Analysis
- max time kernel
148s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
11/11/2026, 08:24
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
27 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
33 signatures
150 seconds
General
- Target 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
- Size 6.3MB
- Sample261111-kan4jsga75
- SHA256 d81e21b8d827a666f756e32d49f20d98d1f25d124c8f4674a945d6e788738f37
- MD5 9c8f8f47627a8ce22de27fd68dc0da6d
- SHA1 dad449698f3edc18c94f4efd39a89d5be75ed6a7
- SHA512 df4d41e7bfe63978ae46ae8e78719cfe645bbbd44525f2362fab12a444e821be780b9b69d156f7cbf5aa23cd785e73cd0f665e7fe35a88c0a9bb7a4cfb538771
- SSDEEP 196608:kISgpMoMPXqVFi5pJ+fTgbzWFimaI7dl3q:kIAigbzWFM
- TLSH T1EB669D42BF8D8176C90A21314B39AF6A522ABE24773855D3B2743F7EDC713D1283661B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Floxif payload 1 IoCs
resource yara_rule behavioral1/files/0x00070000000004ea-1.dat floxif - Custom signatureDetects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 3 IoCs
resource yara_rule behavioral1/memory/860-27-0x00000000005F0000-0x0000000000C31000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/860-459-0x00000000005F0000-0x0000000000C31000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/860-826-0x00000000005F0000-0x0000000000C31000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers - Custom signatureDetects executables containing SQL queries to confidential data stores. Observed in infostealers 3 IoCs
resource yara_rule behavioral1/memory/860-27-0x00000000005F0000-0x0000000000C31000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/860-459-0x00000000005F0000-0x0000000000C31000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/860-826-0x00000000005F0000-0x0000000000C31000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore - Custom signatureUPX dump on OEP (original entry point) 7 IoCs
resource yara_rule behavioral1/files/0x00070000000004ea-1.dat UPX behavioral1/memory/860-3-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/860-19-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/860-28-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/860-431-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/860-460-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/860-827-0x0000000010000000-0x0000000010030000-memory.dmp UPX - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x00070000000004ea-1.dat acprotect - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Loads dropped DLL 1 IoCs
pid Process 860 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe /onboot" 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\e: 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe -
resource yara_rule behavioral1/files/0x00070000000004ea-1.dat upx behavioral1/memory/860-3-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/860-19-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/860-28-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/860-431-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/860-460-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/860-827-0x0000000010000000-0x0000000010030000-memory.dmp upx - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\System\symsrv.dll 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe File created \??\c:\program files\common files\system\symsrv.dll.000 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Checks processor information in registry 2 TTPs 20 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe" 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3" 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Low Rights 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3" 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006} 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe" 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe" 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3" 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm" 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A} 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243" 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4} 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Modifies registry class 17 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter" 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe" 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User" 