floxif | c00363e21d0208907d937b5505e71f7847cdda84c0004d4bf9c9326ee7a3d09b

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/10/2026, 14:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
Size 6.0MB
Sample261019-rqrmyab191
SHA256 c00363e21d0208907d937b5505e71f7847cdda84c0004d4bf9c9326ee7a3d09b
MD5 f2ae40130e89b6687bfced39126c81cf
SHA1 8b6bc6ea30088f4af7cc435490884c6ed3bd1ecc
SHA512 5a7f989f52a84f9602fab6b706cbf27a17e4c54ab21e6f28a5f63997c3f097e5f299f3d88358693e6ac1051081563cc666493058d2e8cf3e23ca4f9f339f8f7c
SSDEEP 98304:LDyrZQ3jRuLAP4c18frP3wbzWFimaI7dlok:AZQ3jARgbzWFimaI7dlP
TLSH
T1FA569C51BE8D817AD91B113607399F2A1029BC243B3855D3B2B43E7EEC723D26D3661B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware backdoor discovery floxif persistence privilege_escalation spyware stealer trojan upx

Malware Config

Signatures

Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/files/0x000d00000001b89d-1.dat	floxif

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 2 IoCs

resource	yara_rule
behavioral2/memory/712-24-0x0000000000470000-0x0000000000A65000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/712-445-0x0000000000470000-0x0000000000A65000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 2 IoCs

resource	yara_rule
behavioral2/memory/712-24-0x0000000000470000-0x0000000000A65000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/712-445-0x0000000000470000-0x0000000000A65000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

UPX dump on OEP (original entry point) 6 IoCs

resource	yara_rule
behavioral2/memory/712-3-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/files/0x000d00000001b89d-1.dat	UPX
behavioral2/memory/712-15-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/712-25-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/712-419-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/712-446-0x0000000010000000-0x0000000010030000-memory.dmp	UPX

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000d00000001b89d-1.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
712	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe /onboot"	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/712-3-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/files/0x000d00000001b89d-1.dat	upx
behavioral2/memory/712-15-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/712-25-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/712-419-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/712-446-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
File created	\??\c:\program files\common files\system\symsrv.dll.000	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies Internet Explorer settings 1 TTPs 22 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe"	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe"	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe"	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Low Rights	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3"	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3"	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm"	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243"	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3"	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe

Modifies registry class 16 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan"	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Therad = "1"	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1"	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe"	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Model = "291"	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User"	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter"	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
712	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
712	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
712	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
712	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
712	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
712	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
712	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
712	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	712	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
Token: SeRestorePrivilege	712	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
Token: SeDebugPrivilege	2928	firefox.exe
Token: SeDebugPrivilege	2928	firefox.exe
Token: SeDebugPrivilege	2928	firefox.exe
Token: SeDebugPrivilege	2928	firefox.exe
Token: SeDebugPrivilege	2928	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
2928	firefox.exe
2928	firefox.exe
2928	firefox.exe
2928	firefox.exe
2928	firefox.exe
2928	firefox.exe
712	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
712	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
712	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
712	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
712	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
2928	firefox.exe
712	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
712	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 712 wrote to memory of 4340	712	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe	91
PID 712 wrote to memory of 5084	712	2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe	92
PID 5084 wrote to memory of 2928	5084	firefox.exe	93
PID 5084 wrote to memory of 2928	5084	firefox.exe	93
PID 2928 wrote to memory of 5980	2928	firefox.exe	94
PID 2928 wrote to memory of 5980	2928	firefox.exe	94
PID 2928 wrote to memory of 5980	2928	firefox.exe	94
PID 2928 wrote to memory of 5476	2928	firefox.exe	95
PID 2928 wrote to memory of 5476	2928	firefox.exe	95
PID 2928 wrote to memory of 5476	2928	firefox.exe	95
PID 2928 wrote to memory of 5476	2928	firefox.exe	95
PID 2928 wrote to memory of 3564	2928	firefox.exe	96
PID 2928 wrote to memory of 3564	2928	firefox.exe	96
PID 2928 wrote to memory of 3564	2928	firefox.exe	96
PID 2928 wrote to memory of 3564	2928	firefox.exe	96
PID 2928 wrote to memory of 1552	2928	firefox.exe	97
PID 2928 wrote to memory of 1552	2928	firefox.exe	97
PID 2928 wrote to memory of 1552	2928	firefox.exe	97
PID 2928 wrote to memory of 2104	2928	firefox.exe	98
PID 2928 wrote to memory of 2104	2928	firefox.exe	98
PID 2928 wrote to memory of 2104	2928	firefox.exe	98
PID 2928 wrote to memory of 2104	2928	firefox.exe	98
PID 2928 wrote to memory of 4416	2928	firefox.exe	99
PID 2928 wrote to memory of 4416	2928	firefox.exe	99
PID 2928 wrote to memory of 4416	2928	firefox.exe	99
PID 2928 wrote to memory of 4416	2928	firefox.exe	99
PID 2928 wrote to memory of 5804	2928	firefox.exe	100
PID 2928 wrote to memory of 5804	2928	firefox.exe	100
PID 2928 wrote to memory of 5804	2928	firefox.exe	100
PID 2928 wrote to memory of 5804	2928	firefox.exe	100
PID 2928 wrote to memory of 2108	2928	firefox.exe	102
PID 2928 wrote to memory of 2108	2928	firefox.exe	102
PID 2928 wrote to memory of 2108	2928	firefox.exe	102
PID 2928 wrote to memory of 2108	2928	firefox.exe	102
PID 2928 wrote to memory of 5916	2928	firefox.exe	103
PID 2928 wrote to memory of 5916	2928	firefox.exe	103
PID 2928 wrote to memory of 5916	2928	firefox.exe	103
PID 2928 wrote to memory of 5916	2928	firefox.exe	103
PID 2928 wrote to memory of 5532	2928	firefox.exe	104
PID 2928 wrote to memory of 5532	2928	firefox.exe	104
PID 2928 wrote to memory of 5532	2928	firefox.exe	104
PID 2928 wrote to memory of 5532	2928	firefox.exe	104

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-19_f2ae40130e89b6687bfced39126c81cf_darkgate_elex_floxif_glassworm_remcos_stop.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:712
- C:\Windows\system32\regsvr32.exe
  C:\Windows\Sysnative\regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  PID:4340
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5084
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
    3⤵
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2928
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1952 -prefsLen 27097 -prefMapHandle 1956 -prefMapSize 270279 -ipcHandle 2040 -initialChannelId {5c4b62ba-812f-4eab-8c6f-af3836759c57} -parentPid 2928 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2928" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:5980
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2440 -prefsLen 27133 -prefMapHandle 2444 -prefMapSize 270279 -ipcHandle 2452 -initialChannelId {4129bc4c-d8c9-413f-829e-28e21f06c9e1} -parentPid 2928 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2928" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:5476
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3756 -prefsLen 25213 -prefMapHandle 3760 -prefMapSize 270279 -jsInitHandle 3764 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3772 -initialChannelId {703faa44-933a-4a51-aad7-4bf37a394e61} -parentPid 2928 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2928" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:3564
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3812 -prefsLen 27323 -prefMapHandle 3800 -prefMapSize 270279 -ipcHandle 3992 -initialChannelId {4a8d8a75-ae98-4007-9573-364f74b510e0} -parentPid 2928 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2928" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:1552
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4552 -prefsLen 34822 -prefMapHandle 4556 -prefMapSize 270279 -jsInitHandle 4560 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4568 -initialChannelId {91cebb56-f70e-49a5-814e-c1f42f9fe242} -parentPid 2928 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2928" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:2104
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2984 -prefsLen 35010 -prefMapHandle 3108 -prefMapSize 270279 -ipcHandle 4700 -initialChannelId {45254509-647a-45c0-a9de-f03b625aaf79} -parentPid 2928 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2928" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:4416
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5504 -prefsLen 35062 -prefMapHandle 5508 -prefMapSize 270279 -jsInitHandle 5512 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5196 -initialChannelId {38130ba3-1951-4181-adce-ad775d4b8afb} -parentPid 2928 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2928" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:5804
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5684 -prefsLen 32952 -prefMapHandle 5500 -prefMapSize 270279 -jsInitHandle 3936 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5688 -initialChannelId {c1685f82-63f2-454e-b4d6-597467cb7eab} -parentPid 2928 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2928" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:2108
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3212 -prefsLen 32952 -prefMapHandle 4356 -prefMapSize 270279 -jsInitHandle 5704 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5716 -initialChannelId {33031922-ad2a-4cee-a104-1930a7072d96} -parentPid 2928 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2928" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:5916
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6040 -prefsLen 32952 -prefMapHandle 6044 -prefMapSize 270279 -jsInitHandle 6048 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6056 -initialChannelId {79ffb360-f95b-4689-8dbd-d3e61e9ca678} -parentPid 2928 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2928" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
      4⤵
      Checks processor information in registry
      PID:5532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

