512 6884ff5c07bc687132c965a59cb8c5a898a25da74c6c846c1d6089ddca8007cb7e4d2f8520bdce9fbcf6e2f9c9e5c28d8c8d6d049d3522470bdc7d38bbfa0ad0
- TLSH T1FFB09262AA2791EAE1AA224505A0248C1ED0B62AB48638002EBA5A4E93256A85916147
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\16h2m5ny.default-release\activity-stream.contile.json
- Size 4KB
- SHA256 ee37c49580f71d8af8325930fa5074bcfdfdf2f20f8390a7840aa69c19aea55b
- MD5 b461267dab9e37357c8e2674ea11466e
- SHA1 8938a01a5832e8827df794ce95936fd6383dbd99
- SHA512 60b0d138e4c7f65997ee5d1a0aa18baebbd68c1bef1b09a1b3b3f75192205c0ba813d332efb61fedbb1a869735730a7dd5840b5e055e770aa2188b0512657a82
- SSDEEP 96:TOyBMZQMXaZ3mYw+8bT+mR9XEZKnSEMIayz7GXfjI:fMnaxt8+mRxEISdqSfU
- TLSH T1C3A1D69F883544461B70E6E66C2F2368F113B405A6E0D67CB06AAC61527C7DEC2DF9C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\16h2m5ny.default-release\activity-stream.discovery_stream.json
- Size 75KB
- SHA256 ba8c73c96bf5ceb8c544e52334ec44f32e7ccd78fd1181fa6ec9be7ca5f3e8a2
- MD5 412087f3768e944c5d3b6fe68a15a5ae
- SHA1 99f06936855ce20c6d550782635990c52d2ff6ac
- SHA512 97711c0ab7307d2ed4f47653792400ab2c1ebe15a5b468a21c0c0f05df26c82cd9ececcbeaa3e3800a82b1e9fdc11824f72fee9c4acef716b308bfcd1962f26b
- SSDEEP 768:qyQjFpQsDIq658vcC9i+HGu51hXNeiROOrr+j+4fgTUkxW+GRHwKZ69aXOB:RQjgHSGuXX4u+jpggEGRHw19ae
- TLSH T11E730AE3E6E8B1FB0B9177D72C0FBA9B92E10195E34501D8ECEDCA1C81DD654113A6AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\16h2m5ny.default-release\activity-stream.discovery_stream.json
- Size 75KB
- SHA256 0c84bb1b184f6e903e9d7d61b23aa19bdee296c0c3bc4e0e6937445519d91de5
- MD5 022c9d73221c592920ac7a06bb34661e
- SHA1 052c1f61d6eec5fc181dda26b2fd65966064ec86
- SHA512 7b2fd489f0becaf1c0d79b01bac808bbac9dc477ec287d432c95d8522b5589ed7e6a9f83c2c4a7c5a24c8ec3eaafb18c6321efc3cc7ebb0f0f6a1b197f72b05d
- SSDEEP 768:qyS6rGjv/aL0WXId8UpXEwMhuFY8ma236yTLSsDMJF5QAslXJT2Mb9y55TY:RS8+yXNU9EwMaY8aqA+1Q7nTZbw55TY
- TLSH T1AA730BA392E4B1FB1BA537CB2C4B7A5B22D20159F34502C9ECDECA1C90CC655127E9BD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\16h2m5ny.default-release\cache2\entries\E9338C5CCF1E2FCF149487351399F198A4F9FCD6
- Size 16KB
- SHA256 d75083c7bce6f85c282821ccfaa2c1723efa2bc4d19714a75879ccc4d72a97b5
- MD5 0dc47d0165c2511cc695787369931ab1
- SHA1 773c8816255a78493a75a5b5e238835de828829c
- SHA512 5118112ff66126a0af1917b0cdd9b653cd819fc8a0ff035e30b2a1d6389983f4996c78b513a747c54fe813005c7e38a74bae646354c9dec89678a049eec29ec3
- SSDEEP 384:HGNQiO024YuWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMAZ:mDZYuWTToXJWTTogB7S/AmVAf+hRMQ
- TLSH T114728E3D8F013CAC175780E9C8B583558D18B7ABDFF6C02D26883D09C988A5A71F945F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\16h2m5ny.default-release\startupCache\webext.sc.lz4
- Size 104KB
- SHA256 69831ee397da46258d4c2179c5e0448988398c9e0c0d75a6f7c7893609c81e9c
- MD5 7759e3c68ef473eeb4857c6f70788d0c
- SHA1 bd08697e45124371d6ce1864d298251c6b020e99
