Analysis
- max time kernel
148s - max time network
160s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/04/2026, 15:03
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
29 signatures
150 seconds
General
- Target 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
- Size 5.8MB
- Sample260417-sfclpsc151
- SHA256 87ded20b2da7f4b97b26a55f8b29d6dbc9e6c1757d622de38f50b79d45602d81
- MD5 db7ada8413ddc45ca2da9c3655b0511e
- SHA1 24262fe74255dc456f0b988c6506d7b2e7b5856f
- SHA512 a3e605997e158b27a1d50ec8c34e844054fb0c7b978d5bcfa6e7c9db4e8276953bd0ae2cd6dec629ccac4035668b412666e8f13ec3d48b105dec7be9e561f027
- SSDEEP 98304:JKGyuXkhrfbsMufe1NP4PuK18frP3wbzWFimaI7dlo50:Tcrfb2+tgbzWFimaI7dlB
- TLSH T142569D51BF8CC17AD95A1131172DAF2A402ABC98773465D3A2743E7EEC763C22C3961B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Floxif payload 1 IoCs
resource yara_rule behavioral1/files/0x001000000001f15c-1.dat floxif - Custom signatureDetects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 3 IoCs
resource yara_rule behavioral1/memory/4188-19-0x0000000000490000-0x0000000000A61000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/4188-408-0x0000000000490000-0x0000000000A61000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/4188-421-0x0000000000490000-0x0000000000A61000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers - Custom signatureDetects executables containing SQL queries to confidential data stores. Observed in infostealers 3 IoCs
resource yara_rule behavioral1/memory/4188-19-0x0000000000490000-0x0000000000A61000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/4188-408-0x0000000000490000-0x0000000000A61000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/4188-421-0x0000000000490000-0x0000000000A61000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore - Custom signatureUPX dump on OEP (original entry point) 9 IoCs
resource yara_rule behavioral1/files/0x001000000001f15c-1.dat UPX behavioral1/memory/4188-3-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/4188-14-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/1388-15-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/1388-18-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/4188-21-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/4188-380-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/4188-410-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral1/memory/4188-2352-0x0000000010000000-0x0000000010030000-memory.dmp UPX - Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
- A potential corporate email address has been identified in the URL: [email protected]
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x001000000001f15c-1.dat acprotect - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\International\Geo\Nation 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe - Loads dropped DLL 2 IoCs
pid Process 4188 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe 1388 regsvr32.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe /onboot" 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe - Drops desktop.ini file(s) 3 IoCs
description ioc Process File opened for modification C:\Users\Admin\Documents\desktop.ini firefox.exe File opened for modification C:\Users\Public\desktop.ini firefox.exe File opened for modification C:\Users\Public\Documents\desktop.ini firefox.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\e: 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe - Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper" 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1" 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8} 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe -