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1" 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\WOW6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D} 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD} 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings firefox.exe Set value (int) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Therad = "1" 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan" 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\WOW6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}\Model = "314" 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 860 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 860 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 860 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 860 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 860 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 860 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 860 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 860 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 860 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Token: SeRestorePrivilege 860 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe Token: SeDebugPrivilege 372 firefox.exe Token: SeDebugPrivilege 372 firefox.exe Token: SeDebugPrivilege 372 firefox.exe Token: SeDebugPrivilege 372 firefox.exe Token: SeDebugPrivilege 372 firefox.exe - Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 372 firefox.exe 372 firefox.exe 372 firefox.exe 372 firefox.exe 372 firefox.exe 372 firefox.exe 372 firefox.exe 860 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 860 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 860 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 860 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 860 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 372 firefox.exe 860 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 860 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 860 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 860 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 860 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 860 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe - Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 860 wrote to memory of 1988 860 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 84 PID 860 wrote to memory of 1560 860 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 90 PID 1560 wrote to memory of 372 1560 firefox.exe 91 PID 1560 wrote to memory of 372 1560 firefox.exe 91 PID 372 wrote to memory of 3588 372 firefox.exe 92 PID 372 wrote to memory of 3588 372 firefox.exe 92 PID 372 wrote to memory of 3588 372 firefox.exe 92 PID 372 wrote to memory of 4464 372 firefox.exe 93 PID 372 wrote to memory of 4464 372 firefox.exe 93 PID 372 wrote to memory of 4464 372 firefox.exe 93 PID 372 wrote to memory of 4464 372 firefox.exe 93 PID 372 wrote to memory of 5092 372 firefox.exe 94 PID 372 wrote to memory of 5092 372 firefox.exe 94 PID 372 wrote to memory of 5092 372 firefox.exe 94 PID 372 wrote to memory of 5092 372 firefox.exe 94 PID 372 wrote to memory of 3248 372 firefox.exe 95 PID 372 wrote to memory of 3248 372 firefox.exe 95 PID 372 wrote to memory of 3248 372 firefox.exe 95 PID 372 wrote to memory of 4368 372 firefox.exe 98 PID 372 wrote to memory of 4368 372 firefox.exe 98 PID 372 wrote to memory of 4368 372 firefox.exe 98 PID 372 wrote to memory of 4368 372 firefox.exe 98 PID 372 wrote to memory of 5372 372 firefox.exe 99 PID 372 wrote to memory of 5372 372 firefox.exe 99 PID 372 wrote to memory of 5372 372 firefox.exe 99 PID 372 wrote to memory of 5372 372 firefox.exe 99 PID 372 wrote to memory of 5408 372 firefox.exe 100 PID 372 wrote to memory of 5408 372 firefox.exe 100 PID 372 wrote to memory of 5408 372 firefox.exe 100 PID 372 wrote to memory of 5408 372 firefox.exe 100 PID 372 wrote to memory of 5620 372 firefox.exe 101 PID 372 wrote to memory of 5620 372 firefox.exe 101 PID 372 wrote to memory of 5620 372 firefox.exe 101 PID 372 wrote to memory of 5620 372 firefox.exe 101 PID 372 wrote to memory of 5636 372 firefox.exe 102 PID 372 wrote to memory of 5636 372 firefox.exe 102 PID 372 wrote to memory of 5636 372 firefox.exe 102 PID 372 wrote to memory of 5636 372 firefox.exe 102 PID 372 wrote to memory of 5644 372 firefox.exe 103 PID 372 wrote to memory