floxif | 5020ccdc3e59796515f59cdb39d3f38549959b2e0130c3e2cc491dbf6981a12d

Analysis

max time kernel
149s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 17:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
Size 5.9MB
Sample260601-vxp98sbt91
SHA256 5020ccdc3e59796515f59cdb39d3f38549959b2e0130c3e2cc491dbf6981a12d
MD5 a96e2f079ada75f70c5da87bf80d2c66
SHA1 9b8e41fa7f2cd2242d921923cfa8504448a4c3dc
SHA512 b27ce55075d65a1d303f4fb0e68edde265dea296410ff9446e06659127563896000d5f98c1a99fc9f71dc3756d25c3068e5b49c1e4ba05498e643758fa31d00a
SSDEEP 98304:Uta1zfM78Z4CioCCPaP4Vhl18frP3wbzWFimaI7dloOYp:1j1Z4iVYgbzWFimaI7dlRYp
TLSH
T149569E51BF8C817AC95A1531172DAF2A402ABC98773465D3B2743E7EEC353C26C3A61B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware backdoor discovery floxif persistence phishing spyware stealer trojan upx

Malware Config

Signatures

Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/files/0x0016000000025a19-1.dat	floxif

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 2 IoCs

resource	yara_rule
behavioral2/memory/4200-11-0x00000000009B0000-0x0000000000F81000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/4200-381-0x00000000009B0000-0x0000000000F81000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 2 IoCs

resource	yara_rule
behavioral2/memory/4200-11-0x00000000009B0000-0x0000000000F81000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4200-381-0x00000000009B0000-0x0000000000F81000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

UPX dump on OEP (original entry point) 8 IoCs

resource	yara_rule
behavioral2/files/0x0016000000025a19-1.dat	UPX
behavioral2/memory/4200-3-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/4200-10-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/4200-12-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/4200-348-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/4200-382-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/4200-400-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/4200-599-0x0000000010000000-0x0000000010030000-memory.dmp	UPX

A potential corporate email address has been identified in the URL: [email protected]
phishing

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0016000000025a19-1.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
4200	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe /onboot"	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0016000000025a19-1.dat	upx
behavioral2/memory/4200-3-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4200-10-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4200-12-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4200-348-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4200-382-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4200-400-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4200-599-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
File created	\??\c:\program files\common files\system\symsrv.dll.000	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Modifies Internet Explorer settings 1 TTPs 22 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe"	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3"	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe"	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3"	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm"	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\Low Rights	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe"	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3"	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243"	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe

