floxif | 625c8e98b22fada83d974dc396a7f1e287fc92ddfcdc7bf9c8692c302e34b945

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 23:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Size 6.0MB
Sample260930-29h51swbrd
SHA256 625c8e98b22fada83d974dc396a7f1e287fc92ddfcdc7bf9c8692c302e34b945
MD5 1fed36f96155c8280c3f6dfcf2ef6f6a
SHA1 0f5908ccd04f800f9917383d96a5b29022aec344
SHA512 c30a81f967fca634c79b093d0ba0280effdf11be0efbe60db939a95b954d989d9497ddd22f9f6b8ce33b9a2a95228152c3a15b10a801d18d2046928ce09e1ed4
SSDEEP 98304:vjPh7/2GGvXuda+P4H18frP3wbzWFimaI7dlouge:d72GGvXuU6gbzWFimaI7dlKe
TLSH
T1DC569D51BE4D8176D90B1172472D9F2A102ABD287B3865D3B2B43E7EEC323C16D3961B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware backdoor discovery floxif persistence privilege_escalation spyware stealer trojan upx

Malware Config

Signatures

Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/files/0x000600000001b856-1.dat	floxif

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 2 IoCs

resource	yara_rule
behavioral2/memory/6068-20-0x00000000003E0000-0x00000000009D3000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/6068-405-0x00000000003E0000-0x00000000009D3000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 2 IoCs

resource	yara_rule
behavioral2/memory/6068-20-0x00000000003E0000-0x00000000009D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/6068-405-0x00000000003E0000-0x00000000009D3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

UPX dump on OEP (original entry point) 6 IoCs

resource	yara_rule
behavioral2/files/0x000600000001b856-1.dat	UPX
behavioral2/memory/6068-3-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/6068-14-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/6068-21-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/6068-380-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/6068-406-0x0000000010000000-0x0000000010030000-memory.dmp	UPX

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000600000001b856-1.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
6068	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe /onboot"	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000600000001b856-1.dat	upx
behavioral2/memory/6068-3-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/6068-14-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/6068-21-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/6068-380-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/6068-406-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
File created	\??\c:\program files\common files\system\symsrv.dll.000	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies Internet Explorer settings 1 TTPs 22 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe"	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe"	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm"	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Low Rights	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3"	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3"	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe"	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243"	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3"	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe

Modifies registry class 16 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1"	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter"	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe"	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan"	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User"	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Model = "272"	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Therad = "1"	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
6068	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
6068	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
6068	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
6068	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
6068	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
6068	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
6068	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
6068	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	6068	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Token: SeRestorePrivilege	6068	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Token: SeDebugPrivilege	5992	firefox.exe
Token: SeDebugPrivilege	5992	firefox.exe
Token: SeDebugPrivilege	5992	firefox.exe
Token: SeDebugPrivilege	5992	firefox.exe
Token: SeDebugPrivilege	5992	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
5992	firefox.exe
5992	firefox.exe
5992	firefox.exe
5992	firefox.exe
5992	firefox.exe
5992	firefox.exe
6068	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
6068	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
6068	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
6068	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
6068	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
5992	firefox.exe
6068	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
6068	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 6068 wrote to memory of 4232	6068	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe	89
PID 6068 wrote to memory of 1820	6068	2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe	90
PID 1820 wrote to memory of 5992	1820	firefox.exe	91
PID 1820 wrote to memory of 5992	1820	firefox.exe	91
PID 5992 wrote to memory of 3704	5992	firefox.exe	92
PID 5992 wrote to memory of 3704	5992	firefox.exe	92
PID 5992 wrote to memory of 3704	5992	firefox.exe	92
PID 5992 wrote to memory of 236	5992	firefox.exe	93
PID 5992 wrote to memory of 236	5992	firefox.exe	93
PID 5992 wrote to memory of 236	5992	firefox.exe	93
PID 5992 wrote to memory of 236	5992	firefox.exe	93
PID 5992 wrote to memory of 5380	5992	firefox.exe	94
PID 5992 wrote to memory of 5380	5992	firefox.exe	94
PID 5992 wrote to memory of 5380	5992	firefox.exe	94
PID 5992 wrote to memory of 5380	5992	firefox.exe	94
PID 5992 wrote to memory of 4784	5992	firefox.exe	95
PID 5992 wrote to memory of 4784	5992	firefox.exe	95
PID 5992 wrote to memory of 4784	5992	firefox.exe	95
PID 5992 wrote to memory of 4376	5992	firefox.exe	96
PID 5992 wrote to memory of 4376	5992	firefox.exe	96
PID 5992 wrote to memory of 4376	5992	firefox.exe	96
PID 5992 wrote to memory of 4376	5992	firefox.exe	96
PID 5992 wrote to memory of 5340	5992	firefox.exe	97
PID 5992 wrote to memory of 5340	5992	firefox.exe	97
PID 5992 wrote to memory of 5340	5992	firefox.exe	97
PID 5992 wrote to memory of 5340	5992	firefox.exe	97
PID 5992 wrote to memory of 5072	5992	firefox.exe	98
PID 5992 wrote to memory of 5072	5992	firefox.exe	98
PID 5992 wrote to memory of 5072	5992	firefox.exe	98
PID 5992 wrote to memory of 5072	5992	firefox.exe	98
PID 5992 wrote to memory of 3384	5992	firefox.exe	99
PID 5992 wrote to memory of 3384	5992	firefox.exe	99
PID 5992 wrote to memory of 3384	5992	firefox.exe	99
PID 5992 wrote to memory of 3384	5992	firefox.exe	99
PID 5992 wrote to memory of 1848	5992	firefox.exe	100
PID 5992 wrote to memory of 1848	5992	firefox.exe	100
PID 5992 wrote to memory of 1848	5992	firefox.exe	100
PID 5992 wrote to memory of 1848	5992	firefox.exe	100
PID 5992 wrote to memory of 4568	5992	firefox.exe	101
PID 5992 wrote to memory of 4568	5992	firefox.exe	101
PID 5992 wrote to memory of 4568	5992	firefox.exe	101
PID 5992 wrote to memory of 4568	5992	firefox.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_1fed36f96155c8280c3f6dfcf2ef6f6a_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6068
- C:\Windows\system32\regsvr32.exe
  C:\Windows\Sysnative\regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  PID:4232
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
    3⤵
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5992
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1928 -prefsLen 27097 -prefMapHandle 1932 -prefMapSize 270279 -ipcHandle 1992 -initialChannelId {039b7aed-88b4-4e39-9b6f-0c760e18d32a} -parentPid 5992 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5992" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:3704
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2388 -prefsLen 27133 -prefMapHandle 2392 -prefMapSize 270279 -ipcHandle 2408 -initialChannelId {7805145c-2bb4-4219-892b-d55ca2d52089} -parentPid 5992 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5992" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:236
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3820 -prefsLen 25164 -prefMapHandle 3824 -prefMapSize 270279 -jsInitHandle 3828 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3836 -initialChannelId {30d0e477-52db-4948-afb3-2cda766a2d76} -parentPid 5992 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5992" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:5380
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4000 -prefsLen 27274 -prefMapHandle 4004 -prefMapSize 270279 -ipcHandle 4072 -initialChannelId {aca03dbd-76cd-4029-aca7-7b76756b7109} -parentPid 5992 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5992" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:4784
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2700 -prefsLen 34773 -prefMapHandle 2892 -prefMapSize 270279 -jsInitHandle 2952 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3084 -initialChannelId {c37a7534-93b9-4c31-8814-57682d9c0c0a} -parentPid 5992 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5992" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:4376
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4844 -prefsLen 35010 -prefMapHandle 5036 -prefMapSize 270279 -ipcHandle 5044 -initialChannelId {8a65ed53-ab4f-4401-8510-2775e466f186} -parentPid 5992 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5992" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:5340
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5448 -prefsLen 35062 -prefMapHandle 5452 -prefMapSize 270279 -jsInitHandle 5456 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4892 -initialChannelId {aaba8bd4-409f-45fd-be40-52d02f6a0609} -parentPid 5992 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5992" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:5072
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5560 -prefsLen 32952 -prefMapHandle 5768 -prefMapSize 270279 -jsInitHandle 5772 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5780 -initialChannelId {701989b8-692d-405b-bac4-567038c01381} -parentPid 5992 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5992" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:3384
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5760 -prefsLen 32952 -prefMapHandle 5680 -prefMapSize 270279 -jsInitHandle 5688 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5792 -initialChannelId {c85ceb56-e1c9-412e-94fa-fa664cc85da9} -parentPid 5992 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5992" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:1848
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6076 -prefsLen 32952 -prefMapHandle 6080 -prefMapSize 270279 -jsInitHandle 6084 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6092 -initialChannelId {c7b980f7-7f03-4f41-8775-6b779174dbd9} -parentPid 5992 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5992" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
      4⤵
      Checks processor information in registry
      PID:4568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

