floxif | bbb2971863ca653fe58bd4fbd4b8132f4b5a7a1a8c2660c535879329e7f8dfe0

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 17:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
Size 5.8MB
Sample260720-v79rmabw5w
SHA256 bbb2971863ca653fe58bd4fbd4b8132f4b5a7a1a8c2660c535879329e7f8dfe0
MD5 6083a923cfcc57a2ffd7995f82b8bcad
SHA1 8a3356f869743e5f2c7553357a76a8f6f72aef7f
SHA512 54aac8653d7f8185292f315a0ad492f96a88a987da78ae67bea421175c2e2523bebb831a7c889c595b8d995129489708188f5620c4d45cfc5d56019cbd7c30d1
SSDEEP 98304:HojsD67sM1mzpB3D1P4oF18frP3wbzWFimaI7dlo5:asM1m1BDD+gbzWFimaI7dla
TLSH
T13D569D52BF8D81BAC91A1131472DAF2A4029BD68773856D3A2743E7EEC713C12D3971B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware backdoor discovery floxif persistence phishing spyware stealer trojan upx

Malware Config

Signatures

Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/files/0x000a000000019cb8-1.dat	floxif

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 4 IoCs

resource	yara_rule
behavioral2/memory/4624-13-0x0000000000E00000-0x00000000013CB000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4624-340-0x0000000000E00000-0x00000000013CB000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4624-400-0x0000000000E00000-0x00000000013CB000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4624-718-0x0000000000E00000-0x00000000013CB000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 4 IoCs

resource	yara_rule
behavioral2/memory/4624-13-0x0000000000E00000-0x00000000013CB000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4624-340-0x0000000000E00000-0x00000000013CB000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4624-400-0x0000000000E00000-0x00000000013CB000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4624-718-0x0000000000E00000-0x00000000013CB000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

UPX dump on OEP (original entry point) 7 IoCs

resource	yara_rule
behavioral2/memory/4624-3-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/files/0x000a000000019cb8-1.dat	UPX
behavioral2/memory/4624-12-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/4624-14-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/4624-321-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/4624-341-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/4624-703-0x0000000010000000-0x0000000010030000-memory.dmp	UPX

A potential corporate email address has been identified in the URL: [email protected]
phishing

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000a000000019cb8-1.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
4624	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe /onboot"	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4624-3-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/files/0x000a000000019cb8-1.dat	upx
behavioral2/memory/4624-12-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4624-14-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4624-321-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4624-341-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4624-703-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
File created	\??\c:\program files\common files\system\symsrv.dll.000	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies Internet Explorer settings 1 TTPs 22 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3"	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe"	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243"	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe"	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3"	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3"	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe"	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm"	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Low Rights	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe

Modifies registry class 16 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe"	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Therad = "1"	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan"	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User"	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1"	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter"	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Model = "200"	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4624	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
4624	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
4624	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
4624	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
4624	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
4624	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
4624	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
4624	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4624	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
Token: SeRestorePrivilege	4624	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
Token: SeDebugPrivilege	4572	firefox.exe
Token: SeDebugPrivilege	4572	firefox.exe
Token: SeDebugPrivilege	4572	firefox.exe
Token: SeDebugPrivilege	4572	firefox.exe
Token: SeDebugPrivilege	4572	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
4572	firefox.exe
4572	firefox.exe
4572	firefox.exe
4572	firefox.exe
4572	firefox.exe
4572	firefox.exe
4624	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4624	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4624	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
4624	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
4624	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
4572	firefox.exe
4624	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
4624	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 2572	4624	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe	89
PID 4624 wrote to memory of 2836	4624	2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe	90
PID 2836 wrote to memory of 4572	2836	firefox.exe	91
PID 2836 wrote to memory of 4572	2836	firefox.exe	91
PID 4572 wrote to memory of 5548	4572	firefox.exe	92
PID 4572 wrote to memory of 5548	4572	firefox.exe	92
PID 4572 wrote to memory of 5548	4572	firefox.exe	92
PID 4572 wrote to memory of 4216	4572	firefox.exe	93
PID 4572 wrote to memory of 4216	4572	firefox.exe	93
PID 4572 wrote to memory of 4216	4572	firefox.exe	93
PID 4572 wrote to memory of 4216	4572	firefox.exe	93
PID 4572 wrote to memory of 564	4572	firefox.exe	94
PID 4572 wrote to memory of 564	4572	firefox.exe	94
PID 4572 wrote to memory of 564	4572	firefox.exe	94
PID 4572 wrote to memory of 564	4572	firefox.exe	94
PID 4572 wrote to memory of 3596	4572	firefox.exe	95
PID 4572 wrote to memory of 3596	4572	firefox.exe	95
PID 4572 wrote to memory of 3596	4572	firefox.exe	95
PID 4572 wrote to memory of 2988	4572	firefox.exe	96
PID 4572 wrote to memory of 2988	4572	firefox.exe	96
PID 4572 wrote to memory of 2988	4572	firefox.exe	96
PID 4572 wrote to memory of 2988	4572	firefox.exe	96
PID 4572 wrote to memory of 3052	4572	firefox.exe	97
PID 4572 wrote to memory of 3052	4572	firefox.exe	97
PID 4572 wrote to memory of 3052	4572	firefox.exe	97
PID 4572 wrote to memory of 3052	4572	firefox.exe	97
PID 4572 wrote to memory of 1352	4572	firefox.exe	98
PID 4572 wrote to memory of 1352	4572	firefox.exe	98
PID 4572 wrote to memory of 1352	4572	firefox.exe	98
PID 4572 wrote to memory of 1352	4572	firefox.exe	98
PID 4572 wrote to memory of 908	4572	firefox.exe	99
PID 4572 wrote to memory of 908	4572	firefox.exe	99
PID 4572 wrote to memory of 908	4572	firefox.exe	99
PID 4572 wrote to memory of 908	4572	firefox.exe	99
PID 4572 wrote to memory of 4604	4572	firefox.exe	100
PID 4572 wrote to memory of 4604	4572	firefox.exe	100
PID 4572 wrote to memory of 4604	4572	firefox.exe	100
PID 4572 wrote to memory of 4604	4572	firefox.exe	100
PID 4572 wrote to memory of 2052	4572	firefox.exe	103
PID 4572 wrote to memory of 2052	4572	firefox.exe	103
PID 4572 wrote to memory of 2052	4572	firefox.exe	103
PID 4572 wrote to memory of 2052	4572	firefox.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_6083a923cfcc57a2ffd7995f82b8bcad_darkgate_elex_floxif_glassworm_remcos_stop.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2572
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
    3⤵
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4572
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1952 -prefsLen 27097 -prefMapHandle 1956 -prefMapSize 270279 -ipcHandle 2040 -initialChannelId {5c8bce8b-bbf8-4605-9089-13921b490c99} -parentPid 4572 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4572" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:5548
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2440 -prefsLen 27133 -prefMapHandle 2444 -prefMapSize 270279 -ipcHandle 2452 -initialChannelId {0a5c39e7-a76e-446d-a16f-d335482a8330} -parentPid 4572 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4572" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:4216
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3868 -prefsLen 25213 -prefMapHandle 3872 -prefMapSize 270279 -jsInitHandle 3876 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3884 -initialChannelId {6df48dc4-fa99-4797-bcbc-4443dae7eb12} -parentPid 4572 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4572" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:564
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4036 -prefsLen 27323 -prefMapHandle 4040 -prefMapSize 270279 -ipcHandle 4104 -initialChannelId {9a75255f-5a58-437e-9a5a-a3e53de04062} -parentPid 4572 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4572" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:3596
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4484 -prefsLen 34822 -prefMapHandle 4488 -prefMapSize 270279 -jsInitHandle 4492 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4500 -initialChannelId {3d69d5d1-9908-4ebe-899e-71f2dca14266} -parentPid 4572 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4572" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:2988
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5128 -prefsLen 35010 -prefMapHandle 5132 -prefMapSize 270279 -ipcHandle 5140 -initialChannelId {380eaf7e-8c9c-40e6-acd8-53977aca4d6b} -parentPid 4572 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4572" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:3052
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5508 -prefsLen 32952 -prefMapHandle 5480 -prefMapSize 270279 -jsInitHandle 1596 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5504 -initialChannelId {9f338b22-5aff-4259-9f4a-91523435dae6} -parentPid 4572 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4572" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:1352
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5628 -prefsLen 32952 -prefMapHandle 5632 -prefMapSize 270279 -jsInitHandle 5636 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5644 -initialChannelId {c26bfe93-b4e3-42f5-a711-e8d21e2956a4} -parentPid 4572 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4572" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:908
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5820 -prefsLen 32952 -prefMapHandle 5824 -prefMapSize 270279 -jsInitHandle 5828 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5832 -initialChannelId {877b1711-7c5a-4b46-8f36-0f1cfda36c63} -parentPid 4572 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4572" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:4604
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5812 -prefsLen 32952 -prefMapHandle 6112 -prefMapSize 270279 -jsInitHandle 6168 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2592 -initialChannelId {b4a5d0bb-a116-43d4-aa0b-7bfd1abd5bd0} -parentPid 4572 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4572" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
      4⤵
      Checks processor information in registry
      PID:2052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

