floxif | 7b24b7f1d49a8a033350a556990856b255fb9247ce8b1ad630cfa116ef317d14

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 04:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
Size 5.9MB
Sample260808-fg4qcs1ajc
SHA256 7b24b7f1d49a8a033350a556990856b255fb9247ce8b1ad630cfa116ef317d14
MD5 936e0bc087bcc693595ecfa8ffb4b1a7
SHA1 aea1e9a3169980d1c974957fd3694dce7246f28e
SHA512 012d7b6fed12a3ee0be3d176fe0b6108fc6428e57807b1ba35f31fd4ef705dc01de125853060a1f6c052ea705dd03e8e76cca46d20d6edfb9849f65adced3864
SSDEEP 98304:qtgDKfFtA2ISF+eYP49s18frP3wbzWFimaI7dlocC:AA2IAB/gbzWFimaI7dlA
TLSH
T122568C12BF4CC176C95A2570272DAF2A402DBD25773925D3A2783E7EDC313C2693A61B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware backdoor discovery floxif persistence phishing spyware stealer trojan upx

Malware Config

Signatures

Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/files/0x000f00000001b1d0-1.dat	floxif

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 3 IoCs

resource	yara_rule
behavioral2/memory/4416-11-0x0000000000C60000-0x0000000001236000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4416-403-0x0000000000C60000-0x0000000001236000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4416-419-0x0000000000C60000-0x0000000001236000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 3 IoCs

resource	yara_rule
behavioral2/memory/4416-11-0x0000000000C60000-0x0000000001236000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4416-403-0x0000000000C60000-0x0000000001236000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4416-419-0x0000000000C60000-0x0000000001236000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

UPX dump on OEP (original entry point) 8 IoCs

resource	yara_rule
behavioral2/files/0x000f00000001b1d0-1.dat	UPX
behavioral2/memory/4416-3-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/4416-10-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/4416-12-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/4416-340-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/4416-404-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/4416-420-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/4416-546-0x0000000010000000-0x0000000010030000-memory.dmp	UPX

A potential corporate email address has been identified in the URL: [email protected]
phishing

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000f00000001b1d0-1.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
4416	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe /onboot"	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000f00000001b1d0-1.dat	upx
behavioral2/memory/4416-3-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4416-10-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4416-12-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4416-340-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4416-404-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4416-420-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4416-546-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
File created	\??\c:\program files\common files\system\symsrv.dll.000	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies Internet Explorer settings 1 TTPs 22 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3"	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243"	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3"	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe"	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3"	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm"	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe"	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe"	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Low Rights	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe

Modifies registry class 16 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter"	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan"	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Therad = "1"	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe"	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User"	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Model = "219"	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1"	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4416	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
4416	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
4416	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
4416	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
4416	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
4416	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4416	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
Token: SeRestorePrivilege	4416	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
Token: SeDebugPrivilege	560	firefox.exe
Token: SeDebugPrivilege	560	firefox.exe
Token: SeDebugPrivilege	560	firefox.exe
Token: SeDebugPrivilege	560	firefox.exe
Token: SeDebugPrivilege	560	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
560	firefox.exe
560	firefox.exe
560	firefox.exe
560	firefox.exe
560	firefox.exe
560	firefox.exe
4416	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4416	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4416	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
4416	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
4416	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
560	firefox.exe
4416	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
4416	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 5548	4416	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe	89
PID 4416 wrote to memory of 2372	4416	2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe	90
PID 2372 wrote to memory of 560	2372	firefox.exe	91
PID 2372 wrote to memory of 560	2372	firefox.exe	91
PID 560 wrote to memory of 3904	560	firefox.exe	92
PID 560 wrote to memory of 3904	560	firefox.exe	92
PID 560 wrote to memory of 3904	560	firefox.exe	92
PID 560 wrote to memory of 2432	560	firefox.exe	93
PID 560 wrote to memory of 2432	560	firefox.exe	93
PID 560 wrote to memory of 2432	560	firefox.exe	93
PID 560 wrote to memory of 2432	560	firefox.exe	93
PID 560 wrote to memory of 1868	560	firefox.exe	94
PID 560 wrote to memory of 1868	560	firefox.exe	94
PID 560 wrote to memory of 1868	560	firefox.exe	94
PID 560 wrote to memory of 1868	560	firefox.exe	94
PID 560 wrote to memory of 2404	560	firefox.exe	95
PID 560 wrote to memory of 2404	560	firefox.exe	95
PID 560 wrote to memory of 2404	560	firefox.exe	95
PID 560 wrote to memory of 5108	560	firefox.exe	96
PID 560 wrote to memory of 5108	560	firefox.exe	96
PID 560 wrote to memory of 5108	560	firefox.exe	96
PID 560 wrote to memory of 5108	560	firefox.exe	96
PID 560 wrote to memory of 1436	560	firefox.exe	97
PID 560 wrote to memory of 1436	560	firefox.exe	97
PID 560 wrote to memory of 1436	560	firefox.exe	97
PID 560 wrote to memory of 1436	560	firefox.exe	97
PID 560 wrote to memory of 4904	560	firefox.exe	98
PID 560 wrote to memory of 4904	560	firefox.exe	98
PID 560 wrote to memory of 4904	560	firefox.exe	98
PID 560 wrote to memory of 4904	560	firefox.exe	98
PID 560 wrote to memory of 1256	560	firefox.exe	99
PID 560 wrote to memory of 1256	560	firefox.exe	99
PID 560 wrote to memory of 1256	560	firefox.exe	99
PID 560 wrote to memory of 1256	560	firefox.exe	99
PID 560 wrote to memory of 5128	560	firefox.exe	100
PID 560 wrote to memory of 5128	560	firefox.exe	100
PID 560 wrote to memory of 5128	560	firefox.exe	100
PID 560 wrote to memory of 5128	560	firefox.exe	100
PID 560 wrote to memory of 5920	560	firefox.exe	101
PID 560 wrote to memory of 5920	560	firefox.exe	101
PID 560 wrote to memory of 5920	560	firefox.exe	101
PID 560 wrote to memory of 5920	560	firefox.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_936e0bc087bcc693595ecfa8ffb4b1a7_darkgate_elex_floxif_glassworm_remcos_stop.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Windows\system32\regsvr32.exe
  C:\Windows\Sysnative\regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  PID:5548
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
    3⤵
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:560
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1800 -prefsLen 27097 -prefMapHandle 1928 -prefMapSize 270279 -ipcHandle 2028 -initialChannelId {3a87f954-d973-4571-8d1a-0b38a45295c5} -parentPid 560 -crashReporter "\\.\pipe\gecko-crash-server-pipe.560" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:3904
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2440 -prefsLen 27133 -prefMapHandle 2444 -prefMapSize 270279 -ipcHandle 2452 -initialChannelId {beaed2bb-ee9a-47fb-9294-af1d53c0b251} -parentPid 560 -crashReporter "\\.\pipe\gecko-crash-server-pipe.560" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:2432
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3640 -prefsLen 25164 -prefMapHandle 3644 -prefMapSize 270279 -jsInitHandle 3648 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3656 -initialChannelId {834d79ef-9b3a-43d4-8520-f30de8cc1aaa} -parentPid 560 -crashReporter "\\.\pipe\gecko-crash-server-pipe.560" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:1868
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3836 -prefsLen 27274 -prefMapHandle 3840 -prefMapSize 270279 -ipcHandle 3648 -initialChannelId {62fe6a5f-c80b-4683-964f-9292c285d055} -parentPid 560 -crashReporter "\\.\pipe\gecko-crash-server-pipe.560" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:2404
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4640 -prefsLen 34773 -prefMapHandle 4656 -prefMapSize 270279 -jsInitHandle 4660 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4668 -initialChannelId {4863e5ef-e92c-4db3-8e80-061cd745ae74} -parentPid 560 -crashReporter "\\.\pipe\gecko-crash-server-pipe.560" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:5108
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5128 -prefsLen 35010 -prefMapHandle 5132 -prefMapSize 270279 -ipcHandle 5140 -initialChannelId {4ad2f417-dce5-4525-890d-115b61265613} -parentPid 560 -crashReporter "\\.\pipe\gecko-crash-server-pipe.560" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:1436
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4428 -prefsLen 35062 -prefMapHandle 4432 -prefMapSize 270279 -jsInitHandle 4436 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4820 -initialChannelId {ea074086-53bd-4251-8193-350776258a71} -parentPid 560 -crashReporter "\\.\pipe\gecko-crash-server-pipe.560" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:4904
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5716 -prefsLen 32952 -prefMapHandle 4968 -prefMapSize 270279 -jsInitHandle 2488 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3744 -initialChannelId {f38da8ff-16fa-4ecf-ab53-86a3ca45f18b} -parentPid 560 -crashReporter "\\.\pipe\gecko-crash-server-pipe.560" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:1256
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5820 -prefsLen 32952 -prefMapHandle 5824 -prefMapSize 270279 -jsInitHandle 5828 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5836 -initialChannelId {4acc5f7e-7544-40c7-ac84-2a73c323483a} -parentPid 560 -crashReporter "\\.\pipe\gecko-crash-server-pipe.560" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:5128
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6020 -prefsLen 32952 -prefMapHandle 5828 -prefMapSize 270279 -jsInitHandle 5824 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6040 -initialChannelId {f9dd3e01-cb3d-411c-8915-6cc086ad454e} -parentPid 560 -crashReporter "\\.\pipe\gecko-crash-server-pipe.560" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
      4⤵
      Checks processor information in registry
      PID:5920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

