floxif | 87ded20b2da7f4b97b26a55f8b29d6dbc9e6c1757d622de38f50b79d45602d81

Analysis

max time kernel
149s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/04/2026, 15:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
Size 5.8MB
Sample260417-sfclpsc151
SHA256 87ded20b2da7f4b97b26a55f8b29d6dbc9e6c1757d622de38f50b79d45602d81
MD5 db7ada8413ddc45ca2da9c3655b0511e
SHA1 24262fe74255dc456f0b988c6506d7b2e7b5856f
SHA512 a3e605997e158b27a1d50ec8c34e844054fb0c7b978d5bcfa6e7c9db4e8276953bd0ae2cd6dec629ccac4035668b412666e8f13ec3d48b105dec7be9e561f027
SSDEEP 98304:JKGyuXkhrfbsMufe1NP4PuK18frP3wbzWFimaI7dlo50:Tcrfb2+tgbzWFimaI7dlB
TLSH
T142569D51BF8CC17AD95A1131172DAF2A402ABC98773465D3A2743E7EEC763C22C3961B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware backdoor discovery floxif persistence phishing privilege_escalation spyware stealer trojan upx

Malware Config

Signatures

Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/files/0x000500000002a738-1.dat	floxif

Custom signature

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 3 IoCs

resource	yara_rule
behavioral2/memory/3440-14-0x0000000000F10000-0x00000000014E1000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3440-399-0x0000000000F10000-0x00000000014E1000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3440-413-0x0000000000F10000-0x00000000014E1000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Custom signature

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 3 IoCs

resource	yara_rule
behavioral2/memory/3440-14-0x0000000000F10000-0x00000000014E1000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/3440-399-0x0000000000F10000-0x00000000014E1000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/3440-413-0x0000000000F10000-0x00000000014E1000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Custom signature

UPX dump on OEP (original entry point) 7 IoCs

resource	yara_rule
behavioral2/files/0x000500000002a738-1.dat	UPX
behavioral2/memory/3440-3-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/3440-12-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/3440-15-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/3440-20-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/3440-400-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/3440-760-0x0000000010000000-0x0000000010030000-memory.dmp	UPX

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010
A potential corporate email address has been identified in the URL: [email protected]
phishing

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000500000002a738-1.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
3440	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe /onboot"	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000500000002a738-1.dat	upx
behavioral2/memory/3440-3-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/3440-12-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/3440-15-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/3440-20-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/3440-400-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/3440-760-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
File created	\??\c:\program files\common files\system\symsrv.dll.000	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies Internet Explorer settings 1 TTPs 22 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Low Rights	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe"	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe"	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe"	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm"	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3"	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3"	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243"	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3"	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe

Modifies registry class 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Model = "106"	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter"	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Therad = "1"	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1"	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe"	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan"	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User"	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3440	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
3440	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
3440	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
3440	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
3440	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
3440	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
3440	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
3440	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3440	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
Token: SeRestorePrivilege	3440	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
Token: SeDebugPrivilege	5108	firefox.exe
Token: SeDebugPrivilege	5108	firefox.exe
Token: SeDebugPrivilege	5108	firefox.exe
Token: SeDebugPrivilege	5108	firefox.exe
Token: SeDebugPrivilege	5108	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
5108	firefox.exe
5108	firefox.exe
5108	firefox.exe
5108	firefox.exe
5108	firefox.exe
5108	firefox.exe
3440	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3440	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3440	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
3440	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
3440	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
5108	firefox.exe
3440	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
3440	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3440 wrote to memory of 3352	3440	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe	79
PID 3440 wrote to memory of 4896	3440	2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe	80
PID 4896 wrote to memory of 5108	4896	firefox.exe	81
PID 4896 wrote to memory of 5108	4896	firefox.exe	81
PID 5108 wrote to memory of 564	5108	firefox.exe	82
PID 5108 wrote to memory of 564	5108	firefox.exe	82
PID 5108 wrote to memory of 564	5108	firefox.exe	82
PID 5108 wrote to memory of 608	5108	firefox.exe	83
PID 5108 wrote to memory of 608	5108	firefox.exe	83
PID 5108 wrote to memory of 608	5108	firefox.exe	83
PID 5108 wrote to memory of 608	5108	firefox.exe	83
PID 5108 wrote to memory of 5472	5108	firefox.exe	84
PID 5108 wrote to memory of 5472	5108	firefox.exe	84
PID 5108 wrote to memory of 5472	5108	firefox.exe	84
PID 5108 wrote to memory of 5472	5108	firefox.exe	84
PID 5108 wrote to memory of 4288	5108	firefox.exe	85
PID 5108 wrote to memory of 4288	5108	firefox.exe	85
PID 5108 wrote to memory of 4288	5108	firefox.exe	85
PID 5108 wrote to memory of 3868	5108	firefox.exe	86
PID 5108 wrote to memory of 3868	5108	firefox.exe	86
PID 5108 wrote to memory of 3868	5108	firefox.exe	86
PID 5108 wrote to memory of 3868	5108	firefox.exe	86
PID 5108 wrote to memory of 1480	5108	firefox.exe	87
PID 5108 wrote to memory of 1480	5108	firefox.exe	87
PID 5108 wrote to memory of 1480	5108	firefox.exe	87
PID 5108 wrote to memory of 1480	5108	firefox.exe	87
PID 5108 wrote to memory of 1424	5108	firefox.exe	88
PID 5108 wrote to memory of 1424	5108	firefox.exe	88
PID 5108 wrote to memory of 1424	5108	firefox.exe	88
PID 5108 wrote to memory of 1424	5108	firefox.exe	88
PID 5108 wrote to memory of 5936	5108	firefox.exe	89
PID 5108 wrote to memory of 5936	5108	firefox.exe	89
PID 5108 wrote to memory of 5936	5108	firefox.exe	89
PID 5108 wrote to memory of 5936	5108	firefox.exe	89
PID 5108 wrote to memory of 2556	5108	firefox.exe	90
PID 5108 wrote to memory of 2556	5108	firefox.exe	90
PID 5108 wrote to memory of 2556	5108	firefox.exe	90
PID 5108 wrote to memory of 2556	5108	firefox.exe	90
PID 5108 wrote to memory of 4860	5108	firefox.exe	91
PID 5108 wrote to memory of 4860	5108	firefox.exe	91
PID 5108 wrote to memory of 4860	5108	firefox.exe	91
PID 5108 wrote to memory of 4860	5108	firefox.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-17_db7ada8413ddc45ca2da9c3655b0511e_darkgate_elex_floxif_glassworm_remcos_stop.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Windows\system32\regsvr32.exe
  C:\Windows\Sysnative\regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  PID:3352
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
    3⤵
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5108
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1980 -prefsLen 27097 -prefMapHandle 1984 -prefMapSize 270279 -ipcHandle 2060 -initialChannelId {b0c5b9c7-efc1-45ba-afeb-448b87e42b66} -parentPid 5108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5108" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:564
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2440 -prefsLen 27133 -prefMapHandle 2444 -prefMapSize 270279 -ipcHandle 2456 -initialChannelId {0c6d6a06-3a97-48f0-8a9a-e0c6db191284} -parentPid 5108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5108" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:608
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3816 -prefsLen 25213 -prefMapHandle 3820 -prefMapSize 270279 -jsInitHandle 3824 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3832 -initialChannelId {b4f88bf4-ebc0-492f-b31f-cca955327677} -parentPid 5108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5108" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:5472
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4020 -prefsLen 27323 -prefMapHandle 4024 -prefMapSize 270279 -ipcHandle 4088 -initialChannelId {292c3f50-238c-45e9-a31d-0ff658bf0cd2} -parentPid 5108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5108" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:4288
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2764 -prefsLen 34822 -prefMapHandle 2732 -prefMapSize 270279 -jsInitHandle 2768 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2628 -initialChannelId {514a6aa7-632f-4ece-ae82-9f340df43adf} -parentPid 5108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5108" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:3868
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5064 -prefsLen 35010 -prefMapHandle 5068 -prefMapSize 270279 -ipcHandle 5024 -initialChannelId {31b3b330-8e63-45bb-a7aa-d03f9f8fde8a} -parentPid 5108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5108" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:1480
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5344 -prefsLen 35062 -prefMapHandle 5348 -prefMapSize 270279 -jsInitHandle 5352 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5360 -initialChannelId {49ebb3b4-7265-44d0-91c3-52b5dc161433} -parentPid 5108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5108" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:1424
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5496 -prefsLen 32952 -prefMapHandle 5484 -prefMapSize 270279 -jsInitHandle 5480 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5540 -initialChannelId {23339112-73f5-4b78-864a-698472856a87} -parentPid 5108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5108" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:5936
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5704 -prefsLen 32952 -prefMapHandle 5708 -prefMapSize 270279 -jsInitHandle 5712 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5716 -initialChannelId {125d3655-17c5-4e48-8adf-8719f0136e60} -parentPid 5108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5108" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:2556
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5352 -prefsLen 32952 -prefMapHandle 5544 -prefMapSize 270279 -jsInitHandle 5900 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5908 -initialChannelId {eb70df1a-c3cd-4a94-a55e-0820af08bbb6} -parentPid 5108 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5108" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
      4⤵
      Checks processor information in registry
      PID:4860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