symsrv.dll

Path C:\Program Files\Common Files\System\symsrv.dll
Size 67KB
SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
MD5 7574cf2c64f35161ab1292e2f532aabf
SHA1 14ba3fa927a06224dfe587014299e834def4644f
SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
TLSH
T17863F1372AB5807DDD210D37949F835AB771E5A76C20643FC25907D988B8DD0E3239AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

symsrv.dll.000

Path C:\Program Files\Common Files\System\symsrv.dll.000
Size 114B
SHA256 aefc503b1ed462d7b6280228a7b5b710792273b78934426f88325341ac5b5a92
MD5 e609411db8aa6775d0344c75c23ae79b
SHA1 1d2ff6194bf159ce36cd0461cd3da29486d1e97d
SHA512 6884ff5c07bc687132c965a59cb8c5a898a25da74c6c846c1d6089ddca8007cb7e4d2f8520bdce9fbcf6e2f9c9e5c28d8c8d6d049d3522470bdc7d38bbfa0ad0
TLSH
T1FFB09262AA2791EAE1AA224505A0248C1ED0B62AB48638002EBA5A4E93256A85916147
MD5 SHA1 SHA512 TLSH

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 15KB
SHA256 4d7fccec9e20f7e16cc01ebfefe967c6950a5cb8ac7dcd3cd9103df37179c1c6
MD5 f6204bec10078525e1c25733c108737f
SHA1 fd985d88e73d4721bdf447b47561be09933b1d59
SHA512 0c7270272dfa4f1866d9d172993550b9625ec3fb38f25b1cff92697efd8f7c320f8000b59ceea1188ffe8daa429dc782c294613e45ebb6325b6266fd178b926c
SSDEEP 384:HwCe7iO024YJdcs3hk2nhfdDE2Ba/rIVy8eou+Eu+K:QqZYJdv3hk2nhfS2sDIVy8s+d+K
TLSH
T191728DBBCF516C6D1917E985C8A95366DC04F9ABCFF690A608243449C784326B0FA48F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9512A4488B00CC053350DAC32D417B4A35C11513