- SHA512 71a5954a8c2a9cffac405d610ebfbbc0d7e9367ea4ed289e778a73f6ebdcd35b2854a2bf8462d0f8d0982861c633c6536977c0df13c491462332f25f631db780
- SSDEEP 1536:jTrliqG3oDQKLn6lT9Om8cjCaFKaR+mI9ZHF+6r1FdjnQdgwALBonL1NEq54C4Of:j3lnn6lT2mCagg+fvQOP0ewR16q5Is9F
- TLSH T10CA3AEF6DFA3CE2D64FFD42C5B82883EFD262814B3A72409C5136750A5C6B78A275748
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\16h2m5ny.default-release\startupCache\webext.sc.lz4
- Size 105KB
- SHA256 56e176fcaac7e349a1ea7c0d32a5ddba92e6afb63f14894f6191c5f0853aea2d
- MD5 eb041b506249060d8be5fed6daebc23f
- SHA1 437d70f1a96fb3c5fac34ef1298116b95dd1a322
- SHA512 024733c646b00e097c333433cf38924418ef0d0df3af5a7cd41236fca5ed5aac604be60ea70bea24748682c759b5333f07b3d6a04c53ee4e4e1ddc985e7cb813
- SSDEEP 3072:X3lnn6lTMUP1UGY+fvQOP0ewR16q5Is9N:Fn8Mwu+fvQe0VfmKN
- TLSH T1A8B3AEF6DFA2CE2D68FFD42C6B82883EFD262814B3A72409C513275065C7B78A675744
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 11KB
- SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
- MD5 25e8156b7f7ca8dad999ee2b93a32b71
- SHA1 db587e9e9559b433cee57435cb97a83963659430
- SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
- SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
- TLSH T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 502KB
- SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
- MD5 e690f995973164fe425f76589b1be2d9
- SHA1 e947c4dad203aab37a003194dddc7980c74fa712
- SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
- SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
- TLSH T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 21.6MB
- SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
- MD5 40bf410fa9ef0d5499907e34885af6f4
- SHA1 4d7722337a0e26bf4a1c6478129356acb2f7b720
- SHA512 b763712aa4bd9819b7972a40216c08fd32338b14fab7ce4b166e39ce441ad62678bf0e1f25da436ffdb56ff1b1a21e3dbbaf47c0f5918c252e70656f5d0307ac
- SSDEEP 393216:KYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHY:3mghF5QDwWCm/2YU8Ivq9u5P
- TLSH T14F37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\IDM\DwnlData\Admin\www_internetdownload_1\www_internetdownload
- Size 9KB
- SHA256 5b462f6871410ba49ff47a42bc44d8451f93f60a1ece48381a912ac3519ef51d
- MD5 aac4518aa1126176803781ab9d7a54d3
- SHA1 a1804bdc2bde93ac5c6a693f2176d381cbbdbc67
- SHA512 ccff9383a3b665e8ddf8cb769d684698a8b84a5a3498df1e8288a49bfa22b9f98f9f3364f5c4d3cbf7642fd008a65bec5e7956a18bea96cb7b7163f92cc1b132
- SSDEEP 96:hpK4+cLOruFL1macbpFS02HxQfErjpkB/WRXZksDaRMb4Fw9HM0:jN4eOZEJG+ZkcaRLGFM0
- TLSH T17522DD2F5004B23501521009ABB6A3F2BB1EB03AA74592A648CB946C7737E7EDB7D1D7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\addonStartup.json.lz4
- Size 4KB
- SHA256 2c52f489a09f856c6ea9c6d0b28544379ee68335322b582c56341e4576b04e00
- MD5 d7cb928b17f992c2f5bf02cf1956b6e2
- SHA1 31df3693b19ed75a296c0005a4f9134e91a76c22
- SHA512 5e4e91b8f46ca7c57b27f4c8b64b7d1438fd872e65fe835b13eefd2973f0f088c631b6338005215f810808bc54fcbe9269e54a372de1b9e872ebef662e48d646