resource yara_rule behavioral1/files/0x001000000001f15c-1.dat upx behavioral1/memory/4188-3-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/4188-14-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/1388-15-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/1388-18-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/4188-21-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/4188-380-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/4188-410-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/4188-2352-0x0000000010000000-0x0000000010030000-memory.dmp upx - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\System\symsrv.dll 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe File created \??\c:\program files\common files\system\symsrv.dll.000 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Checks processor information in registry 2 TTPs 20 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm" 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe" 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A} 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006} 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}" 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243" 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4} 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe" 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3" 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Software\Microsoft\Internet Explorer\Low Rights 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3" 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe" 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3" 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe - Modifies registry class 16 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Model = "106" 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4} 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter" 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan" 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User" 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1" 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (int) \REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Therad = "1" 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}" 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe" 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe Key created \REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings firefox.exe Key created \REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7} 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4188 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe 4188 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe 4188 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe 4188 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe 4188 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe 4188 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe 4188 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe 4188 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 4188 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe Token: SeRestorePrivilege 4188 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe Token: SeDebugPrivilege 1388 regsvr32.exe Token: SeDebugPrivilege 2472 firefox.exe Token: SeDebugPrivilege 2472 firefox.exe Token: SeDebugPrivilege 2472 firefox.exe Token: SeDebugPrivilege 2472 firefox.exe Token: SeDebugPrivilege 2472 firefox.exe - Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 2472 firefox.exe 2472 firefox.exe 2472 firefox.exe 2472 firefox.exe 2472 firefox.exe 2472 firefox.exe 2472 firefox.exe 4188 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 4188 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4188 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe 4188 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe 4188 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe 2472 firefox.exe 4188 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe 4188 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe - Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 4188 wrote to memory of 1388 4188 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe 86 PID 4188 wrote to memory of 5660 4188 2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe 88 PID 5660 wrote to