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
Size 15KB
SHA256 9ce49cffdf45a30de68a418e44d81320de58369e3cc2919f9a8d9d08f6cf9dd0
MD5 2e867d2d97179ea485f157435897d96c
SHA1 be44ff8ec47cf93033f89019c07741b686616fae
SHA512 2cd207352c7da6c4071cddbbc6b97b5f678f0a0253d503f6e43f6bfc567ec66ae9fe4e89edd1546c9362912e1874dc56728de558af531602bd49afe5c54f1898
SSDEEP 384:H9XghOiO024YHdcs3hk2nhfdDE2Ba/rIVy8e1jv:dX+ZYHdv3hk2nhfS2sDIVy8C
TLSH
T16F729DBF9F016C592967D585C8AD8379DD04F9ABCBF690A608243549C78472AF0FA0CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 067542cd1902c481d9190b96a3c34fd291804ab0302b8c7f0babc445a8591cec
MD5 c20624752d91993c614b1e11ff6ddaf1
SHA1 6cd42a8a0e1f80d5c30a209986db44cf9e3f904b
SHA512 2675eb6bc396efc6ba092897794486fe01d89fab870121e16b27c3821db4d52cce0ac6de52f7fa67c075e736675c0af341d858c3c8d93e2775bee12fe3fde46a
SSDEEP 192:K21d66JoztdzgCl6mc0dUSOv5zbo7aZC9yjHswt:jd66Joz/zgC1jKRbouZC9yjH3
TLSH
T1BFE10E64E628863FC844027BDCA62F454F39388AD88E7F1935EC640C2D572DE768E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 10ac4ac5bff0d5e5fc5a6c3573f8b3a2b262b0f919a37de84986a7910171ef01
MD5 2e91223823c0af652a06607dadddc24a
SHA1 b15c2988d4c65e421ac5e5d811444a970cad6f57
SHA512 a02cc0595c5269d72810d2dcd09dafb448c46071ee77e8a6facacccffb74f4735c9b99ee9d67c6ca2bab84cdd8e8f72d93799462295726e653c76e378bc0857b
SSDEEP 192:K21d66JoztdzgCl6mc0d3SOv5zbo8bC9yjHYw:jd66Joz/zgC1jhRbo8bC9yjH
TLSH
T1ACD1ED24E629863FC845533BDDA62F414F39384BD88E3F1535EC64082D6B29E768E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\events\events
Size 1KB
SHA256 8d423fbad42c17183e291ca71755bb8378b9e3e511a8edf7ccd83e703705392f
MD5 0b634dcc58a5a46cecd5af5efc3046df
SHA1 05ea1a498452feef414578cd876e72819b0b7110
SHA512 fe9fe1f169a9d3258220710e0121dd9a6244660213ffeae4996bc3af731796c93c1cba32ee714d0d2b71ad73a2f50c98dda3c2f0f6e0fdf2b53283cca9840ed5
TLSH
T12A212B5C39B98D3A9DCAE25CB45011CEA3914D07494B1C431D52FE8DCE91BD9326E83D
MD5 SHA1 SHA512 TLSH

Submit Download

0b8ea49c-7494-449e-a88b-a43cb1b82e32

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\0b8ea49c-7494-449e-a88b-a43cb1b82e32
Size 883B
SHA256 5ac1ec1c54f66009f14a207b36618a80d286285c3ecb0bbaaf09784197870227
MD5 1b767e626c4e385f614b073039928979
SHA1 8b6d99652f1e6e5ef8f9582da4fd387724a8886e
SHA512 a2a7553edc4efb0c2a4e40f84760acd3e4a707690c33f63ddcc1663109959972b8ffd7183cf7dd044a5f50d62719317b91b03a7e070c9714fd1da55423f9febf
TLSH
T1071104409634B5B2CC78D24FC9A5375697E87427C0C654007EA05A080E3E51FE7AB60B
MD5 SHA1 SHA512 TLSH

Submit Download

28a63b8c-47af-4c05-bd73-c4b817a37816

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\28a63b8c-47af-4c05-bd73-c4b817a37816
Size 2KB
SHA256 b4050913f557529bd7dbfa93310e279b77f9e3655692281e7f34dca1378f81d8
MD5 4d93748b1f3ef77046fcb296f3c88cf6
SHA1 902587e71f2fd2f9a67c97ec314aecc37bf81ad1
SHA512 9d2a2ed5580ddf66c148351aa43867e78cea0da718de812c952ba6ca83b4e8eb1ac5151106cf715018bf9536719498262c74e0144c76fe922cc70de7e19efa69
TLSH
T15641416C35789D779CDAE54D9482338E97A0990340C62C837E51DF0C8D96A9E23AB52F
MD5 SHA1 SHA512 TLSH