symsrv.dll

Path C:\Program Files\Common Files\System\symsrv.dll
Size 67KB
SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
MD5 7574cf2c64f35161ab1292e2f532aabf
SHA1 14ba3fa927a06224dfe587014299e834def4644f
SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
TLSH
T17863F1372AB5807DDD210D37949F835AB771E5A76C20643FC25907D988B8DD0E3239AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

symsrv.dll.000

Path C:\Program Files\Common Files\System\symsrv.dll.000
Size 114B
SHA256 aefc503b1ed462d7b6280228a7b5b710792273b78934426f88325341ac5b5a92
MD5 e609411db8aa6775d0344c75c23ae79b
SHA1 1d2ff6194bf159ce36cd0461cd3da29486d1e97d
SHA512 6884ff5c07bc687132c965a59cb8c5a898a25da74c6c846c1d6089ddca8007cb7e4d2f8520bdce9fbcf6e2f9c9e5c28d8c8d6d049d3522470bdc7d38bbfa0ad0
TLSH
T1FFB09262AA2791EAE1AA224505A0248C1ED0B62AB48638002EBA5A4E93256A85916147
MD5 SHA1 SHA512 TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xoeudfhc.default-release\activity-stream.contile.json
Size 4KB
SHA256 3a6960b2cb3139e1eae5cbe643874f1946b049d425d5fc54bee965c6012b606f
MD5 7c0214efc9e9fbbe3b4c07e2fd0e3d28
SHA1 2d83bf85eac66ff347b8e1b508463149a58ab243
SHA512 f45b6342279b265617c7cf3624802875dc22ec7f68dd11b687d4b7b88639668b3ce791570cb4852f551a21c2a655ac6859f30c521b0dd0c2877aac778cf557ae
SSDEEP 96:TlFMuEz6m9yT2T+mRvzvn4KYFHe6Dqz+lz:XMVWBTTmRvbYewqCF
TLSH
T1F891A74F847489636B31FAE56C4F26ACF013B405DDE889A871559C2086AC7BEC1DB5C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xoeudfhc.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 5ebb4ea1aeaefc4713fe1c5aeee7454d124ae3e941d6fd3ee0e945eb2ba42516
MD5 2541495b90e8b0a7c4906c97877427fc
SHA1 7e0d255308b4f60349d9216a85366d704255f011
SHA512 dae9ac3c5a07647ff3939910f249181e82303e97e741aa655fa2afdd7a18be32d1b34b85d0b965e6b731c475c3ceb14f41bb4799a2fc852abced0fb46652b4b7
SSDEEP 768:NywLqolL5o4OvXJBJihKUb51ihBPJm4UYzZ+GROEZeOOruUZ:cwtvYBJ4KUV8hBJUYzAGROs+
TLSH
T114730AA3A7E9F2BB0B9477D71C0F799762D20145E38605CDECEDCA1C818E654423B6AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E9338C5CCF1E2FCF149487351399F198A4F9FCD6