of 5644 372 firefox.exe 103 PID 372 wrote to memory of 5644 372 firefox.exe 103 PID 372 wrote to memory of 5644 372 firefox.exe 103 PID 860 wrote to memory of 4184 860 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 104 PID 860 wrote to memory of 3088 860 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 105 PID 860 wrote to memory of 3484 860 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 106 PID 860 wrote to memory of 4824 860 2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe 107 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-11_9c8f8f47627a8ce22de27fd68dc0da6d_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:1988
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html2⤵
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2004 -prefsLen 27099 -prefMapHandle 2008 -prefMapSize 270279 -ipcHandle 2096 -initialChannelId {7b18634c-1a34-49b0-8637-a470d17ded5e} -parentPid 372 -crashReporter "\\.\pipe\gecko-crash-server-pipe.372" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu4⤵PID:3588
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2496 -prefsLen 27135 -prefMapHandle 2500 -prefMapSize 270279 -ipcHandle 2508 -initialChannelId {35d080e3-c40f-4d30-8a2a-be775f719359} -parentPid 372 -crashReporter "\\.\pipe\gecko-crash-server-pipe.372" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket4⤵PID:4464
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3884 -prefsLen 25164 -prefMapHandle 3888 -prefMapSize 270279 -jsInitHandle 3892 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3900 -initialChannelId {c77a96b5-dada-4010-a0f6-dca5bf4aba47} -parentPid 372 -crashReporter "\\.\pipe\gecko-crash-server-pipe.372" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab4⤵
- Checks processor information in registry
PID:5092
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4048 -prefsLen 27276 -prefMapHandle 4052 -prefMapSize 270279 -ipcHandle 4140 -initialChannelId {ed1f7760-0737-46e8-ae20-dd6a6dea324d} -parentPid 372 -crashReporter "\\.\pipe\gecko-crash-server-pipe.372" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd4⤵PID:3248
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2752 -prefsLen 34775 -prefMapHandle 2756 -prefMapSize 270279 -jsInitHandle 3880 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4252 -initialChannelId {82df4730-6bd6-46f7-b3fe-364c6bd5c93f} -parentPid 372 -crashReporter "\\.\pipe\gecko-crash-server-pipe.372" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab4⤵
- Checks processor information in registry
PID:4368
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3108 -prefsLen 35012 -prefMapHandle 3028 -prefMapSize 270279 -ipcHandle 4788 -initialChannelId {e23016bc-4a04-41c5-9e6d-99c8636a81cb} -parentPid 372 -crashReporter "\\.\pipe\gecko-crash-server-pipe.372" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility4⤵
- Checks processor information in registry
PID:5372
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4956 -prefsLen 32900 -prefMapHandle 4960 -prefMapSize 270279 -jsInitHandle 4964 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4972 -initialChannelId {35d5602e-d7ed-4b70-8380-33d91ee646c4} -parentPid 372 -crashReporter "\\.\pipe\gecko-crash-server-pipe.372" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab4⤵
- Checks processor information in registry
PID:5408
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5272 -prefsLen 32952 -prefMapHandle 5276 -prefMapSize 270279 -jsInitHandle 5280 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5248 -initialChannelId {58fe15ec-10b2-4bd2-80df-a9dbed685931} -parentPid 372 -crashReporter "\\.\pipe\gecko-crash-server-pipe.372" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab4⤵
- Checks processor information in registry
PID:5620
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5428 -prefsLen 32952 -prefMapHandle 5432 -prefMapSize 270279 -jsInitHandle 5436 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4516 -initialChannelId {78252fc4-73b5-40de-8b22-44dc428a7f1d} -parentPid 372 -crashReporter "\\.\pipe\gecko-crash-server-pipe.372" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab4⤵
- Checks processor information in registry
PID:5636
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5456 -prefsLen 32952 -prefMapHandle 5460 -prefMapSize 270279 -jsInitHandle 5464 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5472 -initialChannelId {15381a5d-2aec-4d13-adb9-282ccc116e5b} -parentPid 372 -crashReporter "\\.\pipe\gecko-crash-server-pipe.372" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab4⤵