symsrv.dll

Path C:\Program Files\Common Files\System\symsrv.dll
Size 67KB
SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
MD5 7574cf2c64f35161ab1292e2f532aabf
SHA1 14ba3fa927a06224dfe587014299e834def4644f
SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
TLSH
T17863F1372AB5807DDD210D37949F835AB771E5A76C20643FC25907D988B8DD0E3239AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

symsrv.dll.000

Path C:\Program Files\Common Files\System\symsrv.dll.000
Size 114B
SHA256 aefc503b1ed462d7b6280228a7b5b710792273b78934426f88325341ac5b5a92
MD5 e609411db8aa6775d0344c75c23ae79b
SHA1 1d2ff6194bf159ce36cd0461cd3da29486d1e97d
SHA512 6884ff5c07bc687132c965a59cb8c5a898a25da74c6c846c1d6089ddca8007cb7e4d2f8520bdce9fbcf6e2f9c9e5c28d8c8d6d049d3522470bdc7d38bbfa0ad0
TLSH
T1FFB09262AA2791EAE1AA224505A0248C1ED0B62AB48638002EBA5A4E93256A85916147
MD5 SHA1 SHA512 TLSH

Submit Download

AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ej9v93ms.default-release\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
Size 16KB
SHA256 7b552dc7ddc8f331103d41e6d7912e5498d64ee0d6e9d00ec0db84795c507cff
MD5 f3972f351bc08b94adc549883ce219f6
SHA1 2c2b08fb5967c6ef5f227f5f7a581610efced8c1
SHA512 d86e5664cd26054bfa1bbc55381119021d4e8ac0aa55fa5a90a699337289587153975e2c3c5553edc6ccac506426d56bc4fd8d8535f255535a8264977e085aff
SSDEEP 384:HalwSiO024YrWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMA3L+TS+S:6l8ZYrWTToXJWTTogB7S/AmVAf+hRM2h
TLSH
T1BB728E7D8F413CAC275790E8D8BA43598C1CB3A7DFF5C06D26983E09C984A1A71F985E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ej9v93ms.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 120ea68e6119b25aa468336584ec0fb59f7536e64783cc1940d13b2515f265cb
MD5 0c2afb92dd5d4c44b7aa003841137dd7
SHA1 f077046d9dd1b8b8403526e0fab9ccdc79b02092
SHA512 56a045be0e683f57eba0342cd2fa935d624a354b42622eb93fb012b888cddded3a06e0b2f705ea8bc7517aeea035ff3f196c5ed70e8ec30a137fbe8451a04e35
SSDEEP 3072:j3lqY4If+YlRbJBiSGQtSEns0XuM9XweooYvL5:pqY1lp3irQtScsgf93YD5
TLSH
T1F9B3AFF6DFE28D2C69FFD429A7C2843EFD262400B3A73009C867276461C6B747679649
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 710424b11377a4ce9a481642e8d9fefd14695e228a9dbccaf586597cc360e4fd
MD5 8210f7f7300244f54c89fc18d1681aa2
SHA1 65c4258a7ad00a75025383767a63d53a9e7af6a6