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xoeudfhc.default-release\cache2\entries\E9338C5CCF1E2FCF149487351399F198A4F9FCD6
Size 16KB
SHA256 0422649843876a1a09cd4634e97a9300d62ebf457f05453f52f3acd09e0a28ea
MD5 81dac10cb349c10080cf38aa7f382782
SHA1 060bdd9f1cf0372122c330b91c1e9f2179180f16
SHA512 7d6acb1da1ce7261513197105b273594c2b6ce86ab0e9528fe930e98a215e189c7880fde511da823150b2d610b70e05678cb6ee2e5042f5da1fe8edae6edd38a
SSDEEP 384:HGNQiO024YQ/WTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMA/:mDZYQ/WTToXJWTTogB7S/AmVAf+hRMq
TLSH
T1E1728D3D9F013CAC175780E9C8B683558D18B7ABDFF6C06D26983D09C988A1A71FA45F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xoeudfhc.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 4aba181711c9a683ededa0062192c91b720beccca1154cd24571ced76394dc18
MD5 f41c2ca98686745f3903a54615dd0695
SHA1 41ea5567f3a3f30bdcfc97de284e827675670623
SHA512 4baa96da39f4d42184688cbf9ace41b884a1287a76026dc119b45ef30b5e7d95b929191eac3f7a3f6554d91a046a2ef02c09f35788ae3eda66ef5fc2e0a16c3b
SSDEEP 3072:j3liLOtqo07GUdvyS06vi3mBm591KRFXTrn:py1oiGUdarQlmojP
TLSH
T10AA39EF6EBA2CE3D68FFD41D6AC1883EFD262450B3972009CD13275466CAF786675608
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xoeudfhc.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 31fc7095f568ade0c0995765d2deaf79225009c6af4d440c6ecbae7d8fcf9fc5
MD5 8376fd77c6ec054717aeb2f796a92720
SHA1 d899306b12bfa1cca268025346741994b9165ff5
SHA512 06e178dcc27545a89525b22d62358f24d08894e60bd20d7610aec12c4a354af78fbe523168674335361c4b85e695c869c9cf76696f4b66e43298478409387265
SSDEEP 3072:X3liLOtqp+OSk8O0sfWEINSmeP1KRFXTrD:Fy1DSk8O/uam5jb
TLSH
T10EB3AFF6DBA2CE3D68FFD41D66C1843EFD262414B397200EC913275466CAF786675608
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 21.6MB
SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
MD5 40bf410fa9ef0d5499907e34885af6f4
SHA1 4d7722337a0e26bf4a1c6478129356acb2f7b720
SHA512 b763712aa4bd9819b7972a40216c08fd32338b14fab7ce4b166e39ce441ad62678bf0e1f25da436ffdb56ff1b1a21e3dbbaf47c0f5918c252e70656f5d0307ac
SSDEEP 393216:KYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHY:3mghF5QDwWCm/2YU8Ivq9u5P
TLSH
T14F37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addonStartup.json.lz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\addonStartup.json.lz4
Size 4KB
SHA256 6ede757b73c557526709fc54c88b8141ce9f63251ae8c2aea2c0154a5ea98e5a
MD5 0bcff7585b79d01ca87500f2cd3c7ad5
SHA1 e48df40a8710eaf87da08b716e18289318f842aa
SHA512 310395c18e98e7c5e9899477afb64a50c2cbe5b49b31e654959d754f7b2db2e7024bef00cf74a0299cd654249133bd46349c0fd6cffb8e73a680bb219a6c9334
SSDEEP 96:N3u4sHNw6M2xWGhD41MgGvmHhF+rUpO1LnOYvhQhIRhN:NB52xxhD8rGvm6ApwnHUuhN
TLSH
T130A17D7AD541EFA1FE32D04388D53FB2E6D6AB7410A9C4D4F1AF71194D64A735705340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