- Checks processor information in registry
PID:5644
-
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:4184
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:3088
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:3484
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"2⤵
- System Location Discovery: System Language Discovery
PID:4824
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\System\symsrv.dll
- Size 67KB
- SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
- MD5 7574cf2c64f35161ab1292e2f532aabf
- SHA1 14ba3fa927a06224dfe587014299e834def4644f
- SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
- SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
- TLSH T17863F1372AB5807DDD210D37949F835AB771E5A76C20643FC25907D988B8DD0E3239AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\System\symsrv.dll.000
- Size 114B
- SHA256 aefc503b1ed462d7b6280228a7b5b710792273b78934426f88325341ac5b5a92
- MD5 e609411db8aa6775d0344c75c23ae79b
- SHA1 1d2ff6194bf159ce36cd0461cd3da29486d1e97d
- SHA512 6884ff5c07bc687132c965a59cb8c5a898a25da74c6c846c1d6089ddca8007cb7e4d2f8520bdce9fbcf6e2f9c9e5c28d8c8d6d049d3522470bdc7d38bbfa0ad0
- TLSH T1FFB09262AA2791EAE1AA224505A0248C1ED0B62AB48638002EBA5A4E93256A85916147
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\activity-stream.contile.json
- Size 4KB
- SHA256 c845121bbd2b5e8980e2f075882b3094ce44741037607dbc2b6a6af29fbdde25
- MD5 aa955e45192c62a30bfd144df7e5a7d3
- SHA1 578043f79ac1f99fac9eb72b6c0ab7e10c31497e
- SHA512 75f5b05a3a6a4c3c642e1a505e2b777d4fc559e280e0fa7b1f982fddcf174c019f3966438aaa080a7f8b1222953fd7759b3e2d36aaf838e514fdbbed3000a4a7
- SSDEEP 96:Tmy8EMhaWYmgyGzlPT+mRqBn+yxAEA9blz:qyMVY5HlSmRqB+v9bF
- TLSH T1FCA1CA5B967089111731B9F5AC0B3BBCF013B40989F0C6DCF2AA9C6095BC7EDD1DA949
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\activity-stream.discovery_stream.json
- Size 75KB
- SHA256 96ffe88549ced746fe29ecc65bc3ac70740500c76bdfec05851c42b6c43292b0
- MD5 0bd6ef4fdd9d1c26f102f9fb8e6f3023
- SHA1 afb1a835cff310d1641d13588df4834135e12a3e
- SHA512 c12022b441f7a9194b94a76d13d802d13860d05cd3b0715632ddd1c6c269160276b0937e090a5cd2b083a12e1dfc1df2b590e8c5c515efe698f27f2ab3a6d82d
- SSDEEP 768:Hy07ddEyqcpSiRh4csXwbUI8GbIQN5W+2KV96qYayi+z9aO2WG:S07Eyq4sXaUI8QIQnW+2KL6qX+cv
- TLSH T171733CA3A6A875BB0BA437CB2C4B7A6B63D14145F34502C9EDFEDA1D80C9740117B6EC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\activity-stream.discovery_stream.json
- Size 75KB
- SHA256 0ff5cf55ee45933d59d2beef9275f65d8885df7d3ddc73aeb7e62a95d6ef767d
- MD5 f5226f11dbc74cc8e209e4922778e464
- SHA1 e2a0410ff8b278f4d80ec2957f4bbe8570b45520
- SHA512 3e1561c22abf869e534bd29a8118dcd821dda0a72858c19655f736f6c94dcc410e9ec699fb70b49e313ee2444097bfa313da7c2d5a67fdfacd71fb4672793578
- SSDEEP 768:HyhGbQsDfloW1bpi+4WCz5Fo7R1o51eZOiEG1z8olU57ew9OOrSc+Gz2KOU:ShGNP1AzfOXYYZOB4z1lU5wGzf
- TLSH T1217309E3A6E8B1BB0F9037C72C0F795B56E10195F74506C8ECE9CA1C81DD658123AABD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\cache2\entries\06A6D86B39A0E3DCE68006525D21C3AAB6C8E0B4
- Size 16KB
- SHA256 7172c8fab103ba4e532101d1aa2805fc972a21a1aa3df1150c26f4dfa1715271
- MD5 43b6db7951145f9f26372193c748913c
- SHA1 fb2323c293df9c9cd46c13c207afeebd4bc9de32
- SHA512 1a8219aae035452f978d4783734b94cf4fb6111bad5010e24facc552871e2890efa5022b103e623bbdee170400d0f4df264e3d30c7177fb0bbdb021f768ae5fb
- SSDEEP 384:HXwIiO024Y6WTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMAiev:36ZY6WTToXJWTTogB7S/AmVAf+hRMXev
- TLSH T102728E7D9F013CAC276790D4C8B983598D1CB6ABDFB5C02D15983D0DCA48A5A70F985E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\startupCache\webext.sc.lz4
- Size 104KB
- SHA256 15007a5100bd017f996bc9ef755751cd2a146f66706c5ba24eac6a3fa2541542
- MD5 4b1a5fd96764877006a089fb656c4218
- SHA1 bb702b109519b76789851980bcade63505a98c9e
- SHA512 030579653c78ea757f2d7a7b7301fea994cc0d2ff19b0cc73146573a9c6531f0713256f2ffc9d4a0422d742042698dc6749cc26f98fb1d9eb886a93fd0cd650b
- SSDEEP 1536:jTrlipJ/QUz/6Nax8PEjNYl9VLtt0eCEMyf6jkL8QNL4b7mBJ3LakFEmt02mbXaT:j3lBax8JE9yfNl8b8J3LakhEbG8KAJtw
- TLSH T163A3AFF6DBA2CD6964FFD42D6AC2C43EFD262404B3A32005CD23672591C6FB87675648
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\startupCache\webext.sc.lz4
- Size 105KB