symsrv.dll

Path C:\Program Files\Common Files\System\symsrv.dll
Size 67KB
SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
MD5 7574cf2c64f35161ab1292e2f532aabf
SHA1 14ba3fa927a06224dfe587014299e834def4644f
SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
TLSH
T17863F1372AB5807DDD210D37949F835AB771E5A76C20643FC25907D988B8DD0E3239AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

symsrv.dll.000

Path C:\Program Files\Common Files\System\symsrv.dll.000
Size 114B
SHA256 aefc503b1ed462d7b6280228a7b5b710792273b78934426f88325341ac5b5a92
MD5 e609411db8aa6775d0344c75c23ae79b
SHA1 1d2ff6194bf159ce36cd0461cd3da29486d1e97d
SHA512 6884ff5c07bc687132c965a59cb8c5a898a25da74c6c846c1d6089ddca8007cb7e4d2f8520bdce9fbcf6e2f9c9e5c28d8c8d6d049d3522470bdc7d38bbfa0ad0
TLSH
T1FFB09262AA2791EAE1AA224505A0248C1ED0B62AB48638002EBA5A4E93256A85916147
MD5 SHA1 SHA512 TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 8d8afdd5249354506248f629ff5ddc09111f99a35f7ac06d4f02853b4dca9795
MD5 e0b4f641e729e8d34237088dfdf76702
SHA1 a23dcf18100de96a423a7e2c00caad96fd98649b
SHA512 796bc057258410ea78b67b8ab0c68584ab13eaaa18281ed17666fe2154659ddcdba36bb5fabd744403de6209d3fc0ad7c5c3f9983c35e7d2a5c96a15578ceda8
SSDEEP 3072:j3lbjupcqI/3hORhm12Ivxf5KZ0rvf60gr:pH0IfhORhmjJxKZkH6B
TLSH
T147A3A0F6DFA2CD7D64FFD02D5A92C83EFC222400B3A72019D923675452C6FB86679648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 40163bbbae98496b9a21f8c5ca933f625b4c4701d722e5bcc919490430ae4ec8
MD5 976b7535f2d599380f0dd86afbdaea75
SHA1 9b28a94e95d0dedddd3683369a17af22304c07ab
SHA512 6a5479dad2cb858e39106acc528a0906c0d0a3fb4dfecfa74eb09afbfd5231700be99e0bc8fb33e08f8fba66508741268f18b4fbb84782222019d7f43ac4b0c2
SSDEEP 192:gOv5zbo7oZJnyjLc5HD1d66JoztdzgCl6mc0dz:LboMZJnyjmd66Joz/zgC1jd
TLSH
T1EBE11EA4E639863FC408037BCCA61B404F39398AD84E3F1575DD610C2D5A2DE3A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\events\events
Size 1KB
SHA256 d0a716be1c397d456007b3380b68227197bb6d0bdd48d9496c266ff3f5f0f609
MD5 e49af70e3a6a6510aa12d81085e7bfd3
SHA1 c3d2f16126a32d9a63195d0a095981ad8af6e95f
SHA512 af76e327191f8689c4cf6ac69a1e4482e09e5cb635454aab83cb40e156f954dce82007b06519b438a657817f03bada02ea1ae83986e603950d765ab26cb8f578
TLSH
T14C214C5C79B84D7A59CAF29CB481038E63A18E0A05975D438E53EF8DCF82AD9326D43D
MD5 SHA1 SHA512 TLSH