symsrv.dll

Path C:\Program Files\Common Files\System\symsrv.dll
Size 67KB
SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
MD5 7574cf2c64f35161ab1292e2f532aabf
SHA1 14ba3fa927a06224dfe587014299e834def4644f
SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
TLSH
T17863F1372AB5807DDD210D37949F835AB771E5A76C20643FC25907D988B8DD0E3239AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

symsrv.dll.000

Path C:\Program Files\Common Files\System\symsrv.dll.000
Size 114B
SHA256 aefc503b1ed462d7b6280228a7b5b710792273b78934426f88325341ac5b5a92
MD5 e609411db8aa6775d0344c75c23ae79b
SHA1 1d2ff6194bf159ce36cd0461cd3da29486d1e97d
SHA512 6884ff5c07bc687132c965a59cb8c5a898a25da74c6c846c1d6089ddca8007cb7e4d2f8520bdce9fbcf6e2f9c9e5c28d8c8d6d049d3522470bdc7d38bbfa0ad0
TLSH
T1FFB09262AA2791EAE1AA224505A0248C1ED0B62AB48638002EBA5A4E93256A85916147
MD5 SHA1 SHA512 TLSH

Submit Download

CD1C116DEEE8F4F97C1806976E10E7E2B349E486

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ljuooy03.default-release\cache2\entries\CD1C116DEEE8F4F97C1806976E10E7E2B349E486
Size 13KB
SHA256 b21bf1620998f0503ca1e4756a70844fa46ee4158f914cf499ae034e7aca6b20
MD5 b1878effe0b882896954663d9242c758
SHA1 85c1a87ba5cf96bf2c596b150b286a91f66e2854
SHA512 019d56af87cc649ef445e18e23550cb3ba745f56a14601045c6b9d96f4e074a7ff0dc486acde76787345d20bac3f108172590fa53559152bd34ef9bf46b5d556
SSDEEP 384:HbaFrLiO024YAFuhw+5EL1pPsac4j0lpDII+oGO:7aAZYAFuK+5EB9sac4ID8LQ
TLSH
T164528E7E9F0138BA1B2BD294D9AA9304CE04E6BBEEE2D05605043845C6843B9F4F60DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\db\data.safe.tmp
Size 30KB
SHA256 b53926ae4f0be489d5f9aae4d4ac3134b83892541e0ffcc118baa599deeda445
MD5 a439fb57ef36d75c886c2c7c0cdd185f
SHA1 b9b978e42f202de05c69887ec5e34e96b418534d
SHA512 7efd04f0cd53be2b1ec161eb4091adb3ae573dfe7a947a4cf93b80823f5c9c27f8bff05b99e6b77cad5016a14d76a481c2c77d492d2ab4cd0e79b171ecc14748
SSDEEP 768:eYnexzDIVLLGcmhusoRoG5Eotbhb6bfbyTm/:xexzsqoR4
TLSH
T1E8E20244EB1A953FD41812BADC9507042F79FC8A59092FA73A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 037d6fbc79c178a8c5a38b38d34989433f06f123d6143d830883927c17ab7e48
MD5 40f612c596505b8f1bc29c8e317911bc
SHA1 d9de60e6f65d8d98375549ea76dafb8b2f69a821
SHA512 d3b7f3a137b161c0c778be5d643200f5667a01c0e02d090fbb0b9bcbc610ce2d7ac382aa731260ec6c7fc9f3d9971e3ff90222ac0bd9876fc5d4a103bf1da646
SSDEEP 192:sOv5zboH1l9yjRS+1/66Joz0dzgCl6mc0dz:PboVl9yjH/66JozQzgC1jd
TLSH
T199E10F64E629863BC448527BCCA61B441F3A388B9C8E3F2935DD654C2C472DD778E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 120e9c9386181a1098d594f2a1ea0095e2231e8ef8d57ab5d11e130d9624c7c4