SHA512 cf432982b149ed45d39dbf9dd088ddcdcca0f1adeebec14f1f23cbb2d1ecda7002b6b9b6262c850ca08a1ef84b0ad9ce020826199f5bfdfbcc524249974d756c
SSDEEP 768:nkV6QFC1lt8+6Gcm+u9StAvRdTS0yKbEbjbTb3:nkAAst8UaAvm
TLSH
T179D21144EB2A953FD41812BBDCA55B002F79B88A581D2F673A4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\db\data.safe.tmp
Size 29KB
SHA256 962bcc3812c8a7f15a4f4447be57f57263ef0a721bfdb579d779db37fcb4429a
MD5 3cd03f6a3418fd1bc9d95aa29628d0fa
SHA1 48174056bcf10208fc952fdd9fcab82ea27ab8d3
SHA512 3a62ac5b96c831f30b6cd2696e961bc12854185917dfcba2d2f0579c669cd8cd8b7305bda9333fb6cdcffdf547c0eb69c75bd270b1dbaa204a2a3a6b476971f7
SSDEEP 768:Wt8+6Gcm+u9StAvRdTS0yKbEbjbTb3P1UkVKQFB:Wt8UaAvmykgAB
TLSH
T16DD22244EB1A913FD41812BBDCA51B002F79B88A980D2F673A5C646C6C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\events\events
Size 1KB
SHA256 db6a715fc0042891b4b31d0ba165e1b72b87a7910ebb889d93230fedcc24a710
MD5 5365b483d96edc4e1fd40ef99ab6c098
SHA1 3d76997cc1323a9b3a2480f3390f6e02ee87d9bd
SHA512 4816f056be4ae18fb00cf39a9f8ffcf4cd00fd30c1cb0144f36fd918bec24b89a93632cbffc4f7b7893766c33232ded7a4511ddc4f3a5923e4b7eb286ab775de
TLSH
T10A21485D3FF84D2A99CBE69C7885418E97918A4A048B1D431D03DFCCCD85BD932AE83D
MD5 SHA1 SHA512 TLSH

Submit Download

39ddc802-d298-44f7-b1b8-748b3ffd06d7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\pending_pings\39ddc802-d298-44f7-b1b8-748b3ffd06d7
Size 2KB
SHA256 db58d6404b7d32f74ade079da4bfe68ca1d9c7f99a16fa4664435c817631c92d
MD5 9083a9062a2c051ca77ddd6288fe984b
SHA1 aeaba639ea0c0e5f66e420c81ce78469eb65f412
SHA512 ba856bfa918842b48ace91a3a8149f96f3ba85b913108e915a782239f2bd3f2b2152f804e9b279ccbe5af55425adc20a0353b14c0d399a40aa2299b18d316ab7
TLSH
T13741665C35B89C7A9CCAF55CA082334E53B48D4300CA5C836E51DF4C8DA669D336B42B
MD5 SHA1 SHA512 TLSH

Submit Download

58f78ccd-1c0c-433f-b62b-48c2a7245a11

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\pending_pings\58f78ccd-1c0c-433f-b62b-48c2a7245a11
Size 871B
SHA256 d183951514f1868ac0aad6745c7def624281c7e09950bf14f20728299a166c02
MD5 c9214164a16beb053ee7f3254de132f6
SHA1 27ac1e81c5877b58e2d783cc6ec9edf534a8edd6
SHA512 fd7f76341a0cd4f1f5027d19dd25fdb76686d663efcce824bb46aa016dff30eea5dcf45165e7e02af43f7afa686d4c1faece377a236ba0247f7227416e06d55a
TLSH
T1B9110C90C774B6B2CC68928F889637025BE4612380CAD5043EB98A180DBF51E93A620B
MD5 SHA1 SHA512 TLSH