- SSDEEP 96:Nx/4sHNw6M2xWGhD41MgGvmHhF+rUpO1LnOYvhQhIRhN:Nc52xxhD8rGvm6ApwnHUuhN
- TLSH T11EA17DBAD582EFB2FE32D04358D93FB2EA96AB7414A9C4D0F16AB1194C64A731700340
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\crashes\store.json.mozlz4
- Size 66B
- SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
- MD5 a6338865eb252d0ef8fcf11fa9af3f0d
- SHA1 cecdd4c4dcae10c2ffc8eb938121b6231de48cd3
- SHA512 d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c
- TLSH T175A022C28E0C83BACF000833008AF00300E83B020B8B0F882AC2AEF8200200C8082082
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\db\data.safe.bin
- Size 28KB
- SHA256 2542f7f6ce9eb82776b589d78def220ec596360d3309a32da42132b168b824bb
- MD5 50183fac1bf56e791d34e89a4c135884
- SHA1 047eb99e456173099aad9411d08b56efbb71ab31
- SHA512 317719bd4f9310036c0187e6094d271b87e1748cc9c18235d2176c9a81c67257ecc8ac004fd130476fc744f157504a94988c1f7041480da4a037daac0e0f2e52
- SSDEEP 768:tEoXl5l7AGcmhuyjxRa0cvU5bObKbhbL:B5lRlz
- TLSH T115D20384EB2E953FD41852BBDCA50B001F7DB88958592F673A4C64686C872DC3D9E07F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\db\data.safe.tmp
- Size 28KB
- SHA256 45fc76b0949dc83c9ace2077e60fade2b6506e048f6a284c1caef617f3413b8c
- MD5 e736549292f3b9456395c98f97c89c82
- SHA1 05dec477ec969039d5875d44c3fc3a6d7e65e7e6
- SHA512 cae7ea27390beb00f46f3ad7053da728e2aafd5c75946df8b639888addac5b81eda23eb5bbf4d8ed102aadedbe36967ca6f6923b48aad8064e5bd898418d3f17
- SSDEEP 768:c5l7AGcmhuyjxRa0cvU5bObKbhbLmIwE/:c5lRlzX
- TLSH T163D20384EB2A953FD41852BBDCA50B001F7DF88958592F673A4C64686C872DC3D9E07F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\db\data.safe.tmp
- Size 28KB
- SHA256 d693b488fe9c434e7b2409c71815253ec30e6447af7b488c0c776744fbad41df
- MD5 16e1be3cb665bb96022b6e7c0816abad
- SHA1 a59bb6f7be4881cf4ed249650e69eb84174c0a25
- SHA512 31c85832ece62fd24efcfdd2d7a4565d1a87b5856e09e3baa97e4b5a6c72dd8be56d6c669783a1b963d54286e0879f3e5eafdcf55fc8d2f2228f6dcee152670e
- SSDEEP 768:qBwEL5l7AGcmhuyjxRa0cvU5bObKbhbL:O5lRlz
- TLSH T106D20284EB2E953FD41852BBDCA50B001F7DB88958592FA73A4C64686C872DC3D9E07F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\events\events
- Size 1KB
- SHA256 95be5e84ee0d6fb0310c811ed845955159fd80409f1aba16254c73f9abaab1cd
- MD5 46e53985a5c1d619afb95f5215638467
- SHA1 def4b5dbe5139214ed941203b03c3311ab96506d
- SHA512 862646dd62c7c229227cce5595d76913cafa96d64d64349c78f88ea54c2e2d91d0e13338adae474b8921198d3174ecabf2e1d25b2f0fefed19db1111ba356705
- TLSH T14B21679C7DF84D3AA9C7FA9CB4A0028E57518A0E54975C430E02DF8DCD85ADE32AE43D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\events\events
- Size 2KB
- SHA256 bbd4ba7123fed717903c1cd2a93c21a98c11ea4d70b8db3b1b8c3dd648c0daa5
- MD5 1042628eb9d2e44698332ac40c654a05
- SHA1 7cb7d47dccc831f69a3f7ae453e9b1027f62f0c2
- SHA512 ad60b80ce70ccfcad0a3d6e4468c6dfa9610eeb581c2bf2279f2f1fa706015f6b842d8c6e7760404bd96642b46e967181dc745cb8c3e16c926b0363b6a65f7c5