Submit Download

1a307493-3bf7-4efe-8dd3-769443c92f06

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\1a307493-3bf7-4efe-8dd3-769443c92f06
Size 883B
SHA256 ffc4558ef1899a1321c7d0f80feb06bf3d1aeadecedbc6b9bd6ab482645b4b54
MD5 812c023455ab5179c58d552f6c596f04
SHA1 3b9de8de2f5b79d1d11352e698347adbf58d9192
SHA512 6a088f9be266d21c6051f8aada02e36def19e1ebb90baab14a6cc8dc7d663861611b2f67d7c35a82151204a25c40b14d432214bdfcf9d02d6beea493d036bcbe
TLSH
T180112340D630BA72CC28C34BC9AA7716CBF8B92380C695047DE54F080E7D65FA7A7647
MD5 SHA1 SHA512 TLSH

Submit Download

1ec11886-c0b9-4eb0-bbaf-3a74051508ed

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\1ec11886-c0b9-4eb0-bbaf-3a74051508ed
Size 886B
SHA256 ad8bdca2c38142149983b53fbd1868191094bad046c72752765114f46c53eb11
MD5 92e70ae1a81d04667da9cab3091b8f48
SHA1 6f7f65ceabea8e2ff43728f6ae4afdf2a50d2d6a
SHA512 69e1135b8fa10002e7a8392dc96df00f2dd6fc0fff6903d543319c0c0073a639e6c7143c56fd69397443bc4d51099c37247ee5ac31ba1c5117246c8b1509a33d
TLSH
T11B112340C67976B2CC29A39BC9E67742CFE47513C0C61900BD995B084DBD25EA76BB07
MD5 SHA1 SHA512 TLSH

Submit Download

50ea2aa3-b7c3-42c3-8034-83b082f0866e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\50ea2aa3-b7c3-42c3-8034-83b082f0866e
Size 235B
SHA256 e249235c8b081b6e1569860164c971443ef4c7e815ed9bba4ee421ff7db5cbee
MD5 57e19cd92cdf3e01ad1c449e70481e67
SHA1 66210cab3e0f927023c14e229b638c54886ae1ca
SHA512 a52990cbc8f14e89a6cc3e2a1fb9785856b80ddc1237bfb08f91a28f145616f2ef61c53ae04ffd648e957de3383b490dea28daf35509788cac388862421eaefd
TLSH
T15AD09780189CB72D0C100F17F0B028C2304C8C331074BC10DDE244B88AFEDC50612816
MD5 SHA1 SHA512 TLSH