MD5 c0cec5a6d34cd247ccf2a5e9e1ac3dd7
SHA1 58a462bcce2857abe778b0717ead184d344acc70
SHA512 e8fa7421da84e3948699ef3567cf28ca8f706d9c414b1cbca1264c17b18607cce195823ec7cfa7dbb289323fb043fcdd50c89946c966d64824bce1f8d9cd6024
SSDEEP 96:9SdF95/7bkW6QXjrcPyUR6rWZGF/QFMFoFaFm/dd66Joz0dzgClKtmc0d/U:9Ov5zbooCyjCn1d66Joz0dzgCl6mc0d
TLSH
T1B1B1DA28F629463FC458423ACCA21B401E36384BD85E7F1632EC74493D6B2DD7A8D1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 6001cdce2d387998ef685dad15096da77407ece4a005d70686ee41e08f00377c
MD5 59ddad2b408be2523510c1b809e0dda4
SHA1 a0d95ff5ac0cdb134a2803e0158b973f72396cb7
SHA512 28f14d46f8dace0c607a3628fda89811c24ed781f82d945fe620afb3209e4196af3a933b16e38871a7a970973a831ab5a241f4694e931e5c1afcf7cc2d83e155
SSDEEP 192:I1d66Joz0dzgCl6mc0dwOv5zboHdZl9yjR6mQ:id66JozQzgC1jBbo9Zl9yjcz
TLSH
T18BE11D64E629863FC448137BCCA61B401F3A395BD84E3F2935AD61482C5B2DD378E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\events\events
Size 1KB
SHA256 8f934c8366511dde76193411485b5278355b8a1b9e396d0e4cd7e27335b81ab1
MD5 13799b58ec632b90f4b4c9b9a1455d77
SHA1 c7e19b634cb137415c41c21527347f5b35874b37
SHA512 f3f0b91352676747bc71ab449966e23991bf687e2cd120a8a3584be8548a2fb908f17e08b97801592cd4321c97e4f29193d004493671b65a2147006770b87c5f
TLSH
T13131495C39B84D6BAD9AE2AC7446138ED3618A0A48C71C434E52DECDCC85AED726A478
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\events\events
Size 4KB
SHA256 3ccbd680e3e825c32468e0c8cecdfce45fe9d549bbc60e3523186bb5085cc2d5
MD5 c4f54fdff6093ecc20cc7a5c40f6e43d
SHA1 26b9f256c4d7b4c32940c71180d9740e1f43f004
SHA512 286847162424e17a431f75b08aea3c224b171e28e9c8708bb31005c369e6d213223d90d00d7a1ee5f8dde842c7c434f058897b606eb0236ecf6061125818064e
SSDEEP 48:YJe2uApdiRoXqKFSx1Os29mV1MPkgT1Ij/l1T4zMzufEJ/VGSlfb1a8qMrZDuNBE:bz2RAEzIcENcSlOfLvsp9
TLSH
T110A1DE0D26680C7F6C97E26CB80517C992E2CA4A98C71DD38E9BDD8CCC9999C725F439
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1b77ff30-afcb-416e-8478-d4aa54ec83e1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\pending_pings\1b77ff30-afcb-416e-8478-d4aa54ec83e1
Size 2KB
SHA256 a27b317a53aa7d013ab87d5c9719896b4aeb9e5398370f25c5fdcf81fabebd98
MD5 0e152e6ccec4dd54e241df6071b373c8
SHA1 7b308216bae2f04824e987bddf5f5e97cd5037f4
SHA512 f896487d7f7bcabaf98b27283da2682e9563d55c3825ec452bf9eac6734d6e9a075a65d33f8d396b890357059f03c23a69846fea9e63cb985d28839d34dc1383
TLSH
T16251735836785DBA5DCAE59D9482338E63B4CA0340862C935E52CF0C8C966ED736EA1B
MD5 SHA1 SHA512 TLSH