Submit Download

50669bf0-2389-4111-97c7-e5d91f0d1efa

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\50669bf0-2389-4111-97c7-e5d91f0d1efa
Size 235B
SHA256 93b5eee904355ee474d4ee17dcdab1fcb2e882210a49dc82be3b5942ca1f6a49
MD5 0cf965b8f03e7c1ad112ed5c36fb8ed3
SHA1 357def27a2060aa8c5d29f5300af4ec0fdf686fc
SHA512 7d9cdef2abb2dd6a0dd94d20a85df157afa44ba6d8e814c3ded700e1301a51cf38408c6462f5c3a55f27462f588ea4200a79593ee3daae1f9ebe6cafbb58d9f9
TLSH
T189D0A7C1749C6B6D08145F07B4E46DD630E54C3314A5A854D6A185B8DAFE9C95163827
MD5 SHA1 SHA512 TLSH

Submit Download

6fcd3333-58b1-4f77-bf0a-37e8cf2034d3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\6fcd3333-58b1-4f77-bf0a-37e8cf2034d3
Size 886B
SHA256 2b26eb7a40fae8e89049140e83d95a4e675958cbed01e1d0b0a9b1c6471d712a
MD5 4029ed6b0fccb52987245d5ec3a61557
SHA1 f5f330e5ddf1ec4e54776235c84cab6998116716
SHA512 89a8d4e1f40953a60575c29411d1ffa9259c147c2f203edca9b5bb1111aa1e3273928e60f7f12386a67a0c3def64aa6d76b64728e9a4f3418d3918313dd8fb6b
TLSH
T18C11DC408638F5B2CC79D24B99E57B4686E4B423C0C65C047EA81A084ABA11BE7B770A
MD5 SHA1 SHA512 TLSH