Submit Download

91d4d8ad-b705-4c22-93e2-741d97e967e1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\91d4d8ad-b705-4c22-93e2-741d97e967e1
Size 16KB
SHA256 ba9cb03637bda7b5961d82dc6799a62121bad7981f7d42d7ade8071ecdca193c
MD5 219c05a65213f4a302817113ae00c467
SHA1 99810ee990ebf9e6f59d2130482a9cbc8aeb04b2
SHA512 f7820d4a17ac42d0ee58acbd7834082bcf4c6cb69ee6ccfffd8627b0aaa4306472bd0af1a958a0c15373028b5ffb9134572a7bc2c9cf15ba0493b795d8241949
SSDEEP 192:kGacu7SUeBSzdg1ct1LSE3gc7BFN97U2gyLsrHiPTplzx5yuIWAsQQcdFetcgJdm:lu+xcRI27Tq0fl5dIWAsQQcdFscV
TLSH
T16B72EB5658605ABA8251E3A9D8FC7FC3E2F528CF4C01DFCA9BE47D0859DE06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a4c1bf4b-2852-4f77-9119-092a87e380d7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\a4c1bf4b-2852-4f77-9119-092a87e380d7
Size 235B
SHA256 f76703b72a4833091b1a31b437f594a6ad0459c37b9fda864755568d404591d9
MD5 141c5ec43c34f3fea12c7857c7249587
SHA1 033cbe55c2209d1c5e04755fffdd643f831dcb1c
SHA512 60b784fc92e2d021f039e1d509191568bba69134dbd321bbec84b7a0b76381164d4b4cc2dd5880621fab141cba3795333d36cde0040f8c749e11a1ec2e2b65e2
TLSH
T162D097E818AC277C48084F0BB2E168C678588C3390A0A850CAD180B8EABD9C4016586A
MD5 SHA1 SHA512 TLSH