memory of 2472 5660 firefox.exe 89 PID 5660 wrote to memory of 2472 5660 firefox.exe 89 PID 2472 wrote to memory of 5736 2472 firefox.exe 90 PID 2472 wrote to memory of 5736 2472 firefox.exe 90 PID 2472 wrote to memory of 5736 2472 firefox.exe 90 PID 2472 wrote to memory of 1660 2472 firefox.exe 91 PID 2472 wrote to memory of 1660 2472 firefox.exe 91 PID 2472 wrote to memory of 1660 2472 firefox.exe 91 PID 2472 wrote to memory of 1660 2472 firefox.exe 91 PID 2472 wrote to memory of 5224 2472 firefox.exe 92 PID 2472 wrote to memory of 5224 2472 firefox.exe 92 PID 2472 wrote to memory of 5224 2472 firefox.exe 92 PID 2472 wrote to memory of 5224 2472 firefox.exe 92 PID 2472 wrote to memory of 2820 2472 firefox.exe 93 PID 2472 wrote to memory of 2820 2472 firefox.exe 93 PID 2472 wrote to memory of 2820 2472 firefox.exe 93 PID 2472 wrote to memory of 5156 2472 firefox.exe 94 PID 2472 wrote to memory of 5156 2472 firefox.exe 94 PID 2472 wrote to memory of 5156 2472 firefox.exe 94 PID 2472 wrote to memory of 5156 2472 firefox.exe 94 PID 2472 wrote to memory of 3036 2472 firefox.exe 95 PID 2472 wrote to memory of 3036 2472 firefox.exe 95 PID 2472 wrote to memory of 3036 2472 firefox.exe 95 PID 2472 wrote to memory of 3036 2472 firefox.exe 95 PID 2472 wrote to memory of 6132 2472 firefox.exe 96 PID 2472 wrote to memory of 6132 2472 firefox.exe 96 PID 2472 wrote to memory of 6132 2472 firefox.exe 96 PID 2472 wrote to memory of 6132 2472 firefox.exe 96 PID 2472 wrote to memory of 1776 2472 firefox.exe 97 PID 2472 wrote to memory of 1776 2472 firefox.exe 97 PID 2472 wrote to memory of 1776 2472 firefox.exe 97 PID 2472 wrote to memory of 1776 2472 firefox.exe 97 PID 2472 wrote to memory of 1676 2472 firefox.exe 98 PID 2472 wrote to memory of 1676 2472 firefox.exe 98 PID 2472 wrote to memory of 1676 2472 firefox.exe 98 PID 2472 wrote to memory of 1676 2472 firefox.exe 98 PID 2472 wrote to memory of 4120 2472 firefox.exe 99 PID 2472 wrote to memory of 4120 2472 firefox.exe 99 PID 2472 wrote to memory of 4120 2472 firefox.exe 99 PID 2472 wrote to memory of 4120 2472 firefox.exe 99 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1388
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html2⤵
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html3⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2020 -prefsLen 27099 -prefMapHandle 2024 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {a7f2f1d8-4f31-4cd5-907b-d2c157291c27} -parentPid 2472 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2472" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu4⤵PID:5736
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2504 -prefsLen 27135 -prefMapHandle 2508 -prefMapSize 270279 -ipcHandle 2512 -initialChannelId {8872d8bd-f9b7-4081-b90d-d9cc7f441507} -parentPid 2472 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2472" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket4⤵PID:1660
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3680 -prefsLen 25164 -prefMapHandle 3684 -prefMapSize 270279 -jsInitHandle 3688 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3696 -initialChannelId {97a23f29-62ba-4229-b5b7-abaa084fed95} -parentPid 2472 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2472" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab4⤵
- Checks processor information in registry
PID:5224
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3864 -prefsLen 27276 -prefMapHandle 3868 -prefMapSize 270279 -ipcHandle 3968 -initialChannelId {c0506a0f-ce5a-4022-b605-d3ede708d4b7} -parentPid 2472 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2472" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd4⤵PID:2820
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2820 -prefsLen 34775 -prefMapHandle 2816 -prefMapSize 270279 -jsInitHandle 1676 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4180 -initialChannelId {5d5bf501-b99f-4e75-bf23-613767c52b21} -parentPid 2472 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2472" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab4⤵