- SHA256 785c0d70e895afe98d26029ee3ca1b49eaf3cd171d2c17c7064b055f5f582ee5
- MD5 ba11a1115ab9c28c7fab61e8721b2cd6
- SHA1 09be85231b8ce1735aa6a0d229b3d34e4487d8da
- SHA512 c8fb56080eb84a980368355ea28e9bee330772623b6e7c79f9241559932a9e507df844031982a2eea095dbff2024856230b20c724575a788deb0db3e5cd3eb3e
- SSDEEP 3072:X3lBax8XQ2BjicfNl8b8J3LakhEbG8KAJtq:FBtXzscI8JbaWEbmAu
- TLSH T1B8B3BFF7DBA28D6964FFD42D6AC2C53FFD262414B3A72009C923271492C6FB87675608
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 21.6MB
- SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
- MD5 40bf410fa9ef0d5499907e34885af6f4
- SHA1 4d7722337a0e26bf4a1c6478129356acb2f7b720
- SHA512 b763712aa4bd9819b7972a40216c08fd32338b14fab7ce4b166e39ce441ad62678bf0e1f25da436ffdb56ff1b1a21e3dbbaf47c0f5918c252e70656f5d0307ac
- SSDEEP 393216:KYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHY:3mghF5QDwWCm/2YU8Ivq9u5P
- TLSH T14F37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 11KB
- SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
- MD5 25e8156b7f7ca8dad999ee2b93a32b71
- SHA1 db587e9e9559b433cee57435cb97a83963659430
- SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
- SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
- TLSH T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 502KB
- SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
- MD5 e690f995973164fe425f76589b1be2d9
- SHA1 e947c4dad203aab37a003194dddc7980c74fa712
- SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
- SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
- TLSH T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\IDM\DwnlData\Admin\www_internetdownload_1\www_internetdownload
- Size 10KB
- SHA256 c8db35d012205bfb0c9b27e217b949ea9782a7e1de017a0ccddbdabc3dcf38d1
- MD5 3f78380466581cdd222c67131e7795cd
- SHA1 7e8827023fc4f548f4678f9d32b46fe02c0a02e3
- SHA512 11fb321151870c259dd3aeacb5e96de80752a8d4702006f9d598847cb8b8b4a084b3339e3c2d6b5d425275eb4adb9f320512f91853bbd86a46ce767c11e97490
- SSDEEP 96:9MupK4+cLOruFL1macbpFS02HxQfErjpkB/WRXZksDaRMb4Fw9HM0:VN4eOZEJG+ZkcaRLGFM0
- TLSH T16322CE2F5004B23501521009B7B6A3F2BB1DB03AA74592A648CB946C7737E7EDB7E1D7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\addonStartup.json.lz4
- Size 4KB
- SHA256 52309938b2918cc57d792e18bbdcc16a1c8345cb94e461f64587cf860691cd56
- MD5 b89e784df4e4de2a28382c66ac08f1b7
- SHA1 c4023f796c2afd1baacf8524260ad74b0343ebfc
- SHA512 b5f58d3c24080b8d439476e9075408968556e703a2ae745bd697105aa159dba2c56d32b266d64fbc090b5b3efd6765cdd34eaff13ed50292caf8c26ecc4f0e64
- SSDEEP 96:NXR4sHNw6M2xWGhD41MgGvmHhF+rUpO1LnOYvhQhIRhN:N452xxhD8rGvm6ApwnHUuhN
- TLSH T1DCA17DBAD541EFA1FE32C0439CE93FB2E6A6AB7410A9C4D0F1AF71294C64A731701380
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\crashes\store.json.mozlz4
- Size 66B
- SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
- MD5 a6338865eb252d0ef8fcf11fa9af3f0d
- SHA1 cecdd4c4dcae10c2ffc8eb938121b6231de48cd3
- SHA512 d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c
- TLSH T175A022C28E0C83BACF000833008AF00300E83B020B8B0F882AC2AEF8200200C8082082
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\db\data.safe.tmp
- Size 7KB
- SHA256 0854229989e99d360ed0ead3915e42acdb1a128f41a6a709b9cb6695ade0dcd3
- MD5 de69657af8651000afde47a7056a45b1
- SHA1 7b74d84bccae2bf479ed1ad1f7325597d404b1d0
- SHA512 979e9efdfb22a4f4f205fab02e2778d0cc7ac3a5058410f3fa4acd4b86b08337c7ae5bd51e9f8739ea9b73206c364ca4bee82e5c02c06db25aa596af5540c1fe
- SSDEEP 192:YX9Ov5zboPBOVZyjifYb9L1d66JozGzgCl6mc0dz:HboJO7yjjd66JozGzgC1jd
- TLSH T14BE110A4EA28863FC054027BCDA61F554F353C9A988E3F19359CA4082D573DD7A8E1BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 45c2643922e46d4216188f03264fc8373a8d3459c9cb5bf7f25fb0d0fb1a072c
- MD5 12e7c1bdbca4bae7c1ca8216871ef13b
- SHA1 5e60a38549dc8dfb348fc6160be7d789c36310ff
- SHA512 1e1ca52608af061019c38f268f148c9487216dca28abfc5f645a3438278f869325969e987e07c2380235a50a4746ee1a74791431705f8a796f1d89f264ab1e8e
- SSDEEP 192:CX9Ov5zbo8ZOVZyjifYb9L1d66JozGzgCl6mc0dz:Nbo8ZO7yjjd66JozGzgC1jd
- TLSH T1B5E100A4EA28867FC044023BCDB61F554F353C9A984E3F19359CA4082D576DD768D1BD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\events\events
- Size 1KB
- SHA256 48b91d4639fac96c151d3c08bf14275d13c08a6a8c8e464f41fe03b442d8aac4
- MD5 42d2175aad1082fd04dd50e5164c3189
- SHA1 b2ba885e4de15299b0b26dd906e0f305801cef00