Submit Download

6d5ceb49-4ab6-450c-a653-fdc5e6d3a307

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\pending_pings\6d5ceb49-4ab6-450c-a653-fdc5e6d3a307
Size 883B
SHA256 cd6c00f23c98566aca8c4bb4d04c02c13a407fa87eb53505fef60a463710f29e
MD5 4ce83e2995250711e56d206d448984b4
SHA1 1e1a175d514a775b400f74f4d40181a86451c3f7
SHA512 ade2f0d1267f3f7553fff5ac96557f01081f2abf60f9b32dc470a9c30522d536694c5bd8ef5107bc590ea87d73c8dab270027f0e1fe95923a79bb27c389ee95b
TLSH
T192110C40E330BDB2CC7CD29BC9927B059BF47523C4CA94187EF55A040D6A52EA7A6A4B
MD5 SHA1 SHA512 TLSH

Submit Download

7159b34e-7b63-4d17-95f3-6e9634945fbb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\pending_pings\7159b34e-7b63-4d17-95f3-6e9634945fbb
Size 235B
SHA256 790766358b16b5d7dc5ffd6b360a3efe59944cc9fdd85a4db0eb8421e290c80f
MD5 104db69956a0656cdf7774cef66f5d41
SHA1 96307225be6f4697915fa264f69982eebba5e169
SHA512 f5b7cdefaa543f0e5559281707667d6fbe8e14a55bd7c3f564be63c1e5c5d49a88539ba5be247bfaef2c40922c99b47395b87c9d47eebb31b3330468754cd0f1
TLSH
T155D097A01898276C08244F17F0A02EC730864C333072A810CA620034CABFACC2221807
MD5 SHA1 SHA512 TLSH

Submit Download

829a785d-61cd-4203-9aa9-f9a2b2c7ce0d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\pending_pings\829a785d-61cd-4203-9aa9-f9a2b2c7ce0d
Size 235B
SHA256 ca763ae8bd77a58b058f437c6e7c6475feebfc038cb11462b50b87e4129b02b7
MD5 ec433b6926791fb9e4eb7d16600c6168
SHA1 a1c84a418f812c7dc31b3cc2f8dda969bed6ec27
SHA512 d1fc5c47d71317ef41de3efe26f3a6416d5a59ffe79dc21eedfc23672d6e122948b68385e4b63d738c3829e229e6aa0a74728d144c5380ef1af867515a4a0439
TLSH
T183D097801498676D0C040F07F0E0B9C330864C3320B89850EA52083C9DBBEC40272916
MD5 SHA1 SHA512 TLSH