Submit Download

7eda486d-c7e4-4e7d-b374-4abc1452cb45

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\7eda486d-c7e4-4e7d-b374-4abc1452cb45
Size 16KB
SHA256 c37f6f3b756acf59760d469a6f828d42d42d1e677af85e83eae29ae37e9e8eac
MD5 af8773a33e36655fe348dbaf44d0805c
SHA1 833950a7f7915cb2a7a32bdd571ed5387a3a17c5
SHA512 db0ffb27f0db8aad47240a2410604063c7ab70939aa494034fca59a80b72be43ee8bc0b11856cf062ea46654b80279834eccf642772684b2da8c84aabe7b0ec3
SSDEEP 192:CdT0JYloYVaUI9KaiAwGXQYoJ0VVnaXhAzlECtDiK6cwa0kcyz+y4Iy918BAbZaM:QiUXhABEyDiK6zZyz+CygSehw
TLSH
T1A172EB56682045BAC691E3A8D4FC7FC3E2F528CF4C419FC99BE4BD085DDA06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f63fc12e-815c-41d5-8448-2904cc53aed7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\f63fc12e-815c-41d5-8448-2904cc53aed7
Size 235B
SHA256 ab1d632bf486ab0a9f2f7ff789e6bc5eb312f3c59fb1ee1c9b3c411b10e158d3
MD5 c03de4f75051c989e15ca1da7c50a3b5
SHA1 76bbd4ffee2c3ff3d6ddb7cd18c3ad1615f831e1
SHA512 6ccb7ce8281e79cb29e3ff342107e0ebd28a9e2b0f45154dfb22199a1b3eb37d70eee691e438a2bb9720872357058ea9f14c3ddca71e5876a54ef98e06ebfb35
TLSH
T166D0A7C428A86B7D48151F66B0A069C772A44C3328B59850996645BADAF9DC851A1C1A
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\extensions.json
Size 16KB
SHA256 4798504790314984d19103de825868ff270ad321c992eefa9803fb1c287f1cd2
MD5 53d47095f85a899b6db0e07959a5510e
SHA1 d82a2321d2477d0d12aa4b1832e978c5c33c3eed
SHA512 aeceda0d882c01fa22ba8185c34b6d700ce6fb695c23d4f4fe84362094a418c8e8f48af2440aba8cbf6ce3e23e30d87b40cf01366ff2765ca2c0404f1c995af9
SSDEEP 384:UkI4v2UmldvR8dhWZk94zP96ohL4H8L4PtL4H2L4HxL4Hx/4hTS:7I4eRfiXi+4Z6C424l4c4J4l4s
TLSH
T1D672641545049EB8294F979BAA367D02C37D473B60845C38F4DD8FC842FA5B902FB66B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs-1.js
Size 6KB
SHA256 62da9fe9018bc8d6a1c2a57eaa42c31e1360155278c0cf6bbaf35f3d5caa782f
MD5 3fe9e4fea1665c48a42a68bcb83efb77
SHA1 496ceb7dbe339fe3a2675f7a61b8c6bcb7d7a25b
SHA512 02c19ce3039f249a53d9e797d5d2be8e2ec18cc0121397c1fd19e9e993e85bf361994fa64ab6f782b6956bcafd55320b855ab8e09f06cc3bc9cdb0caba7f70fa
SSDEEP 96:xHTGUTUEqGqSvfkvfBuN1zS7SSlvdv9jwnNHKm9fBw88u8L4cn5VPB:oHRYfkHBuNKSSo35Bw88vT
TLSH
T197E120785548CB7F74B6776CAC688C316AB2413B77BF28C610BA5484011CF3446F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs-1.js
Size 8KB
SHA256 1ae835bcdf754acdfe4883541b93e572d788351e684d69f65cf47f6d727f5c83
MD5 b21a17f1c949d6862fe47dc812a4b54c
SHA1 02bf57e474fe5e9fbc959f34812eeb105cb61140
SHA512 36caa59f647dd5dc41f639a56771da816b32706c7f74429416f829930499851beb88420c76261775ec56f865c0e8a131e2ee67b5f06973a9adfa9e733fe5cc65
SSDEEP 96:xHTGtTUEqGqSvfzvfBuNObzS7SSlvdv9jwnNWRTgem924Bw88koGp8L4cn5VmB:o6RYfzHBuNtSStRT+TBw88uuQ
TLSH
T1B4020E389004CF7FB4B6376CAC6489716AA2023BB6BF68C714B95485050CF3446E9AFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs.js
Size 6KB
SHA256 f6f0b1e54d21077f51b1dc8a0ce58373fd0221c695f26aada906feb4496a7b8c
MD5 3dac6caa928ee6ac7b28853c95fa02f4
SHA1 441c03c89c5bb4456123965197f3372ba9389fed
SHA512 2753c324eeb18e41b9415bb690e7004be2f68578d2da0aeaaa8d508ddb9c3f8a0697612c47502372a54aaffcaea366e3152b657039379eda27774e3f05f75566
SSDEEP 96:xHTGUTUEqGqSvfklN1zS4QCSSlvdv9jGefnNHKm9fBw88u8L4cn5VPB:oHRYfklNNQCSSrZ35Bw88vT
TLSH
T1E7E120789508CB7F74B677ACAC688C715AB2413B7BBF28C610BA4484010CF3442F9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 79523fd3cbea59364f892260794337d944eabb7d0a1db9b091274d1034a11fc5
MD5 ab4ce73cf54dd474fce2252482f149b8
SHA1 d323d81999181536bb44fd41b0033189c1afff7e
SHA512 ba9db2b0593b1eb65c09f39678426f3f10dc1269b078a2303884bd3cd16cf04fcdc1266bbb2f349c0675589289e6968f9529226c31d25e17efbe4183bd78e2e7
TLSH
T15C21D89780762DF57EB1984AB08B8BB5C766212240B244F091AD0E41596E649E38911A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4624-400-0x0000000000E00000-0x00000000013CB000-memory.dmp

Download

memory/4624-14-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4624-13-0x0000000000E00000-0x00000000013CB000-memory.dmp

Download

memory/4624-340-0x0000000000E00000-0x00000000013CB000-memory.dmp

Download

memory/4624-12-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4624-341-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4624-321-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4624-3-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4624-9-0x0000000000E01000-0x0000000000E02000-memory.dmp

Download

memory/4624-703-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4624-718-0x0000000000E00000-0x00000000013CB000-memory.dmp

Download