- TLSH T1FF419A4C6AEA4D7AA887F68CF841028D57954B0AA4D36D835DC2DF4CCC46ADD32AF43D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\pending_pings\2ae2db92-ebae-4228-a764-82f4155dd254
- Size 2KB
- SHA256 12a7a616d8fe2da028f744738c7b7e6eafbb4aa6e0186bda071597ba88ff1529
- MD5 7477cef881160de2aef334915156f4fe
- SHA1 47d8f2cd3fa075f2a8c7225f688226b4ef5b29ea
- SHA512 b9f65e2d36e9b1d8c89e5e836d562a54ab07cf24e2f943f5b855cc8a0a93718b5eb7a0a840602076875ce321616ecb083291acd80f9e0bc1f30a53c2dc4f335b
- TLSH T1E641546C74B85C368CDBF54D9082238D43788A4340C65C876D96DF4C8DE665E376A15B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\pending_pings\4f3be0e0-449e-454a-a248-2f9bc52931a5
- Size 871B
- SHA256 79a6c157aa76c29e8cc14d79bdd24dae94e7dd4c02b8398536c9250b64e3e461
- MD5 d80bc98ebb715dff9440b701b2ca8143
- SHA1 8562dd5b6742719e07baa0893766c24ec9bd17d9
- SHA512 27e11babd1599892e590ab7e6677763d7dad9a7c806a3cec6e6198e256ee7239b711df15225893158f8525bfa6f9354950c91835cf91d4a5287b37cd0d0b7185
- TLSH T192112F90D936B9B2CC28E24BC0E537518BF8761380CB98083CA14E280CFF50E976A24B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\pending_pings\9b1630dc-7ec1-4efb-a57b-71ac210686a6
- Size 235B
- SHA256 5d8a99d9820c4c97084532124eea6c2fab30649601a8d91440287e5e71c9e76a
- MD5 f4ab7344cbd715b2285ba526889b85c6
- SHA1 178679e94f52ed644f7454e954af89011969a3a6
- SHA512 5c487d188e25aac5bfb6c662c3eaf9f6606529f49fb461317c25c1e5431f2ca7210ba8d426dcd3ad4be3485274e70f8994a0127320aad5d4ecf228afcee342bb
- TLSH T105D023C458E8675D48181F07F0F0B9D771D94C3324B9B864EA61457C99FDDC94192D2B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\pending_pings\ac260463-128b-4576-97b5-b3495f43da47
- Size 886B
- SHA256 7f3b612130ee659da54fe1ef68023daa9e0eb79d1c8d6c24bcf3ce9595f419e7
- MD5 e870ec2f0f4cc43c52dd4d617b1d94d1
- SHA1 97e2671229086ff4c4c67861550bc96a2c95b63b
- SHA512 40dcfe05d8dfcd38374bd2acc56dc3b5ce6c9d969eb3e0792b6ef941fb4577bbeb6cb9bf05d06f5b7054b77cea66c6918747449496afe27b7493f2f342a9d096
- TLSH T1B51100909935B9B2DC28D24B90E477828AB47023C0D74D0C7D954B280CFF50EA757207
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\pending_pings\bf6d8fc1-3159-4f2c-8fa2-154aa5dd8c46
- Size 235B
- SHA256 2ffcf0b99453d45bbda3b18b6f3f9ad215fa5693aa602aca442d0de94d827442
- MD5 36db362b10c4d987bda5dc11e4347e0f
- SHA1 ccfb3e8a82bbf401546bacceb6d4622a26369498
- SHA512 7f6ffa63b171750f4c8b514d75d408b5d0b89d8d3beae59b92417ef906f1a4dc5fc0180a6c5588c4e983f09f152df61249894b662c72ecd91cfe9ac7e5a6de1c
- TLSH T1C4D0A79518A8B79D0C141F26F0A1B9CB71988C336864E824D691497C9AFDECA4192C1B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\extension-preferences.json
- Size 942B
- SHA256 aecfc11c0db969b2c79da2144415a8859c77d66fbfc37ca4924ac58a0ff29834
- MD5 20357ec0806e9826d6daf456b6b16bd8
- SHA1 7d5d7a921213989294eb5cea2ee760e562ce5293
- SHA512 2333fde606ee727a6b6d9812ed40e56e5d0dba4ec35abcc11b67f8ad61d1d3d4af5db699d29b3ed6b459b9e142badae69ffbebf18974b5a1c72e45ecc8cf93cf