Submit Download

bf9aa45e-4820-45f7-b287-dee64052898f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\pending_pings\bf9aa45e-4820-45f7-b287-dee64052898f
Size 16KB
SHA256 088954294f240f907eb49606a2493e2da15820702c80248ca3396e143b3ba304
MD5 8489349018a3147fcbe0fe4310ba425e
SHA1 9b747d80acf3d5061902779c5a43d6dbf9d3f8f1
SHA512 13b77a3b84ac4d3d562dbce1e9a72d2889c0459a21241d43d2fb5197221babc6b97f6e23c1ed7b93bd2a5ffebba2ac4fc60e224132498aeb11eee3e4f63c2c25
SSDEEP 192:+u1v453WDJN0bmQIdebZ9zxAuSy+X9Hc8BGLtSw5Gg1lNLGprinp9ENHu31iBA8t:+u1AZk6eebZ9lXSyB9ENVdDVeKx
TLSH
T13472B956582049BA8251E3A894FC7FC3E6F528CF4C418FC99BF4BD086DDE46E512784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d4090a7a-d269-4d2b-8d4f-b0a135225b6c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\datareporting\glean\pending_pings\d4090a7a-d269-4d2b-8d4f-b0a135225b6c
Size 886B
SHA256 f8c8b81e0a4074cea0d9ff9752bd07a71bbbef1b2b7a3e7387bd53d9a744b542
MD5 2ae288af422da7268b7b373665474621
SHA1 6484a9b8129f7fa5bf1b75b79833df450515d7bc
SHA512 e5b6762605d77c0975e237c8bf963e861f973df85f552d9276e7667fb3cfb4a63035b000237718b1bd4bca29ce9fafe93671371b4a825870c9a4fe3ed7e69e5e
TLSH
T1E0110040D630BDB2CD6CD2DB8992B71197F47123C0CA19287EE45A040DAA12EA352B0B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\extensions.json
Size 16KB
SHA256 0880f650e444d6b7b3833c579b3ce5f590011c108e6b719d17d29e6fa289c190
MD5 ef91205f00a602d53d0a92e381b4bdac
SHA1 60e9dcd540c91a174b60b9424ebff20b8fa37e38
SHA512 e9b14121ae662eb3e12ce6acc3c4b2004113e71cca6cac33eaa34af07b9ce545de98b8f541a77abf57ea9a18ed59c5b6199bf5217da7408777232ee0af72ca6a
SSDEEP 384:DkI4vBUmldvZ8dhWi94zI96oUL4HjL4P1L4HZL4HXDL4H1/4hi:AI4pRfqXv4A614v4d4x43v4J44
TLSH
T1E172541545049EB8294EA79BAA367E02C37D473B60845C78F4DD8FC842FB5B902FB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\prefs.js
Size 6KB
SHA256 f4e8ad5626d2ccaeea6e2682d93d68def580c6f503eb3d2faedb222b7184d78f
MD5 9e71166c0f8a8b182922e07a9216fe3c
SHA1 c00aba28f589a48cb7a3f2e0d21f21cc3449e6ba
SHA512 3da96ee2b0ac788b15e9db444a8f2b9d89ea0f7479f9735407ecc5f5023783bb341ebc436b938db10e31fb9b4b332a1370f1a78e5d8e64d46b9de5ccd93f44c9
SSDEEP 96:xHX9UTUq1qGqafuc/q1zSbSSlIdv9j/nlHw303tBw88H8L4cnQVJ:d91Rafuc/quSSkw303tBw88B
TLSH
T1F4E11F7890488F7FB4B6776C6C6888319AB2413BBBBF68C750A544C5050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\prefs.js
Size 6KB
SHA256 bce95a16a8c45014833b85888cfc5d71b80c8b44826a02667553d3d9c11130d8
MD5 a8386e39df6de9a3dafa96e3f96c401b
SHA1 d311171881b22ca7fde3890e842fc42eca2df7dd
SHA512 f3d34ce71031ac343912fff8c75531243212041fbb686ce914774d1d85ba537fc18acf7b5a08702e19096f356f7e4ed1376ab918eb9ce5e5ffab153aabed8c5c
SSDEEP 96:xHX9UTUq1qGqafuKjmnjv1zSLS6kSSlIdv9jxnlHw303tBw88H8L4cnQVJ:d91RafuNDcS6kSSCw303tBw88B
TLSH
T19EE12E7890088F7F64B6766CAC6888716AB2413BBBBF68D750B544C4010CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\prefs.js
Size 7KB