- SHA512 9ca8e057cd553b86eebfc2931b0a4377413414827be00f22c2140bdc4cca4350d0afba50038716703215e8fc3ff6f849ad0d943feabd6a51c1d7074ae8a0ffa1
- TLSH T1EA21B45C39B85D2AAECFFA6C7551118E57514E0B04871C430D12EF8ECDD1ADD32AA43C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\012dd85a-fd8f-407c-bb08-4419b025b125
- Size 235B
- SHA256 cc8ba8f9822175da8fd8fd9a0a228630ef2890d83296eb138256290dd39a987d
- MD5 739b65250a5d6de586f9c4f53a1be4db
- SHA1 73ca2b96c194204698dabc99f6ac559354228dea
- SHA512 9f4cd3d7ea29545ab8d8e20cd253ba1eecafbc3c36a35680deba32c79b201e1b112b8b4750fd3114c1ef6a7c315ffdd2e4dcd75eea6dacc90c77116cd567282a
- TLSH T112D097D0B4A8376C88140F07F0E0B8C630E54C335470A8608A6040B48DFCDCA0251C5B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\11eb1c81-15e8-438c-99a9-f6ee40fa1ff6
- Size 15KB
- SHA256 8c72ca1fa73493c4ea3dd9fa508b1cc48ed59ab535d16d887d1431bcd7a2a59b
- MD5 0d4d3569ee57164442c2221fb2dda5b7
- SHA1 639a9705177ea6c7f96af2b736ef12dc26705ae0
- SHA512 68de831b05ae34ffeb25552e7e1a68843ff25cea7093bd329ea463502373fd4c0178551e89af00a8f7aba869b68e906820a4603e9b0496eef6fa369dee6274fd
- SSDEEP 192:BF9f//9mKZx01Tu+sIzaRESUhV1HQW0UlrjIX5qh/sJi9Dz6udSooI0713MBeE4i:D1/VmK/sK+sI+RESUP1HQ6r0YIE4i
- TLSH T16A72EA56182059BA8251E36994ECBFC3E6F538CF4C419FCACBE4BD085DEE0AD512784B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\65735676-4028-4f8f-a87e-ab80b9c46e58
- Size 2KB
- SHA256 0862913b6fee9504d24e2e8a024f1566aec3c34eb147027d091d7d25d4d54a21
- MD5 71a780115187fb0b35d66c0a4e455551
- SHA1 01455373c2b1d1df947570b7123aaf1282096fa0
- SHA512 4575c63c6394a1b985ab29b19a6e8390dc6d0ec19ba291ac09538e11a7fae02bbdd0700985686ef1bfb7846682308332ff15639cd02a2f7552ba631a8abe6f97
- TLSH T16C41519C75B86C778CDAF14DA591238E53608E9300C628636E41DF0C8DA679E337A96B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\9a093220-ffd6-4948-ba4f-4b2e50f6607e
- Size 235B
- SHA256 4da31f22850d2b80dbedd2e98065c0c146047a6d67853777ad0c6266c2824591
- MD5 cc594705ee0bb0ba8bfc7ac1eb4d6b0b
- SHA1 3b739e555a7973bd6569b054807344eb9110ff32
- SHA512 f4af2e03ed5b8e10a12cd544c46f9f3e9d5bc015901f568b8ab7f15d42e5a8ef77b4a6bda02b694d4f1fd8af96b3c7956df95373ff65118e069cc686e71a66f1
- TLSH T1FCD097942488272E0C144F0AF0F02AD630888C331070A820C9A3413599BAEC80111C0B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\af9452f1-4ae4-4842-b702-8097808e15be
- Size 886B
- SHA256 e7e03b507421d403489f7e34fcf94b32d5eee9e41d62b3b8b563eedababd6f03
- MD5 81247e8203b4a8c81cf005d24c93c5a6
- SHA1 e9e6ce91f4e13d0debe001eecf736d67b0a5c725
- SHA512 a2e1aba72f7d24a5b9150bfa71ac0fbb265d68187abdc2254fe2cdb22e9274bff40404e7db901249f5ac98763ad669e0111d62a5eca28474f6aa47b21d0df4c6
- TLSH T1AB112781D734B4B2CC78D24BC9A177528BD0743380C959143D548E0C4DBE71E6797607
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\datareporting\glean\pending_pings\bf519774-3482-4ec6-a2b6-f96f2b95cb06
- Size 883B
- SHA256 00886bedd4b873fe28ecc3b40d39a346ceb1f1dd671b728c662f7c9bc4cab899
- MD5 77033c4e84a61c962fa95ed04e3cce45
- SHA1 44f312177bef8a57e141b185bb63d1b48e8b1e54
- SHA512 443ed2ffcbbf4f4b98d6612755c736e060d0c991b0a15da44de306229b0b14e52eaa1832cc754ada03c898cbfb9aa0af08264d5b03d9bd48229c050048f87641
- TLSH T143110080E639B5B2CC6CD25FC96137458BF4693380C994143EB48D080DBEA1E93A668B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\extension-preferences.json
- Size 942B
- SHA256 aecfc11c0db969b2c79da2144415a8859c77d66fbfc37ca4924ac58a0ff29834
- MD5 20357ec0806e9826d6daf456b6b16bd8
- SHA1 7d5d7a921213989294eb5cea2ee760e562ce5293
- SHA512 2333fde606ee727a6b6d9812ed40e56e5d0dba4ec35abcc11b67f8ad61d1d3d4af5db699d29b3ed6b459b9e142badae69ffbebf18974b5a1c72e45ecc8cf93cf
- TLSH T17211F13A640B6EB01E8E5625FE384A92E791111B50B7F2E47E69934A13D3970C1ED39C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\extensions.json
- Size 14KB
- SHA256 c729435dff2a9d676c53a0f1cd0f3768bf51f1ec7dc8f75ad573dc0110799c71
- MD5 30f831c31c4b4420e888b98f3c5da7a1
- SHA1 e72951c5572af141b34a1a33584a19cf1a3a88b5
- SHA512 1c1f2dc9b7e3989a794b4e0d23ac6810bb4c2b277fe9bf049cc3f16cfdf247f411f25a87a84ff09bd8ed17a0fe2206b66d265bb8e9c137dc8b94b1d16a4c7e96
- SSDEEP 384:mkI4vfUmldvBM8dhW+94zO96otXL4HpL4P1L4HDL4HTL4HC:pI4XRfbXT4e6Yb4h4d4P4/4i
- TLSH T11462531545148EB8298FA79BAA367D02C37D473B60845C38F4DD8FC842FA5B902FB61B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
- Size 1.1MB
- SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
- MD5 626073e8dcf656ac4130e3283c51cbba
- SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
- SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
- SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
- TLSH T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
- Size 116B
- SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
- MD5 ae29912407dfadf0d683982d4fb57293
- SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
- SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
- TLSH T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE
- Size 473B
- SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
- MD5 7406820f5d56fda6baffa951c60679d2
- SHA1 e7d4894993e506e235d55b3e47aed019d0584148
- SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
- TLSH T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
- Size 1002B
- SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
- MD5 dcffff15fa618a53834ee4ae8673bd23
- SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
- SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
- TLSH T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
- Size 21.6MB
- SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
- MD5 d14dd3f0107ff91c3e21f301d83f82b0
- SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
- SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
- SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
- TLSH T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll.sig
- Size 1KB
- SHA256 c5f50bed6afd38490baca2ce8e8fdd1a39849c9f0dc06478a8a2e9226526607b
- MD5 61d51cf075ad6dcbaaebf956c6bc1dcd
- SHA1 f176331dcdb84327afd47ecf8ede3b0664c7d05a
- SHA512 de263ed43f1112786186afa7bb942f25482fe60b04e7138c3687ec09956e0247307e5a6303a4297f785a572ed9a0059747a9b870c2fb6e84483373cfe27ca6c5
- TLSH T1C421B6DDAD2426542DC0EB2D5EF8E826DD3112C2F96404BB426666C3FCA3BA038C466D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\prefs.js
- Size 6KB
- SHA256 10eceb04e427c955d13123e7442e200a6ac23d44c03710c49b2938cb81c20d9a
- MD5 78549c1c3e74fbeffd149c0896c0261e
- SHA1 a48c17192c3f5bbfe167dc2df9543fe0f036b514
- SHA512 11da229386f5d5823ee5aec12150dc138a7cfb0c3aafb4d5a6d27733e496dec4fd6d16760e883e3002eefe1bb44e60e342ce768aaa3207e891741d92e434b6b1
- SSDEEP 96:xHYUTUzqGqZEfUoiObzSzSSlSdv9jw1nvHhW/YBw88n8L4cntGUI6:KORZEfUoihSSho/YBw88n6
- TLSH T104E1407891088F6F64B6776CAC288C316AB2413B7BBF68C750B584C4011CF3842F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\prefs.js
- Size 8KB
- SHA256 62b8817be815ce46758d94340039c04e6096f9da3ba4509f4dff29d91f75f87e
- MD5 ffa13ae7d255766a96603fbf72baaab6
- SHA1 c159e78692ebff3f0d5ae5873e1e13f34ec72535
- SHA512 4ab4d9a9efa9c21deedb7a150086cecb6a6cc3e52bf11c65d4d4c0a09bd48da2c59f79df11c219d52abf65f26a95f75f47f8925dd66999a10c1fc0b2308f5a96
- SSDEEP 96:xHYJTUzqGqZEfDoiObzSzSSlSdv9jw1nvWRl9W/sBw88Kke8L4cntGUI6:KPRZEfDoihSSoRO/sBw88hE6
- TLSH T143021E789048CF6F65B6367CAC2489305A72013BBBBF68D750B994C9015CF3441FAAEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\prefs.js
- Size 6KB
- SHA256 f646b039851d5a05319a6b376ff6c1d361b2536c304f7df82c3881c81eb5e736
- MD5 62e0ef985528d88eceb6af0467002108
- SHA1 082e2399d19916e9e872aa0ea87f9e19c9f5c6d6
- SHA512 e6f3c0125680cd4ccbe0cfcb1a0c2fd6476efb254ca88e5158492c6dbb7681c250d019e0a9efb740a36f350c96a1b5d70f93b3ecdbf6b7e1389844a70df86318
- SSDEEP 96:xHYUTUzqGqZEfU2a1zSQSSSlSdv9j/nvHhW/YBw88n8L4cntGUI6:KORZEfU2atSSSoo/YBw88n6
- TLSH T1EAE1307890088B6F64B6776CAC688C716AB2413B7BBF28C750B544C4011CF3442F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\prefs.js
- Size 6KB
- SHA256 53050d29f692c7216c298f15d00eda780f4dd332907877007845c5adb8da544b
- MD5 20333c735e735359cd06860242cc2c02
- SHA1 097b43312ce8e0b1bd974b08bebd44c49d742063
- SHA512 8f3d8d339c34c4a1e1587b2fd5250555d36d4167aa32734c62d0d55fe1db0d35d48a8b55f3380dd3e659965d6432bc4e0aa658ad7ce43f628185b8b32e2bb174
- SSDEEP 96:xHYUTUzqGqZEfUoi1zSzSSlSdv9j/nvHhW/YBw88n8L4cntGUI6:KORZEfUoiuSSoo/YBw88n6
- TLSH T14BE1307890088B6F64B6776CAC688C316AB2413B7BBF68D750B594C9015CF3442F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\sessionCheckpoints.json
- Size 90B
- SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
- MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
- SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
- SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
- TLSH T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\sessionCheckpoints.json
- Size 53B
- SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
- MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
- SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
- SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
- TLSH T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\sessionstore-backups\recovery.jsonlz4
- Size 4KB
- SHA256 616b50dec040b10b6fc26b74654c5b9fcb0d028af8183b4799dbf322b3fa32b9
- MD5 860a88b71684837bca98f409ff69f263
- SHA1 5d3ea44757c7b48af0592a920213187f929191b4
- SHA512 683de236bcbe596922e09940251c9fb343342162c36cf9295492021b4cfa66cd03d0127b688760fefd18c04a0cd444623fe35a9bb33f4c331b8e3148c4570c0a
- SSDEEP 96:ePf6wbYKgAXDLQeW9jILA0NjoB8kMJttn0YJZQBW:uxfIOnNcB85JttnTZEW
- TLSH T11F917E02361BA9A7FD5B858BEA5D4CE141F4310E998148EC90CF7A26F76FB47384D076
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\sessionstore-backups\recovery.jsonlz4
- Size 4KB
- SHA256 0ec4e03be537757c9bf8b11624463f719dd14ced509bfcfe7203aff9bc5547ee
- MD5 79ea54a43ae390d273ec0e7846fbb8c9
- SHA1 3da670e82fb8d5490b56137275210c0e9f7506b1
- SHA512 fbddb7ed24d75d43c71134c60a2e8b1188c45cf883e87418fbb63bd215835de11b6daaed64859097fa280e98e83143901e4fb11a0adb4744d4054d1a658f7295
- SSDEEP 96:ePf6wbYKgAXDLQeW9jILA0NjoB8kMJttn0YJZQBU:ux3IOnNcB85JttnTZEU
- TLSH T1A2917E02361B68A7FD5B858BDA5D4CE141F4310E998148EC90CF7A26F76FB47784D076
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 5.5MB
- SHA256 854af8a85b93dab02fcd872be072b7bb50e544c67d9fb20b6673a614d8471b22
- MD5 985981c8de08b03eb68329b00f1028ce
- SHA1 2a5f2654b12d06153087de470e453da441cec574
- SHA512 db25f2ebe61de9a34239f173affd9b86f3f473d8ffa2907115f17e31866bcd4cc26f1aa458db30c628505aef707dca2fc4ae43b7757772bb2e7e554186675a84
- SSDEEP 24576:cGUlohpBX/STjyJDYBRyyGOO8wBERfEiPNzvjmryA1s7jS5E6NKREkfNkMC:cGPpIGJYu5KvjsR1s7EEXRxR
- TLSH T12C4629E820D1A297F3814073724593EB21EFD00D5037DA085BA95AE9A574CEF8E17B7E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 6.5MB
- SHA256 39bc6339563ab9642566b5ee2ae9f589bb916e8f5bcc7413421eb5f74c10d185
- MD5 b0c6caceeea335d648ae05d1cbb5f0d4
- SHA1 89202e55f30ca0f2f6bbd67df48cf19260eac4d7
- SHA512 be9164450e71930dd5d6c64df0f9aeaf968749e964b9b7cc5f9d8fe8c49062be6e36385282c80d2f2568f95fb4b1bfb9c7f83b70250d244280d7028a594ff372
- SSDEEP 49152:bYiGa8W/5b4EUoeIHZ9P7m7srqn96x0B7yrFF9kW:cHUXm7yqnsxSyr
- TLSH T1EE663BE860D0D297F3824073764983EB21EFD00D503BDA0857A45AE9A5758EF8E27B7D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 6.9MB
- SHA256 0670761db7cac56057fe0a3d01a8baa01414246c0c823d8d057d776970a226c8
- MD5 91cf43550067f9d748f853569dd32373
- SHA1 9c07e4fe0bf3a79f6c31beb2d77e1df78a2c1b06
- SHA512 6e40bd96a57f594f66f7a7d5a6c22a774c57a31eaeec4de2919f4fc695b6851af892421fa2a10d1f6b0ec8230fa08ea28e29dcb0adad7ca36c69d4e4ba4110b8
- SSDEEP 49152:sjlGa8W/5bDFXoeVzZ9PrYm72Gqn96x0i7RA6F9DWmNDY07:i1X4m75qnsxrRAC
- TLSH T1D4764BE860D09243F3464073718993EB21EFD00D607BDA4857A45BE9A5748EF8E27BBD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 7.6MB
- SHA256 ecf912160ea5bf4c34978d0fc21f040aa61e52a11fdb16582623d2a56dbe1af1
- MD5 2c7c5663381818b5395fcdfbf0856bd0
- SHA1 06bf48fd53af9a984a81d0cc460f7160d53d6560
- SHA512 6ff826d7f7fb7c6a390bcf15c1c51befb476b2ab9215a110d7d90a772a4235441f4ca3d1030dce3ed07b044bc8c93f22acf59d0b1feb9b62722645c62e475740
- SSDEEP 49152:uv0WkPn/X1yeAy2D3/YjHoWT4lJqP++fW4uw/XYYVUa/QW9ws5Ga8W/5Uk9cNoe6:Wu9rgZ7mqnsxx+i
- TLSH T17C866DE820E1D253F34644B3719993EB20EFC01C6036CE4457A496FAA9748EB8E577BD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\targeting.snapshot.json
- Size 3KB
- SHA256 a9d20bef1153b59060ee915176673cb57e413084310be4802385d79f9f33f984
- MD5 011f01ed671e4413fd0ad52138b688fa
- SHA1 a122f7eded2cfcf33d32aa8fe5ef6e0face3dff2
- SHA512 1d47c2a4d4496593fa8cf163869f92b574fbdff9a2e4d8571e24849d3c1b7e280b96b3ce095c876c5559f528344107d575c9b03ff74821262bd64243a94466b6
- TLSH T16571820C961CA4BEA66BC3C0DA447F978BBD053770407458DAFE460C55FB5FB162621B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\r7rqhbuk.default-release\xulstore.json
- Size 167B
- SHA256 c1bed5f53e44f988d50469fe36ee52ab0bfe2215cc126514ad06b5c0c28dfd87
- MD5 2ad8b3c13995ae985a912f3297c6103d
- SHA1 45b786fb55ccbb948a89c9a233fdab1fd3c82eb9
- SHA512 c9853c003b0c9fe66ae2cd849dcf17fe1e3646520a5d2d5cf5ec1bdc1308ba504f58a248ff4b5fda487d7fd97318899e2c41ce1c628a5895aa75648d10a34ac3
- TLSH T109C08CB0216FD8487D27CBCF128D22983D3A8A54A1D0529A69EA94E018C570F9D18388
- MD5 SHA1 SHA512 TLSH