- TLSH T17211F13A640B6EB01E8E5625FE384A92E791111B50B7F2E47E69934A13D3970C1ED39C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\extensions.json
- Size 14KB
- SHA256 0acc10790033cd2500356283104aec1f6fb9d136f03b3a28188ff08122d976c9
- MD5 fefa1934a6bc305995a5c0bfeea10c4f
- SHA1 7151986a3dd03d2c7a7f79ea6b8d2ab899a21462
- SHA512 365ed8a2fb345ed081b5cceda94b1893680cde1be29d42ddd1266739bc4bb848e71a4de42e58de63595ae9d9a914b3ca8ea5839eaba56dd68f54452380f261ab
- SSDEEP 384:xkI4vDUmldvmC8dhW294zK96oSL4HgL4PYL4HtL4H7L4HC:CI4bRfuXP4C6v4i4i4N4H4i
- TLSH T13362421545049EB8298EA79BAA36BD01C37D473B60845C78F4DD8FC842FA5B902FB61B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
- Size 1.1MB
- SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
- MD5 626073e8dcf656ac4130e3283c51cbba
- SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
- SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
- SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
- TLSH T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
- Size 116B
- SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
- MD5 ae29912407dfadf0d683982d4fb57293
- SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
- SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
- TLSH T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE
- Size 473B
- SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
- MD5 7406820f5d56fda6baffa951c60679d2
- SHA1 e7d4894993e506e235d55b3e47aed019d0584148
- SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
- TLSH T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
- Size 1002B
- SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
- MD5 dcffff15fa618a53834ee4ae8673bd23
- SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
- SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
- TLSH T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
- Size 21.6MB
- SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
- MD5 d14dd3f0107ff91c3e21f301d83f82b0
- SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
- SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
- SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
- TLSH T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll.sig
- Size 1KB
- SHA256 c5f50bed6afd38490baca2ce8e8fdd1a39849c9f0dc06478a8a2e9226526607b
- MD5 61d51cf075ad6dcbaaebf956c6bc1dcd
- SHA1 f176331dcdb84327afd47ecf8ede3b0664c7d05a
- SHA512 de263ed43f1112786186afa7bb942f25482fe60b04e7138c3687ec09956e0247307e5a6303a4297f785a572ed9a0059747a9b870c2fb6e84483373cfe27ca6c5
- TLSH T1C421B6DDAD2426542DC0EB2D5EF8E826DD3112C2F96404BB426666C3FCA3BA038C466D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\prefs-1.js
- Size 6KB
- SHA256 820be065133deb953f39a3d085a91a28c7cd193a504280bb4e84c70b15764716
- MD5 cd1f7e3fe1b67e9a30704a0286ab4595
- SHA1 58c8d04ea6ad2f67b318e3922a88beb8f2928cdc
- SHA512 d13986e688f2b8466d030d3f48e8d1804e50650c88652c111b1e1c38d0d00fa97a63107c5f3b757ee1427a7a1cc338c32d842ab1aeaaab5ad1b55e2db31191b9