SHA256 0393e7d38a9a6fe01275adf8d0fc4ab725867c1a4eb4b5f980a5489f149d22de
MD5 1a6a04104a9a78d461e14468609a4183
SHA1 0a32d2968f0c1bdbb82b4a9ff4ddefc50e04dbaf
SHA512 7ea4d52585668ced7cb47121bae4fabb15cb093094079e703cd1829c4a5d3e4a48ce27f76c4b6a1b1aba60a87f44074e87b8edf5a59cdd5b2db389fe7d704f96
SSDEEP 96:xHX91TUq1qGqafuc/qObzSbSSlIdv9j/nlHw303wBw88x8L4cnQVJ:d9MRafuc/qlSSkw303wBw88r
TLSH
T131F1EC789014CF7FB4B6776CAC6989709A72013BBBBF68C710A944C4050CF3452EA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\prefs.js
Size 8KB
SHA256 9957420dd34a913e1673ca4e18ed5b6b798fe8c856f15a8c4b604f0745614d7c
MD5 1ad8a47c6a32132b156af245c25c0852
SHA1 3f219864cc8181f772eedd121c5f01962e225dfc
SHA512 a1aa60970cffd0deb11e103d1351bf8fe036a5a0107034d9441c3a5f0a1a51d1498b1bacfad78e110e92222896fc9e1dd9590f3e22c3d0f3d6a134ece9095d84
SSDEEP 96:xHX91TUq1qGqafGc/qObzSbSSlIdv9j/nlWRV8303XQEBw88U8K98L4cnQVJ:d9MRafGc/qlSSBRu303XbBw88GX
TLSH
T1BF020E385004CF7FB4B6376CAC6989709AB2013BB6BF68D711B954C5050CF3452EAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 616278b7efea25c3ac6655047164d1603a5955edc1a8e647d0c24818b1d66ae7
MD5 eb4ba2fd380953b5d85c324c25eaefbb
SHA1 36e22f53a8d4d935986a7efb526be4988c419b9d
SHA512 f8f12e2efbff5092b1fcd646213a762bb3e232c103a4106752c0cab3677e719603db594fd733dda244a63062bde1b690ff440d8560dafac04eae133260051f3b
SSDEEP 96:eLfE69JuLIrZzeQeW9jILA0NjoB8kMJttn0YJZQB4J:KH9EI1aIOnNcB85JttnTZE4J
TLSH
T1C9917C063B1B28A3FD5786CFAA4A4CF145B4300E9C8048E880CE6A15B66BF0B3659476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ljuooy03.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.2MB
SHA256 52bc4f7f0ca621e9235bfde8199be5c80be0fc11a5bc439cb9f75c9c4f64669c
MD5 c286a5f202fbf57e8cb8b58d84aa9bd6
SHA1 bbfae4337620cdb990a9faa387d2703e47826f5d
SHA512 c10a8e72b3ccf69413e49ba02aba34a425046aada31b72472545fe4350f08e0c53465ff1213a2edf68185015b9f9311b310b0a4fd9290409105ac8bb98e592e6
SSDEEP 24576:xE+OO/IgzrJ4rV6lZYDyrRLvcMIrQwxOWlr3zt:xVbfJk6kDyrRjcMIrrxOwr3z
TLSH
T1ABF52AF820D2B357F3418033A64553EB21AFD00CA467DE044BA956E995B8CEF9E05B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3440-5-0x0000000000F11000-0x0000000000F12000-memory.dmp

Download

memory/3440-12-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/3440-3-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/3440-413-0x0000000000F10000-0x00000000014E1000-memory.dmp

Download

memory/3440-399-0x0000000000F10000-0x00000000014E1000-memory.dmp

Download

memory/3440-400-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/3440-401-0x0000000003690000-0x00000000036F4000-memory.dmp

Download

memory/3440-14-0x0000000000F10000-0x00000000014E1000-memory.dmp

Download

memory/3440-16-0x0000000003690000-0x00000000036F4000-memory.dmp

Download

memory/3440-15-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/3440-20-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/3440-760-0x0000000010000000-0x0000000010030000-memory.dmp

Download