- Checks processor information in registry
PID:5156
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2932 -prefsLen 34905 -prefMapHandle 1676 -prefMapSize 270279 -ipcHandle 3180 -initialChannelId {6b8402fa-8949-4e64-b3e5-cb769e98be13} -parentPid 2472 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2472" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility4⤵
- Checks processor information in registry
PID:3036
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4624 -prefsLen 32900 -prefMapHandle 4496 -prefMapSize 270279 -jsInitHandle 4612 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4620 -initialChannelId {beebc100-8450-4bd9-9390-b9085f6940ec} -parentPid 2472 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2472" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab4⤵
- Checks processor information in registry
PID:6132
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5376 -prefsLen 32952 -prefMapHandle 5380 -prefMapSize 270279 -jsInitHandle 5384 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5396 -initialChannelId {61e75d83-b56b-4117-832c-5ad4b7b3794c} -parentPid 2472 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2472" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab4⤵
- Checks processor information in registry
PID:1776
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5608 -prefsLen 32952 -prefMapHandle 5612 -prefMapSize 270279 -jsInitHandle 5616 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5624 -initialChannelId {3b6e7fa2-5340-433e-8a4e-78afb9e2d5a0} -parentPid 2472 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2472" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab4⤵
- Checks processor information in registry
PID:1676
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3784 -prefsLen 32952 -prefMapHandle 3788 -prefMapSize 270279 -jsInitHandle 3772 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3940 -initialChannelId {415a5bb2-80c6-431c-b06e-16b82387da63} -parentPid 2472 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2472" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab4⤵
- Checks processor information in registry
PID:4120
-
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Event Triggered Execution
1AppInit DLLs
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1AppInit DLLs
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\System\symsrv.dll
- Size 67KB
- SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
- MD5 7574cf2c64f35161ab1292e2f532aabf
- SHA1 14ba3fa927a06224dfe587014299e834def4644f
- SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
- SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
- TLSH T17863F1372AB5807DDD210D37949F835AB771E5A76C20643FC25907D988B8DD0E3239AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\System\symsrv.dll.000
- Size 114B
- SHA256 aefc503b1ed462d7b6280228a7b5b710792273b78934426f88325341ac5b5a92
- MD5 e609411db8aa6775d0344c75c23ae79b
- SHA1 1d2ff6194bf159ce36cd0461cd3da29486d1e97d
- SHA512 6884ff5c07bc687132c965a59cb8c5a898a25da74c6c846c1d6089ddca8007cb7e4d2f8520bdce9fbcf6e2f9c9e5c28d8c8d6d049d3522470bdc7d38bbfa0ad0
- TLSH T1FFB09262AA2791EAE1AA224505A0248C1ED0B62AB48638002EBA5A4E93256A85916147
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uqk3a6df.default-release\cache2\entries\CD1C116DEEE8F4F97C1806976E10E7E2B349E486
- Size 13KB
- SHA256 a3f6db1ef913849292790f88b34f2aa3c52f92cebfc3ae8b4ba8e59f149ac750
- MD5 34e59dcc35cfda47f864252ac2d09307
- SHA1 9e0565ea74f497562d50cd255aabfcbe0541f4c5
- SHA512 73856936e7fb715efdf598f0ec23b553119ec771da1712b98d3ff4dfa01b35ef15e197c8b064687c5bd6d1e02f0c4593b176961634647832818f601e984d659a
- SSDEEP 384:HbaFrLiO024Y8Fuhw+5EL1pPsac4j0lpDII+oA+:7aAZY8FuK+5EB9sac4ID8Lu
- TLSH T1EC528E7E9F0138BA0B6BD294D9AA5304CE04E6BBEEE3D05605043844C784379F4F64EE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\792420d0-e3eb-4fce-be2c-6ef593d1d6e3.zip
- Size 3.7MB
- SHA256 614ce12a892bc6f616e1a9fede0e01314aa6c1dfa7b4d584c4bed48c8423085b