- SSDEEP 96:xHrJUTUdGLqGq8f3G61zSGuTSSlSdv9j6nWHbQW/Bw88n8L4cnuVCLM:RJNGGR8f3G6ESSSbQuBw88jUo
- TLSH T15FE13F7894088F7F64B6376C6C6888715AB2013BB7BF68C750BA54C5011CF3442F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\prefs-1.js
- Size 8KB
- SHA256 780e1dc5f610e5f7c41246f059e4bede11ec0dd70268aa0d31d056fb4b8adbeb
- MD5 bccfb622b83e1b3c4db08a76767c12c5
- SHA1 f9647511c6ea84895bd847413145506cb3828cff
- SHA512 756da5ae3e06179bdf80877a7e7c7718861dad219203d14cf6c91afe70e42cd157b646f254d1d908c577a841b63678681883e8e096812ea12c86c11e9f5db3c8
- SSDEEP 96:xHrJGQP82GSTUdGLqGq8f1xG6ObzSGuTSSlSdv9jGgnWWRZHQWbm6Bw88MzzSDZN:RJaGGR8fLG6HSSx+RBQaBw88jwSUo
- TLSH T18D020F789504CB7F74B637BCAC2449705AA2013BBBBFA8D750B954C5051CF3441EAAEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\prefs.js
- Size 6KB
- SHA256 a4255f5732490dff984da72dd8c77feb06260017fe6bd238e8d5c0206dfcdc92
- MD5 de1ec1ee897d27e8cfd68efa306317a2
- SHA1 64b85b597c1773bd93a448ecbe9bde16c9933f94
- SHA512 a67484fb7b144b27f15ecf0adedc16eb40d8c2ef7ca3ebbdf230fe5bbe4518cc2fdda5a55373fe9c3ca505470545dba50289207b0664717a2f85fcde1d905f82
- SSDEEP 96:xHrJUTUdGLqGq8f3T+1zSySSlSdv9j6nWHbQW/Bw88n8L4cnuVCLM:RJNGGR8f3T+nSSSbQuBw88jUo
- TLSH T104E1307894088F6F74B6776CAC6888719AB2013BB7BF68C750BA54C4015CF3446F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\prefs.js
- Size 6KB
- SHA256 179c03bf6b09e05604f5a5ed80fbdb1d63b51b9da60ec97620c2ea4c7544f889
- MD5 c304833645ba8f787051752d58b2fd8c
- SHA1 40a3fb8c1e50007aeb34058e0d32f6d758d33e1c
- SHA512 de8068e83e73506b91cfbc2d4c0c2a9064751559d74846e6f834da1ed59a892d56ee2b2a2415a97dca6ee3ac46ab777c4f97cf10a428c51fa00a5c470214933e
- SSDEEP 96:xHrJUTUdGLqGq8f3G6ObzSGuTSSlSdv9jGgnWHbQW/Bw88n8L4cnuVCLM:RJNGGR8f3G6HSSxfbQuBw88jUo
- TLSH T1A0E13F7894088F7F64B6776C6C6888715AB2013BBBBF68C750BA54C4011CF3442F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\prefs.js
- Size 7KB
- SHA256 274237aacd8f847d88b9f8c48c24c14fa95fc8945dc53bb6d9e66061494124d5
- MD5 f647043f9d7709700e607b5347854d81
- SHA1 c82773eb114f8217cf9105d53deec7514f8a01d0
- SHA512 a7ad7373c3cc304c82b57798592e531a466ee7732f6b956c7b38cdcb81ee6c77e97c327b894ddd40bbeacd39b97de31739d4ba163e89bc01d776ca363ecd7859
- SSDEEP 96:xHrJGQP82GSTUdGLqGq8f3G6ObzSGuTSSlSdv9jGgnWHbQW/Bw88Mh8L4cnuVCLM:RJaGGR8f3G6HSSxfbQuBw880Uo
- TLSH T12FF10E789404CB7F64B6776CAC6449705AB2013BBBBF68C650BA54C4051CF3446FA6EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\sessionCheckpoints.json
- Size 90B
- SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
- MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
- SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
- SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
- TLSH T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\sessionCheckpoints.json
- Size 53B
- SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
- MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
- SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
- SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
- TLSH T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\sessionstore-backups\recovery.jsonlz4
- Size 4KB
- SHA256 0098a704d7df10235124b60f9998044559767063ff2bf8a86d8165b85eff87dd
- MD5 d53a8074563fb9cc413dde370e8eb151
- SHA1 5d5ee708d65bc2c834614ccdb7609927a5c9fce6
- SHA512 179f1afc87d9d2f82e30ab7bdb172f1d90e7fd3b423ef235b9cf657464339f877b0d79ce353ee51f247a63bafaf09674a32b81235db2fbc7b6d7cbf6428ad141
- SSDEEP 96:eTf8zGDCTUKAQeW9jILA0NjoB8kMJttn0YJZQBtw:GND1IOnNcB85JttnTZEy
- TLSH T183918F42371F74A7FD5B868FEE584DF141B4300A548048E890CF7B1A776BB477999075
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\sessionstore-backups\recovery.jsonlz4
- Size 4KB
- SHA256 09830dfbcc249d22fe140dff3fc93f9136acf62c2f2b7cd9e48f5b104a345d8d
- MD5 1f3ff024fecc29e1b4afb5f95ab6d599
- SHA1 b85fcf962cce480075a70986a7fb69cda28e31aa
- SHA512 7eaa3f93cf630c81bd493cc9eb37fe6f62697855b27904f939942fd5d5f7406ac36187dee1a56d5af7a3f6a27fd3d1846ee91881b09f530cb9bed0cc30286cfe
- SSDEEP 96:eTf8zGDCTUKaQeW9jILA0NjoB8kMJttn0YJZQBts:GNDhIOnNcB85JttnTZEe
- TLSH T18E918E03371F35ABFD5B8A8FEE984DF141B5300A648088E890CF7B1A776BA477999075
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 5.5MB
- SHA256 309d1970e26def24ba816bff79d6e0be58be6f41b7155789be62c1e87d2f3151
- MD5 3426926c413e41c148c42396bba257c0
- SHA1 0b77951ee0a1a31a9b180c4bd46bd6b6286c5fed
- SHA512 79fc5da9ab204c19b6311a6087f9d3c1a60275e77a0920c8caa99040c0fc15b28628df5d88d3c812762bc113f2e83f4a846d5a854777f4b6b61741b668f33cee
- SSDEEP 24576:DxMyD7VRPaQRjujY8K4PG9fdGX0brGxACLg++7HGplmDiuGI+3k0kI5N8:DxJK8KjYaNg++7imDiNVk0kc+
- TLSH T1534629E820D1A257F3814073724593EB21EFD00D5037DA085BA99AE9A474CEF9E17B7E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 5.6MB
- SHA256 733b667340906cb7979c7bb577f6d051faf291cfc3538263952decd41b0ddf22
- MD5 afd74478cfc9ed0422e13da1eabeeca7
- SHA1 482ffcc224a38ee67dd6f8c55362b93b272f23da
- SHA512 9055f32956c7d5175077287433c1be762e5183f43e74cac194358f995c961b7dd6417dcae1bff44f398f1ca0515ac91cda10a3f635fce9244e770d8e8ddd8bf4
- SSDEEP 24576:fxQd9CD3IIRTcLYKoKQtG9fDGXsbrGNnILg++7HGplmDiuMI+gk0UgZNk:fxg904WcLYKU+g++7imDibSk0Uwi
- TLSH T1E84629E820D1A257F3824073724593EB21EFD00D5037DA085BA99AE9A574CEF8E17B7D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 6.7MB
- SHA256 cb69af9f35ebea4da9fcb6ac0d3aa2cdefea1ad05d0a5bee1b2d1468e2edeac0
- MD5 045f4c90a5c1e2b8c7042a62a090aef3
- SHA1 995e207ca2017ee94da829cf7c3878e20ac650d8
- SHA512 9ffbc2013242334332ad170288871c590e4781bf5e1038a1c4a809740e464e5788474409f1a3c6a7b239aac89b554eb2292731e8608a8f4a595244792dc62608
- SSDEEP 49152:uGh9AfHWn9jym2eM37bXVSKHE0XfoaS58N:3mm2eM37bFSCEW
- TLSH T1E7663BE860D09243F3428073B18993EB21EFD01D607BDA4857A45BE9A5748EF8E177BD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 7.4MB
- SHA256 b82509d98d716ff30e237331b078b98cd0f86ac38b4f26f518a08bd22103233f