Submit Download

7d8af9d9-2431-4559-8d1d-492e1d09347f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\pending_pings\7d8af9d9-2431-4559-8d1d-492e1d09347f
Size 235B
SHA256 e4edc8b6524e527f4adbfefc13e63845add8046d08ca377baba764b2a6e3ad32
MD5 863021a7d84894a61353c5e5b1b8db39
SHA1 b740773f175d2d753043523b1397130b80e6645f
SHA512 da0f41917d571479719f8b95f52b993107c1ec3938266a06f66e048e9f8462825cfd671715414c6898be1466b472c38c71dcb811f5c18687bd35ef2f6b74b9e0
TLSH
T1BBD09784288C232C48044F06B0B0EEC230484C3314A268609590AA389EBE9C601F1C2A
MD5 SHA1 SHA512 TLSH

Submit Download

a1451d5c-d822-44df-8168-66550e2b24ac

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\pending_pings\a1451d5c-d822-44df-8168-66550e2b24ac
Size 886B
SHA256 2fc8c217830132a809c2120ec79a8dd53ff6ed7d27dc6414677e381d2468d9a8
MD5 da81c937cf2c9a56c290cd0d6854409e
SHA1 2d9dfcfcd13eb0f991c77f1e1c5d441b30b20511
SHA512 f9de71871b12c8fb6eca49e371bde817ecf56a6b3bb191fae721e202a98c1dac6c8fc60999949b09e009feb9b294d7fbae5e4b12da8c732de85d9ffa68fde544
TLSH
T17811004087B4B5B2DC38938B94D67B024FE06523C0DA59183FB49B180DEB52EA75720B
MD5 SHA1 SHA512 TLSH