- MD5 0e7b28e44e920bea1c2247dd0506a717
- SHA1 3888e74ca031f00bb9361b6d93e470c54edc4fc6
- SHA512 1a63ebb747ca0bad30c81b44ffcf3913b83a0ed9b03d6418e9ef4ef18e66c6e41a984211bae31ad4a60c1b227d13da7d33ba9519ea250dfed3b9c68f4f29dc87
- SSDEEP 98304:mjbFqkFkwEV811z5EkH0pTaAnXSRVt077:O57sUz5EkH0pTaiXC077
- TLSH T11E06E075E69C1A39C9CFC3BA850C3FC2D84C4FA7805CA96F6A7E99715CB31E62B44844
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 11KB
- SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
- MD5 25e8156b7f7ca8dad999ee2b93a32b71
- SHA1 db587e9e9559b433cee57435cb97a83963659430
- SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
- SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
- TLSH T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 502KB
- SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
- MD5 e690f995973164fe425f76589b1be2d9
- SHA1 e947c4dad203aab37a003194dddc7980c74fa712
- SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
- SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
- TLSH T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\datareporting\glean\db\data.safe.tmp
- Size 31KB
- SHA256 be540d7d03c4286b13a32137d855a8d568a27ba93d063b1764c3ad34c4185a9d
- MD5 5b2c30ecf6c60f8a2b49d1ff1b863e6a
- SHA1 9de6de2098e2ac6733b06f57e9c4ac9a60550567
- SHA512 33f1cd7a236c51fd345c398a4f833d9eac2301dfab8c5febb8e2710520dc541d4b95095fafe980b9c51d7e125db0c4bd00dbc2773039b333cd340b28b5b1ab70
- SSDEEP 768:pYnGxK1TKNClGcmhu1vFKcJGYfDPbBbdbTbuvHEeci:pYnGA1TXvFYL
- TLSH T10CE21144FB2E953FC41512BBDCA50B002F79B889591A2F5B3A4C64686C872DC7E9E07F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\datareporting\glean\db\data.safe.tmp
- Size 31KB
- SHA256 4d5ffc1df591fc65406acc68491993e24598a137fea6cd56aeec53cd1aec6093
- MD5 e298b7f24ae351572fd30bb83bac45f7
- SHA1 0043c5f656c0d572acd97b35cad573b537983a11
- SHA512 63df699d4164b3dd230c13cf0356acfd74eb555ff0b2ee45fbc8c2144dc0d339220bd3dd482dd86e9cc33689033d39ce89bb3ba205e06038c2a3da7d68383d32
- SSDEEP 768:rcJYnGxK1TKNClGcmhu1vFKcJGYfDPbBbdbTbuvHE/:AYnGA1TXvFYS
- TLSH T1E5E21144FB2E953FC41512BBDCA50B002F79B889591A2F5B3A4C64686C872DC7E5E07F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 7af77b15aa4ab1f004386fb9d1ac076a7ca768672f284912291c07b80416a5a5
- MD5 991bb34e56e18368c3689eeee8d2e8b1
- SHA1 27dfc2663ae97d19b3cb1330adfab46eda7e6393
- SHA512 e79a21f80f3931d23fb93deb3c4614a5629eac7b293c2f42ee4a3f9e63ebf5afec42c93108e1d59f9f57801293171eb1f539efd586e3f3659a2a7a4a6b6992bc
- SSDEEP 192:81d66JozGzgCl6mc0dVOv5zbo9ZR4yjsI:md66JozGzgC1jAbo9ZR4yjL
- TLSH T125D10E28E629463BC458023BDDA61F400F76385BD89E3F19319C741D2D5B2CEBA8E17E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\datareporting\glean\events\events
- Size 1KB
- SHA256 8a54d4769697a599b03ba9d6aab62e9cabd41e5c209ce53e6785866ab2b61fa9
- MD5 7f38915a2d996e16c66c8252a5e00c01
- SHA1 dd9a9f0041b311522d7942a41a79b080f58a9c31
- SHA512 c3fd522f63dddd135139e52d9ab38d8eae7699b32318c8de5e0389563b2a435432e614b4771266f591dc2026dd189ab9853fe873f37c3439d885b0d5f0892d10
- TLSH T1B921789C39BC4D2AA8AAF7587455028EC3A54E0B48C71D434E42DE8DCD95EE9336A439
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\datareporting\glean\pending_pings\4b03eb28-4160-4ad8-85a2-4c8ba138e543
- Size 2KB
- SHA256 e52113c39799608ddcbdc2fc262e31ae62da913b0cb6247fbbf707a0922b6176
- MD5 ad63c68fadad6199220fba24afdee34c
- SHA1 8d89e1587631bf62b6eb0447be9e974d8fe12165
- SHA512 d48897a19451fadb6504fda57977ccf5e20ad2786bd1d02291bc7538d2f089e2c80c583ec2d366555931451470b7ba996f273ff6d264a356c7b12030556f5a04
- TLSH T1D541335C35784CBB9CCAF68DE092238E53A48A0350CA2C573E51DE0C8D966DE736B52B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\datareporting\glean\pending_pings\9abe1795-a4d3-478a-a4c5-6bf82a4c1439
- Size 883B
- SHA256 ee885fd8ef5bd1b9fbba9de278ccbf17633d6fce6b428c01164bdf421e71910d
- MD5 e2043299d04de4c19292fcac05c529a6
- SHA1 d835f11c7abd41302f5ad76162132d76acf0b52f
- SHA512 a8aaaf4714a9f79c7049e387f6bb520f9632cf8a19ef3a5aa328d84b0b225c19de2932fdc75301c247a405a11b1e1a2b5dfb3b509a2c45e8c01d565b11dfdc86