- MD5 add2be7c2c6230e2c627ecbd1c7857af
- SHA1 a7dceb426f67d0b3a21b9356f3666f110e153fc8
- SHA512 db8eed5a6e1baa0c2d67d032d22693ce5747185aa252cf0b8d479ff8e154d6e73d6ce7017d8887f5368256ae17a0bf8a53cd7bbac07b0eac0fa382bc7c0b7e6d
- SSDEEP 49152:bGP9y4O6n9jemaeS37bXVSKHS0XIvM/58NZH2HLiqx45ISllqXbg02lcr+jaaSZX:agmaeS37bFSCSW
- TLSH T13F764BE820E1D253F38640B3718993EB21EFD01C6036CE48579496FAA5748EB8E577BD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 7.4MB
- SHA256 88d42831604e2eb2046bafef54f1f5b0204ab900dc8fc58b2654cb80108fdfe1
- MD5 c386411442b8542fcd1e64b9f2d19fa0
- SHA1 a28ecb7e556db189e3a6004f4000de732bb90e15
- SHA512 b7c5e1371c05923c709549696e30175159ee24c84b6c0319ffaf0d3974b14874d974419fd4e765b0993047cedae656278d9ec08c478fc6d175a4be1cf208eba9
- SSDEEP 49152:jGP9y4Opn9jemaeS37bXVSKH/0X7vM/58NZH2HLiqx45ISllqXbg02lcr+jaaSZX:SrmaeS37bFSC/W
- TLSH T14A764BE820E1D253F38640B3718993EB21EFD01C6036CE48579496FAA5748EB8E577BD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 7.5MB
- SHA256 8a18b53cbdaa90e20a54bb024e10d694df8bd415741f6be60856428599c610e9
- MD5 e1de7312f83ba571c1174ec8f519e8d4
- SHA1 28a562f94cf1e48db65dfa59f2ebc7c5560ca3a8
- SHA512 9ba4d788df6fb5d3081e841c81e62cae8ab50f5cc837cee18dcbdb8324a6d097b00e4a3ce8a6aa3c58347eca55d51ba0bfeefb0bb1c77b8e540a3921cdc87728
- SSDEEP 49152:LeCBWkWKV2S5O8D2D3/Y1m3QFTlLzOKocUziFnluAG0Rc9AW6pRB9m9Wqn9jemBK:jVmpex37bFSC/+6
- TLSH T123864CE420E19253F38640B3719993EB21EFC01C6036CF48579496FAA9748EB8E577BD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 7.5MB
- SHA256 46794fb0cc79120b6ee367c435ae22f0f10741b8c67b11e3fb2292e3b33df7bc
- MD5 6b394d5c728b92f0389f88ae94cfc1f2
- SHA1 13bf0b3bf1b0bb3aa1ece5c9a2d5e3d0340247b0
- SHA512 e37f578210fbb58cf24cbdbd5bd99ea82b2b993c9becf7fda4f04ac6d95fc6b9ada8676708bfd0109b01c47bc4c9a3d42e7922c78b143d5b72e3e0173d27bc72
- SSDEEP 49152:89yWkZn/X1Ae4y2D3/Y1m3QFTlLzOKocUEiFnluAG0Uc9AW6pRJ9m9cqn9j3m8Mh:I7mPev37bFSCJ+
- TLSH T17E864BE420E19253F38640B3719993EB21EFC01C6036CF48579496FAA9748EB8E577BD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\targeting.snapshot.json
- Size 3KB
- SHA256 0425d2b1a2ee8d0843e0d070755928a30db04104ce06f7ebdb745dacedcdd945
- MD5 f5bc4bc077dd115637a10eb2f24a891d
- SHA1 c0224680d70dd3f2efbabf6d10111cf02dd4de6d
- SHA512 f04fe01b2acb889fe0907024f4b5920776617c9533acca71c1fd0519b04e53eb49796f119a6201c2e80ad07616d5b25edd3e23d2ddd5cf12c5958284086381bd
- TLSH T11E71710C961CA4BEA66BC3C0DA847F978BBD053370847458DAFE460C95FB5FB162611B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\xulstore.json
- Size 167B
- SHA256 c1bed5f53e44f988d50469fe36ee52ab0bfe2215cc126514ad06b5c0c28dfd87
- MD5 2ad8b3c13995ae985a912f3297c6103d
- SHA1 45b786fb55ccbb948a89c9a233fdab1fd3c82eb9
- SHA512 c9853c003b0c9fe66ae2cd849dcf17fe1e3646520a5d2d5cf5ec1bdc1308ba504f58a248ff4b5fda487d7fd97318899e2c41ce1c628a5895aa75648d10a34ac3
- TLSH T109C08CB0216FD8487D27CBCF128D22983D3A8A54A1D0529A69EA94E018C570F9D18388
- MD5 SHA1 SHA512 TLSH