Submit Download

fb3f43ae-d7e2-4c5d-b247-a37543eb7dbf

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\pending_pings\fb3f43ae-d7e2-4c5d-b247-a37543eb7dbf
Size 235B
SHA256 6bba57ce319b6ac2e78ead0b2b5675b0bf7073d87714168e718804fcd4dc7ed6
MD5 67542a36b72475824dc0d21425f26b77
SHA1 c8531e726f005883775a10825dac14686f6317a1
SHA512 c591241c3b2874b9efc4c0127eb03a11162aea39a4848de1d8dd7ce1c9653fec1325be6e7a72a304295c8475f52604579a0da0c682e1d5524aa9cb79e00c9aa9
TLSH
T1BCD0978414DC671D0C180F06F0E1ADCA3189CC3310A86820DA524A39DAF9ED80221C5A
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\extensions.json
Size 16KB
SHA256 220cb5ed879fffa2e202e1c8754b693902170664156d567b9feb6ecd9717b3d9
MD5 15ddc3181ee80d08a1a79855d13a50d7
SHA1 9866eb2969e6e671db13db3f08a823db885ec95e
SHA512 391e8cb1ba2ef9b8086c2da79c8d59a5e777c14ce93c9e9e95cd7c10c559b0b919f6724555bad691fc4ab611f38c58ca9d133c3bf66b66e56e112695a718f9a8
SSDEEP 384:hkI4vkUmldvc8dhW+94zCN96oyL4HzL4PyL4HozaL4H3VL4HCB4hc:SI4cRflXj4G6b4f444f4l4e4y
TLSH
T11C72521545049EB8298FA79BAA367D01C37D473B60845C78F4DD8FC802FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\prefs-1.js
Size 8KB
SHA256 4726725604433502bb5948dd8e795674ca8e3b250044016a6cee938aa6c30a63
MD5 e30cb7e005de0ca939c88aa49612b400
SHA1 f49296aa27558cece26bc237058fe5143e1c9b0a
SHA512 2675647f452362b0cd8fa25e7869d3948f0645c1a18435cd22114ac270524cd95f39f08fb2442f88d29580249d2b7db008786168542ae61901767e3e2570de19
SSDEEP 96:xH4pTUbqGq6fvi8ObzS9SSl4dv9j/nXWReR7+FvrVBw88UpO8L4cnYtjO7:u3R6fvi8XSSLReBgpBw88Y57
TLSH
T1A1022F386644CB7F64B7766CAC6888315AB2013BBBBF68D750B954C4014CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\prefs.js
Size 6KB
SHA256 4d9997a42d0d561583fa189dc9b53e381fb5279e5533bacc94b5a5459bef1592
MD5 ab04668cac1978d5e9e5947dc93ae122
SHA1 514e69031ba2aad42a3b87a2a69c1e5a284d143d
SHA512 2650428d3c6435ff14247cef97667419e5faccc8d575e87eea849bc66dcf0a0af3cefd6df33133db52173d11e6a5dc441670c399a8030a63444d555a1f6deb59
SSDEEP 96:xH4UTUbqGq6fUgC1zSySSl4dv9jPnXH/+FFBw88u8L4cnYQO7:umR6fUgCrSS2/4Bw88A7
TLSH
T1B4E151789448CB7F74B677ACAC6888316AB2017B7BBF68D750B54484015CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\prefs.js
Size 7KB
SHA256 a840e1f6fb20ed4afe249dd3e47d0ce9248870ae50207671b7cb0bb93099e9a2
MD5 75c9fdb109de9c4d0386c57d85b57148
SHA1 2b87b203424c016a60f455c8571949fce2c30eba
SHA512 8c8aa91a926e85c523767ebc08468857f0422bfda6349cc3f1791f812ecfd8ebd9405c06357126b2e2d54343a7a97329c3e68e78fc449554be2efb50a134854a
SSDEEP 96:xH4pTUbqGq6fUi8ObzS9SSl4dv9j/nXH/+FFBw88r8L4cnYQO7:u3R6fUi8XSS+/4Bw88H7
TLSH
T191F11078A544CB7F74B2766CAC6888315AB2013BBBBF68D750B954C4015CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\prefs.js
Size 6KB
SHA256 a86f5e3d823c57ff87d583c24d844f0a0018f42b803212bd7c9116aa3059a01c
MD5 3b424eff6741d9020d77062b8bffcc3c
SHA1 34c06cec7c6f10e5f9981319cc270a81f40e4a3d
SHA512 08140a78263ca5ddd5b5009c42814c4c6022dc59b6457aec6a13f78afc72287572e45db0dc874f7c7625c32cac0658037b3386c57018a9909af550bb85f1c284
SSDEEP 96:xH4UTUbqGq6fUi81zS9SSl4dv9jPnXH/+FFBw88u8L4cnYQO7:umR6fUi8cSS2/4Bw88A7
TLSH
T19FE1307895488B7F74B677ACAC6888316AB2013B7BBF68D750B544C4015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 43a002c06d81a44c0786ff119f8bad8b287d337dc1fbb935f78f8f29c85d4948
MD5 2a989061023c3ec24dcc55008b133492
SHA1 db1008522d1c4ad7366beec7d1b8a66d8019a2e9
SHA512 b58db4410f28aa189211e25f07830d76736a542880dc7ebc1780fe7d00110f89acd44eb7193176b1b4b3be1d915db903b0c81793a866f10dfa23234900049990
SSDEEP 96:enfh9R9ZGb401kLQeW9jILA0NjoB8kMJttn0YJZQB1:q3R9g9CIOnNcB85JttnTZE1
TLSH
T1B6917D02361F6967FE67868FAF598CE105B4310D488044E880CF6A16B67BE4B7999874
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6068-405-0x00000000003E0000-0x00000000009D3000-memory.dmp

Download

memory/6068-406-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/6068-380-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/6068-20-0x00000000003E0000-0x00000000009D3000-memory.dmp

Download

memory/6068-21-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/6068-14-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/6068-9-0x00000000003E1000-0x00000000003E2000-memory.dmp

Download

memory/6068-3-0x0000000010000000-0x0000000010030000-memory.dmp

Download