store.json.mozlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\crashes\store.json.mozlz4
Size 66B
SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
MD5 a6338865eb252d0ef8fcf11fa9af3f0d
SHA1 cecdd4c4dcae10c2ffc8eb938121b6231de48cd3
SHA512 d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c
TLSH
T175A022C28E0C83BACF000833008AF00300E83B020B8B0F882AC2AEF8200200C8082082
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 1d1b8cfc4d8e135b9586d14f60cc1fa1e4690b42f40e72afd7024e8f23d39d20
MD5 c85656850a05bd9b6c6c8901e6ae80de
SHA1 244ef2fcca76a5bff4115b08cbb9f63608802392
SHA512 13b33f6649189a06602d07f24dc7521bfed39f69f0545f973f5b93d31ec2f6177d5eb0d0e1ac17837295b7bfc8b06db56a36ddbf945a0983b7fdeea5d8596356
SSDEEP 192:GOv5zbo7vZdYyj+MI1d66JoztdzgCl6mc0dz:9bozZdYyjWd66Joz/zgC1jd
TLSH
T161E1ECA4F628863FC408037BCDB61B400F39389AD84E6F19759D651C2D5B2DE768E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 76b6f8382dc88162fb0d1c5ca58cb7ca3b13e5beb56335c2de94462ce4ee6b3f
MD5 d7d25ffb0b7238332199532d30c88ae2
SHA1 bcb84de7b8cc075c93ce596d577a66cce2e9d7cb
SHA512 c05d47e3c41127f46517b8693033e558db70336569e7e53030c80a7444d78f123259f4c31ef525c76e5ac6b33d58ac14ec2fe048fed165e89a869e180500aba3
SSDEEP 192:wOv5zbo7ndYyj+MI1d66JoztdzgCl6mc0d:7bordYyjWd66Joz/zgC1j
TLSH
T1A9E1ECA4F628863BC408037BCDB61B400F39389AD84E6F19759D651C2D5B2DE768E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 fa39ffc6fa329cefb9c1c0525f61c3ef87415001c16a500d1adba7371f60e536
MD5 ef67458fc2d45d9c41d59726ebe6c470
SHA1 723d9407030d97876e411709fb64f78fa84f73f2
SHA512 d9970faac4a79c0f70c2f19be3db6eeb681430fc1de4b79d0306e94ab55062202811f23a8b7be2f4e95d5920824ab50ec24f76f7b5774f7e138590c04036ac30
SSDEEP 192:xOv5zboSZdYyjixs1d66JoztdzgCl6mc0dz:uboSZdYyjpd66Joz/zgC1jd
TLSH
T112D1ECA8F629863BC449023BCDB61B400F35389A988E6F1971DC651D3C9B2CD76CD17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\events\events
Size 1KB
SHA256 2268cf3e16a22e2dc6994b42cca19f2c2de3ab96a61f0a1292bbc1ae6d594398
MD5 d15ae422cffabacf34dcac1101e3a69e
SHA1 d2d114f09f43ac88ab7aa1338a82513ab71b9abb
SHA512 296f8e97222798e4e927e6bf3f449bd5002f48575bc2adcbef8cd245f5d5abab956208160a6c2badc5fd932c6dc1a8bf169b495423a464b1b3e2c53ffb7ac702
TLSH
T19A21676C3AF94D6A9C87F6ACB440018F57158F0A08871C830D52DECDCE91AD972AA479
MD5 SHA1 SHA512 TLSH

Submit Download

3898e1c0-218c-4c89-b7bb-f5c54af4f6c4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\pending_pings\3898e1c0-218c-4c89-b7bb-f5c54af4f6c4
Size 235B
SHA256 6098dab1f2b87400f0cc096b7f5ae5e3fde5420c2d035ef4bb18024531dccf2e
MD5 35dcc133f2350b7431051d236b113a4d
SHA1 ea5db82a5b11212c2b66f0335a98ae16d2fd990a
SHA512 c28892e875a75ab482d2d2ad57381283981ab19507954f50104ee9f8e34f31614af4eb312dfbda9814de8fd0da2c36ab4f5268e23c7029a77c045ea5601cf59c
TLSH
T183D097942498332D08140F03F0E06AC230448C3B1074D83096A0083499F9AC841A2C8B
MD5 SHA1 SHA512 TLSH