Submit Download

bd9d79ef-7351-4a51-89b3-6d0b46cb852d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\bd9d79ef-7351-4a51-89b3-6d0b46cb852d
Size 2KB
SHA256 7ae7b56dfe6fa6a15b1cd9472b8f7e94b152384578c35b9e873199f365f6574e
MD5 09401fcc817ceecf771e7d0c544f724d
SHA1 527ad29acfbd80f5047362424f15bcc36490858f
SHA512 f711bb4e8f5ade8d5d68439dc5b2d2dab0a8e56305e96c2c72ff32d15b874250913c3157cb85a90c555fdda47205fc48ccc275383a88aae5d207aab41d094833
TLSH
T19A41245C39B85C368C86F39D949233CE97A49A0304861D832D46EF0CCE9669E336A51B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\extensions.json
Size 16KB
SHA256 7ba9460e73188ebcdb3fb14b7a5cf657600d5d832cd8806f66d1b252021cc760
MD5 8f1c53bdaebe53d1adeee9873a99dd9f
SHA1 f9c27bfa086114f101230abe894e3c0682fa3a8f
SHA512 8574b3a28972d6fb4689c5966f0b90b184083a2fb66e6566495deeea80ed5f05879bc516126e528128133286dd9e04f7deb262fbe412c616243cf97b52a40b29
SSDEEP 384:qkI4v3Umldv/8dhWW94zg96oNL4H1L4PCL4HtL4HCL4H/54hM:NI4fRfsXH446+4V4Y4N4Q4x4e
TLSH
T11872521545048EB8298EA79BAA367E01C37D573B60845C78F4DD8FC802FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
Size 7KB
SHA256 dc92fecc73407a9113bbb743d9bfa016bf45ad7c0c8bfd705c3531ef69b43257
MD5 0a9a3e5d4c6559c388f5902ab074816e
SHA1 df0215f3a5e82513ccf3144293eeb5279a6a1c6b
SHA512 2f19111c8c86f06757bb9fd6236829f76b60bf43f1a0875c15b672fa2827267d8c5932461c3989b2ceebcfa18076b5e833a6cfffbe4a719bbb0b72ddf5b3205f
SSDEEP 96:xHpdTUWqGqPfLsTObzSVSSlvdv9jqn+cHjCaeQBw88u8L4cnAV7wb:vQRPfLsTbSSqj75Bw88qU
TLSH
T1B6F1FD7C9404CB7F74B677ACAC6889316AB2023BB7BF58C715A95484064CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs.js
Size 6KB
SHA256 5431a50f9d58c8e4aca7fe6abf704872dc6b4d20dcea2e2f8347ceaa70768dea
MD5 877758ef5c89ab73f7bffa5a180144a0
SHA1 8355758a6792e93528093ab07c01761ef2869143
SHA512 52aa90fee4bf89e137513b526eb454f6c917cd188f44d6200e6ac5c9d476b5e768b4d5044aa79a2d5a210f9afd59a93dd258cbd1442e22d472e9698d439b8225
SSDEEP 96:xHpUTUWqGqPf2BBr1zSLSSlvdv9jbn+cHjCa/Bw88u8L4cnAV7wb:vRRPf2BBreSSTj7/Bw88qU
TLSH
T1BCE1117894488F7F64B6777CAC688831AAB2013B7BBF68C750B95484055CF3841F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs.js
Size 6KB
SHA256 88c835c4c86ca350dc40b9f8acbb3c4cfc27a660004edb2aaab5608279775038
MD5 8ac9f73402dc34bc5024d22cee44cc25
SHA1 f2e1f37da8e572ef8e818eeb73e9a5c0247b8bbf
SHA512 a0941333aa63516c3a0426068650a00aae32653b8910ca10eb9e3fa0921e6310bd42512d46d6c55c7b3bdfe1ac45616ac6a3aac8a0fdecfd2f77ec811a670eae
SSDEEP 96:xHpUTUWqGqPf2BsTObzSVSSlvdv9jqn+cHjCa/Bw88u8L4cnAV7wb:vRRPf2BsTbSSqj7/Bw88qU
TLSH
T169E1107895088F7F64B6777CAC688831AAB2413BBBBF68C750B95484015CF3841F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs.js
Size 6KB
SHA256 67a537625024f1e9a697d9dfaacf52342fd2e99bbf02bb60b37a7028b0eb3453
MD5 e62c1400d7179bd9f04cbc2226fea276
SHA1 0d4bcb94005f714044337eb5d09dc842dfd3e493
SHA512 5c6b4c77b51d522b08464d3ebeb3ef69598c4a391c462d9913f3f54460c850e0433d84ccc5e662782c2967f667de7f6eb8a089f3110111a2ec5974b9222dda78
SSDEEP 96:xHpUTUWqGqPf2BsT1zSVSSlvdv9jbn+cHjCa/Bw88u8L4cnAV7wb:vRRPf2BsTASSTj7/Bw88qU
TLSH
T171E1107894488F7F64B6777CAC688831AAB2023BBBBF68D750B95484015CF3441F96E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 9842193d2d28427975ddd359af9c2b8a960e45b606e7eeef4b39b1014a578cd5
MD5 f0cbeac7b1b2057ec98d4bc54ca74e7b
SHA1 2614fbbdc9e061ba0922b5d301a6a0344df001a6
SHA512 de04db3e6abcdaed372a765cf9bcdc2a9850ea47c499ee374c8f985fe8f5e63050af0d6c5892860f34b96ddb19eb7716683df55fffd16e490f13205ed343ce2d
SSDEEP 96:eTfRd99jF/QeW9jILA0NjoB8kMJttn0YJZQBm:ORd999IOnNcB85JttnTZEm
TLSH
T19F917C05360B2927BE5785CFEB564CF145B4300A99C098FD50CF6B26B36BB0BB8584B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4416-420-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4416-5-0x0000000000C61000-0x0000000000C62000-memory.dmp

Download

memory/4416-340-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4416-10-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4416-11-0x0000000000C60000-0x0000000001236000-memory.dmp

Download

memory/4416-419-0x0000000000C60000-0x0000000001236000-memory.dmp

Download

memory/4416-3-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4416-403-0x0000000000C60000-0x0000000001236000-memory.dmp

Download

memory/4416-404-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4416-12-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4416-546-0x0000000010000000-0x0000000010030000-memory.dmp

Download