- TLSH T192110C81812A79A2CC68D24BC6A83B414BE87523C0CA45083EE15A180D7E01EE36B387
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\datareporting\glean\pending_pings\b690586d-8963-4529-a87f-ab140a43e696
- Size 886B
- SHA256 5e42f578df11385d3545ea422b78db14b117908217294c62ef122a5f2b5eb6f7
- MD5 0adc12f6983024ce9457ec8506769e49
- SHA1 54b149aa0d00f3dc7fc21c7a323a94e0996a3b9e
- SHA512 7a2cd08a43887b27f3d04c84d58354af8887990432ba857c8b136b5559de6c98e94c25094e3429e722e1ea9b0b87563ebf64a0ba0e6e9e2d7083d80be62f6b7b
- TLSH T185110041856679B28DB8C29BC6A43B814BE43033D0CA19087E915A180DAF01EA367307
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\datareporting\glean\pending_pings\ca762b31-dc93-42e1-983d-2d31cfa72241
- Size 235B
- SHA256 8cb1e86ae9a75bcffbdb66e91faa67c936767e8ddc01f6ec8c115fea796cadd9
- MD5 81b28c661b1848670cee52ff47cdf1df
- SHA1 71f75022174b790790aa01c6faefb1a27cead403
- SHA512 31d84cf566539c59d1e0cd041c8c56b71971307dca7cc3c390615bfd26fb6185a54ccbf60284bee0316b2e68797fe65c9984a016c33ae2f1b0784b9ad97fa987
- TLSH T11AD0979038E82BAD08000F0AF0A029E2348E4C3324B65C10CA61063AFEF89C8419281A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\datareporting\glean\pending_pings\cdffd9de-a4ab-44df-bd85-13e08fe1193d
- Size 235B
- SHA256 4e68c09285f8cddc0f0c122c0da89e61ae412ea64eac47f4a05593459700f35b
- MD5 f62a5b90c8b779a6cfef47ae7f5555e9
- SHA1 25e33b467e1236cc79de665383c0a8ee8aa2fcc2
- SHA512 f6cfe7fe36c39e328365be8a7ee735a1283ac44e3a3dfde4b6a9356e0b6ee5c08580082c8c6d284f9ec06689ae7e03ff944a180dd91fab8e8b666e9a2537e8fc
- TLSH T116D097802CE86B2C8C004F2AB0E12AEB30888C33207058249A5240B4D9F8DC9525181B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\datareporting\glean\pending_pings\d9361c72-1911-4fdd-ac15-1b26a01e40a6
- Size 16KB
- SHA256 3165d8646fa0d4674924a4bfa469e050991063b28211c8b2b8ea859632756798
- MD5 184cf1738e73263dc1383c930008cba2
- SHA1 40a43942731582d5a5c49d0eddbeb117a373d50a
- SHA512 9ac1428b7a5da90c713bb52fad9b79716d6056a53d2e696bd2aaca65ee0a356a35f139aaeb5f3fe1327479e6c5fa71476fa987bbc4d9bf0e18b76ead9ba54eee
- SSDEEP 192:tvesRRotzZiD7uk8lxJcf1dIsJQouB+1VKmPUSr1k0JgFNFBgaHTLG0S6PivcrX1:tvxRRotliD7uzyYsaARUoyrGmlwPOkg
- TLSH T19872C9561820497A8291E36895FCBFC3E6F538CB4C419FC99BE0BE482DDE06E112794B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\extensions.json
- Size 16KB
- SHA256 1ef0bbc4bbe43579f858900df9d773bc3e9f83ebb87de82e401f20174d9aa200
- MD5 f88d6315c6ff62d2810fc55b907c82e8
- SHA1 c8685ad0a47d44b01162f393412ff8eb4c21d34c
- SHA512 d38af0bdd5d606747184903580f284b3c507b12fac8aa4d76f48d7b30c26f1dd643c1aefa1573507d5edbbaba620602574848b3ee4a596a5cbbce4f57d08c62c
- SSDEEP 384:L+kI4vmUmldvV8dhWHW94zc96oML4HLL4PSL4HSL4HlL4H+D4hC:LxI4ORfGXK04k6x434o4A4l4w40
- TLSH T19E72321545049EB8294F979BAA36BE01C37D473B60845C78F4DD8FC802FA5B902FB65B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
- Size 1.1MB
- SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
- MD5 626073e8dcf656ac4130e3283c51cbba
- SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
- SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
- SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
- TLSH T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
- Size 116B
- SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
- MD5 ae29912407dfadf0d683982d4fb57293
- SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
- SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
- TLSH T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
- Size 1001B
- SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
- MD5 580786a5ec9eb650dde3e0e75db8588a
- SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
- SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
- TLSH T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
- Size 18.9MB
- SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
- MD5 15fa9ea03f6f451d587b1dabb2f7b036
- SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
- SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
- SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
- TLSH T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\prefs-1.js
- Size 8KB
- SHA256 a2d69c13ec90aab3df172aa1142814284e451fb40b52f5ca7592db5c4abc9a07
- MD5 b0bd2d6c60e0b88e33eab7a8c9f907a3
- SHA1 6226060c2243379067bf633a832b8fbb66835306
- SHA512 d11f1462294ebb6e553a8a94ff101b0439bd7d8f40b33d312c67abcb5ab3013d1060e5fb220a227e95570d860872742be4744634acc36e3d48cce26134c946d3
- SSDEEP 96:xHSrxTU5QqGq0fjEKObzSdSSl8pdv9jgn1WRn2ce4Bw88FQ2N8L4cn48gmg:4rYbR0fjEKnSSGJR2ce4Bw88/ci
- TLSH T13402DD785004CF6F74B637ACAC2949705A72013BB7BF68D611B994C5450CF3492EAAEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\prefs-1.js
- Size 12KB
- SHA256 fdab9f43637f886ca850d9f83d071f538628b7aaa7c999d6610fd93b6d8168c1
- MD5 601ca1c2f93b2e0abded1d7b0af2eb08
- SHA1 d24b3a5cfc9a9a47737de5255d939b2c870de9a7
- SHA512 17e3f2361d4b1f874d1aeede4c5533c87507bbf2b4e523c0e148ee64fac48b59ca507999c6fafe42a07e44ce2d5a266da593e9d983a13adba446d5bf1bf067da
- SSDEEP 192:SrYbR0fjEKnSSGgLR2cexmmBw88g90BSjcF:CG4R8FwoVwF
- TLSH T15842CE7850448B3F74B3367DAC2E4DA05962412BB6BFBCD706F994D1480CF2492E6AE7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\prefs.js
- Size 6KB
- SHA256 b7e20f1ed6e185b36fe950ba3e0373bb0b6f199746c7b0db1b6b68242fe7f235
- MD5 22b444b785160c61e444ff207414991c
- SHA1 d8aa2fb3731db1e3e3c46e2fa7f992e4b932c467
- SHA512 7930c42b75b3bd9749df9904779e01c51c6bcd514767762443ba59c083b2bd4f87e07427f6d722e8daa648a87eb3085133cb5d306d01301eef07ce879fe1605e
- SSDEEP 96:xHSrUTU5QqGq0fCkKjanjLM1zSpgISSl8pdv9j/9Cn1HacetBw88n8L4cn48gmg:4rJbR0fCk13MogISSGJ98acetBw88yi
- TLSH T102E1407890188F6F74B6776CAC688C706AB2413BB7BF68C750B69484011CF3442F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\prefs.js
- Size 6KB
- SHA256 f6dd963141616d251ff8d616829cbeb8d676d1ac9fd12a04f7e037816c584135
- MD5 9404cb667e7a47ce9576d0060d3bd79c
- SHA1 c84812dc1d11c9124c6693fd087704f20786b004
- SHA512 9ebcf32408a2b27ec0c2dc53c93a03dd543dc7a9b9678a1697ddee1b0ee6e3c0d2e29c84515419315c55ec736c47ae02cb793ae6c819a2fa2c083e1514d2ead3
- SSDEEP 96:xHSrUTU5QqGq0fCkEK1zSdSSl8pdv9jgn1HacetBw88n8L4cn48gmg:4rJbR0fCkEK0SSGcacetBw88yi
- TLSH T1B2E12F789018CF6F74B6776CAC688870AAB2413BB7BF68C750B65484051CF3442F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\sessionstore-backups\recovery.baklz4
- Size 4KB
- SHA256 f0d21ddf6dfa841203b9dca64096ee98d26c94d0c0fda0ec26b5349cf3ee9a1a
- MD5 6f820061c0365600afb73ea352febffe
- SHA1 4426bb69be0ca762f1fec3c2f86faa006ad5ed45
- SHA512 10c5d82754f8851015418e538a1689c8465d928eff1cd549ba5f911a7e57c2b8ad96413da2204e7d3a546d11e6213a2cb153de4d6603703d17af1950834f932b
- SSDEEP 96:etfgynWop8BCHQeW9jILA0NjoB8kMJttn0YJZQB0Z:wgcN8qIOnNcB85JttnTZE0Z
- TLSH T199917E02330F7863FE57859FEF558CF145F9300A498188E890CF3A2AA76BB4B75440B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\sessionstore-backups\recovery.jsonlz4
- Size 4KB
- SHA256 9a77553dae3afdea6b1896a1085343dc3a2adfc8b289f4b2d36298c6657f40f8
- MD5 4ab0d71ea6275dbf9de93fc74153918c
- SHA1 38a2e0a5c683aee06cd9bf2d9e52a2fe0845050c
- SHA512 0df3eb1295bd8312d7f0e8c81e9ad28ff017602480f12e6633dafdbdf06d1dae4ecba82ebcf6f1e15fbaa8efb948d78224e1a4f4174d67259eba756b070dd60b
- SSDEEP 96:etfgynWop8BCgQeW9jILA0NjoB8kMJttn0YJZQBuZ:wgcN8PIOnNcB85JttnTZEuZ
- TLSH T1CF916E02360B7853FE5A859FDF558CF145F8300A498188E890CF3A2AA767B4B75494B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uqk3a6df.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 10.5MB
- SHA256 8100c08c829eea21411afa70f948a871263628f49aaddf01aff254a9303fd2cb
- MD5 f2ef440ddf56852b9717eb0dd651d695
- SHA1 92fd68aff76925793d7443cde13cd2025eb79e91
- SHA512 f69c78cd49f454f148592a25d74b045fba19824fc4937634437ccc465aec8ea664b9af0ff7a57c35950a3d9d900e5ac03c666a6fc011963af8b7bec3a7b907fe
- SSDEEP 49152:cOkoRVaAIoW8zN6wlpFJIlxyGg5s4iSxM7fltufPICnz8KguG0nOypL5TKJrsZEF:TEURlK1sZEJOfCcFpO
- TLSH T18BB66B9170E0D692EB4186F7F35F13DB317FC18C20A5C98007B8AAA868565DBEE5F364
- MD5 SHA1 SHA512 SSDEEP TLSH