Submit Download

5cf6dab8-3126-469a-a4c5-fe926456e0ea

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\pending_pings\5cf6dab8-3126-469a-a4c5-fe926456e0ea
Size 886B
SHA256 e0cbabffbc4e07089d7187cdda09141b5a23981063ad8d1134bd197806c92d51
MD5 d098fba27f28cdc8a5ae5f9189369faa
SHA1 f45a22e5a59835e0c95888988d3e55c8943e70e7
SHA512 e03cbda63acd8eb850f1d799b6f59c739626823c2c29018970d96a58f40320a3bdb67a4dc894720c1b4a1cad3d2ff55310cc4b2ffb6fece9a6de7b68fb5548c1
TLSH
T1AB11D090A624B5B38D69925B85E0770247A8713380C788487E954B0C4CAEA1EA3A6307
MD5 SHA1 SHA512 TLSH

Submit Download

5d92c3a4-aa55-4a5b-86aa-fbb2b58881b0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\pending_pings\5d92c3a4-aa55-4a5b-86aa-fbb2b58881b0
Size 16KB
SHA256 3406e6515623d9a842d92fe95625c23605bb0600012fdc23b5eee7cc99101a3f
MD5 3992816e2ff54cd2eb8f1bf94a9f0fac
SHA1 7db77e165059b90094261ddbaeea4f122ebd2ad6
SHA512 1440521b741ac417a918d7682ad39c364f524d6985ca541f30f09c553b3554ecf0a2b41166555407b4a1b056951a2fb8fa13dc3dbe7cd8c5e310bbdff5732564
SSDEEP 192:aqKKV9+J0Wp5Y8B018MzGPL9pwF8DjgwnunS3s9wiKOkNn774RUgSzxaEju7KAyV:jK8ARp5Y8RMsD774RUgSl07ByWY
TLSH
T1B572C7565820557B8691E36994F8BFC3E6F628CF4C418FCA9BE4BE0829DF06D1127C4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

707defd0-0c9e-4f00-84f0-88ff4ce830f2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\pending_pings\707defd0-0c9e-4f00-84f0-88ff4ce830f2
Size 2KB
SHA256 c864911f6db6e5749ddf8e9519370e4771734d9f9efd79281f23cc0ce7dd7ba5
MD5 7b24a600f6111c3008aec7f06c38df70
SHA1 6a998f8a0261967bd3583de027c8b4cd72c3372c
SHA512 0f676e1b5bdc642760292e7a2886e66e043d92553a8adfa6e1642c55f8f964dc99b9fac50d2a098e39959eaa57398e27f940686293aa522a3ccefb6fa6d123a4
TLSH
T15741345C79B88E775C8EF14D909233CE57A08A1300825C876E52DF0CCD9769D63AA52B
MD5 SHA1 SHA512 TLSH

Submit Download

d73e1c2c-8f77-424a-af16-bb15b268eaf3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\pending_pings\d73e1c2c-8f77-424a-af16-bb15b268eaf3
Size 235B
SHA256 d468028e7dcb610834a26d79804ce1ee29691168187412f18978b875abc0215a
MD5 2b808a2896a45ead968ba7889111345a
SHA1 fc698deffb9ae045703eb0580dab0a5b952bc799
SHA512 f6827d85c70dcd597e7657cbcb7d6ed1bccde6cd8073d35ebc15258d6638d64c5213ab514cf4820ce3ddae18b8a360849b8c0a5ac03bfcc72613aca64f3cbab3
TLSH
T1E9D097802498A71C08182F47F0A028DA305E8C3328A0ACA0E6A0013CC9FCDC88152827
MD5 SHA1 SHA512 TLSH

Submit Download

db5eacd3-9c53-4da2-b84f-4539a25214ef

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\pending_pings\db5eacd3-9c53-4da2-b84f-4539a25214ef
Size 883B
SHA256 7f4655791bbaec2ea926fa5a64cea10ca23dabc52ea46ba12c964199738610b9
MD5 dd98727250d3efb87bbc2ff9464e0a29
SHA1 b2129d0570f7eaf5f3746af5848c5c4226fdc9a5
SHA512 49ba36d6f5129f0e2ffbd076a8f35bc396f33c66c6c34253f29a7a9b3f68abe403400cd0166d3345dfccf1c148fa886514940c9ee06166d6dfb24c7eee6b07e2
TLSH
T147119CD0A624F9F28E6C924B85957B524BA8753390C5C8087EE58B084DAE91E93B620B
MD5 SHA1 SHA512 TLSH

Submit Download

extension-preferences.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\extension-preferences.json
Size 942B
SHA256 aecfc11c0db969b2c79da2144415a8859c77d66fbfc37ca4924ac58a0ff29834
MD5 20357ec0806e9826d6daf456b6b16bd8
SHA1 7d5d7a921213989294eb5cea2ee760e562ce5293
SHA512 2333fde606ee727a6b6d9812ed40e56e5d0dba4ec35abcc11b67f8ad61d1d3d4af5db699d29b3ed6b459b9e142badae69ffbebf18974b5a1c72e45ecc8cf93cf
TLSH
T17211F13A640B6EB01E8E5625FE384A92E791111B50B7F2E47E69934A13D3970C1ED39C
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\extensions.json
Size 14KB
SHA256 a2e21f6b1af114d61328e7decb2a1b15d63ce8587e88f19a3b4a1f892427f15e
MD5 eb42279ff4647b48313ed77da5cb2fc3
SHA1 4676e0f62974562ad107968f96a6998a66f12eb1
SHA512 45b21007b29d4f064adf99862235fb9c0eab1bf146de534ca9f565fbbe7a0cd8e60f0e37598f2463d71895f6fedaee8f09d293eb834498d66de9752f56f45877
SSDEEP 384:9kI4vyUmldv98dhWY94z+96oBL4HxL4PpL4HJL4HnL4HC:+I4qRf+Xp426u4J454B4r4i
TLSH
T13662432549049EB8294F578BAA367D01C37D573B70445C78F4DD8FC842FA5B902BB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll.sig
Size 1KB
SHA256 c5f50bed6afd38490baca2ce8e8fdd1a39849c9f0dc06478a8a2e9226526607b
MD5 61d51cf075ad6dcbaaebf956c6bc1dcd
SHA1 f176331dcdb84327afd47ecf8ede3b0664c7d05a
SHA512 de263ed43f1112786186afa7bb942f25482fe60b04e7138c3687ec09956e0247307e5a6303a4297f785a572ed9a0059747a9b870c2fb6e84483373cfe27ca6c5
TLSH
T1C421B6DDAD2426542DC0EB2D5EF8E826DD3112C2F96404BB426666C3FCA3BA038C466D
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\prefs.js
Size 6KB
SHA256 ea4befaae930df5a066f2e7d11460e31d3f313701ebc2228e12734a69ca7a3f4
MD5 3ed5d02a24b1cf8abb507ac3e0702ea5
SHA1 afbd4b0d74da0749e729f972494321d35ae12227
SHA512 7d0ddd3b69d50e3822c1a3dc8dad13fb4eb4004a6b2f500e7b6135d95a881c2fcab0170db26e11e564e1d5149843b3aa4e803b448bc1211759bb2f5d14f11e3b
SSDEEP 96:xHeUTUDqGqTfXc61zSfSSlXdv9j0HnNHG/C+DBw88u8L4cnEtjI:8eRTfXc6qSS0G/C+DBw889
TLSH
T1C9E1207894488F7F74B6776CAC6888315AB2013B77BF68C750B54489054CF3886F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\prefs.js
Size 6KB
SHA256 069dce7d8d40eee6788ad21c29f3b279597281bb140076ad9120ff8e958367f3
MD5 ee5c108a1ffc2a9e0f13b31e61908a42
SHA1 5ac42462947a62a87bdf54dbb231d7aea3e742b8
SHA512 5ce716ca4049a43f6436ea72657b16f9bcaa7271e55c7940289fba3fa029c77c293e36b1502d0fce1fd6278a68ba50244c22db80374ba1aca0c7bb51a58599f2
SSDEEP 96:xHeUTUDqGqTfXeSObzSeSSlXdv9j3nNHG/C+DBw88u8L4cnEtjI:8eRTfXeSgSSLG/C+DBw889
TLSH
T1F7E11F7895088F7F74B677ACAC6888316AB2013B7BBF68C650B544C9055CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\prefs.js
Size 7KB
SHA256 c5689ada0450297019c5c905a61a009c6095f6b4f4a439bfd6c2ec6cd5ffda75
MD5 40eedf41456f71b91df2feb266f94223
SHA1 fac24ca9ae0dfadbc46d011d9857ceb9644cffad
SHA512 7386e36531a4ae7f00f2fb757bf61d3f88ba3d1b7356c735c5c8d2dac627490b4cf64e4ee34dea2c1009813cbbaa9dfb34cabb8deb0aed43f59b25c55ee65de7
SSDEEP 96:xHe9TUDqGqTfmeSObzSeSSlXdv9j3nNHG/C+DBw88/78L4cnEtjI:8vRTfmeSgSSLG/C+DBw88c
TLSH
T1FDF10D789104CB7F74B2776CAC6449315A72023B7ABF68C650B944C9155CF3842FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\prefs.js
Size 6KB
SHA256 e5259a357df4e99b34cbfaed0b563cc2e4147fc26809235eb8d8498abb8d6d8b
MD5 5661f584f1860ef1e7e45c3fe4d2d129
SHA1 0de2d6d52c03c960074cacb07bf704a1e7664e01
SHA512 684433da73f7b77e267bb4bac7aa1274731a387d28e1af7f01096541a3e11b70b9adcfcac027f74d084c5d5dad961744756ec02f6a3ca6ff7eee6f9293675912
SSDEEP 96:xHeUTUDqGqTfXeS1zSeSSlXdv9j3nNHG/C+DBw88u8L4cnEtjI:8eRTfXeSbSSLG/C+DBw889
TLSH
T150E110789448CF7F74B677ACAC6888316AB2013B77BF68C650B54489055CF3442F9AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 02213201d145e22d7a62178da01fd0bcd13e174de6cf7426c112c840a8745cf1
MD5 fdec6becd694d91e6fa2820deda74f75
SHA1 644e8a9a6e40e6e09fb83eac915c8ff14be44b57
SHA512 73d773e138672bc7caf3ed8e59d852efb9640694aa0cca56474a0be06499a39c2bb95994a0d89ab781252c92086e452d3149f5439110dcb807d08e7f28743d11
SSDEEP 96:emfnx9F672+QeW9jILA0NjoB8kMJttn0YJZQBCT:lx9OIOnNcB85JttnTZECT
TLSH
T1C7917D06320B3963FDDA858F9F164DE145B9300989C144E890CE6A1677AFA4B7859075
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 5eca113f6a6e49936709d6b1626256c975253ad93f3ff2ff2d71750770a6f6db
MD5 a9502388a93a897f0287ab21b4ec868f
SHA1 0fc88b77cff37cddc825428061603b5a04efc274
SHA512 e039c46ef99b88d0739dbb21e67b06187f8a43058dd84eae2c0fdd8a4c1961e359c2bb478e626c38a4291dd5b0678d848470c7c0ed3046c842c5c862d0e0da75
SSDEEP 96:emfnx9F672QQeW9jILA0NjoB8kMJttn0YJZQBCH:lx9gIOnNcB85JttnTZECH
TLSH
T119917D02320B2963FD9AC58F9F064DE145B5300989C144E890CE5A16B7AFA4B78590B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download