Modifies registry class 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1"	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe"	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Therad = "1"	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan"	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter"	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Model = "151"	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User"	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4200	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
4200	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
4200	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
4200	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
4200	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
4200	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4200	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
Token: SeRestorePrivilege	4200	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
Token: SeDebugPrivilege	3176	firefox.exe
Token: SeDebugPrivilege	3176	firefox.exe
Token: SeDebugPrivilege	3176	firefox.exe
Token: SeDebugPrivilege	3176	firefox.exe
Token: SeDebugPrivilege	3176	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
3176	firefox.exe
3176	firefox.exe
3176	firefox.exe
3176	firefox.exe
3176	firefox.exe
3176	firefox.exe
4200	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4200	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4200	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
4200	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
4200	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
3176	firefox.exe
4200	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
4200	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4200 wrote to memory of 3372	4200	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe	85
PID 4200 wrote to memory of 4388	4200	2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe	86
PID 4388 wrote to memory of 3176	4388	firefox.exe	87
PID 4388 wrote to memory of 3176	4388	firefox.exe	87
PID 3176 wrote to memory of 2128	3176	firefox.exe	88
PID 3176 wrote to memory of 2128	3176	firefox.exe	88
PID 3176 wrote to memory of 2128	3176	firefox.exe	88
PID 3176 wrote to memory of 3408	3176	firefox.exe	89
PID 3176 wrote to memory of 3408	3176	firefox.exe	89
PID 3176 wrote to memory of 3408	3176	firefox.exe	89
PID 3176 wrote to memory of 3408	3176	firefox.exe	89
PID 3176 wrote to memory of 4056	3176	firefox.exe	90
PID 3176 wrote to memory of 4056	3176	firefox.exe	90
PID 3176 wrote to memory of 4056	3176	firefox.exe	90
PID 3176 wrote to memory of 4056	3176	firefox.exe	90
PID 3176 wrote to memory of 5096	3176	firefox.exe	91
PID 3176 wrote to memory of 5096	3176	firefox.exe	91
PID 3176 wrote to memory of 5096	3176	firefox.exe	91
PID 3176 wrote to memory of 2332	3176	firefox.exe	92
PID 3176 wrote to memory of 2332	3176	firefox.exe	92
PID 3176 wrote to memory of 2332	3176	firefox.exe	92
PID 3176 wrote to memory of 2332	3176	firefox.exe	92
PID 3176 wrote to memory of 5564	3176	firefox.exe	93
PID 3176 wrote to memory of 5564	3176	firefox.exe	93
PID 3176 wrote to memory of 5564	3176	firefox.exe	93
PID 3176 wrote to memory of 5564	3176	firefox.exe	93
PID 3176 wrote to memory of 5856	3176	firefox.exe	94
PID 3176 wrote to memory of 5856	3176	firefox.exe	94
PID 3176 wrote to memory of 5856	3176	firefox.exe	94
PID 3176 wrote to memory of 5856	3176	firefox.exe	94
PID 3176 wrote to memory of 6052	3176	firefox.exe	95
PID 3176 wrote to memory of 6052	3176	firefox.exe	95
PID 3176 wrote to memory of 6052	3176	firefox.exe	95
PID 3176 wrote to memory of 6052	3176	firefox.exe	95
PID 3176 wrote to memory of 1588	3176	firefox.exe	96
PID 3176 wrote to memory of 1588	3176	firefox.exe	96
PID 3176 wrote to memory of 1588	3176	firefox.exe	96
PID 3176 wrote to memory of 1588	3176	firefox.exe	96
PID 3176 wrote to memory of 492	3176	firefox.exe	97
PID 3176 wrote to memory of 492	3176	firefox.exe	97
PID 3176 wrote to memory of 492	3176	firefox.exe	97
PID 3176 wrote to memory of 492	3176	firefox.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-01_a96e2f079ada75f70c5da87bf80d2c66_darkgate_elex_floxif_glassworm_remcos_stop.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Windows\system32\regsvr32.exe
  C:\Windows\Sysnative\regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  PID:3372
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
    3⤵
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3176
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1964 -prefsLen 27097 -prefMapHandle 1968 -prefMapSize 270279 -ipcHandle 2028 -initialChannelId {b008b3a5-e6fb-4e78-84fd-7e0084469e5c} -parentPid 3176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3176" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:2128
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2428 -prefsLen 27133 -prefMapHandle 2432 -prefMapSize 270279 -ipcHandle 2440 -initialChannelId {1b3122fb-d71f-4f6e-8b22-b3c6ad0eca43} -parentPid 3176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:3408
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3792 -prefsLen 25164 -prefMapHandle 3796 -prefMapSize 270279 -jsInitHandle 3800 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3808 -initialChannelId {f0a2c97c-e517-4dc7-aec1-b3e1f281d6ad} -parentPid 3176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:4056
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3984 -prefsLen 27274 -prefMapHandle 3988 -prefMapSize 270279 -ipcHandle 4056 -initialChannelId {e719d2ec-d891-476a-9980-9b59691517ad} -parentPid 3176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3176" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:5096
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3136 -prefsLen 34773 -prefMapHandle 2476 -prefMapSize 270279 -jsInitHandle 2732 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4424 -initialChannelId {ff54df64-f7f6-421f-94f1-151ed5232a36} -parentPid 3176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:2332
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4972 -prefsLen 35010 -prefMapHandle 4976 -prefMapSize 270279 -ipcHandle 4948 -initialChannelId {ef420881-3f21-494a-9bed-6259896974df} -parentPid 3176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:5564
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5360 -prefsLen 35062 -prefMapHandle 5364 -prefMapSize 270279 -jsInitHandle 5368 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4900 -initialChannelId {019f5a01-6886-4dd9-83d3-a19e17e4e30c} -parentPid 3176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:5856
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4180 -prefsLen 32952 -prefMapHandle 5528 -prefMapSize 270279 -jsInitHandle 5524 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5624 -initialChannelId {b12c785c-e8c2-49f0-8db6-c5a2164fe5d9} -parentPid 3176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:6052
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5700 -prefsLen 32952 -prefMapHandle 5688 -prefMapSize 270279 -jsInitHandle 5684 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5736 -initialChannelId {d2b335cc-e6e7-45d3-866e-e0507d4b39a3} -parentPid 3176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:1588
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5940 -prefsLen 32952 -prefMapHandle 5944 -prefMapSize 270279 -jsInitHandle 5948 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5720 -initialChannelId {832ec519-906b-4f90-a0f7-367702f86948} -parentPid 3176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
      4⤵
      Checks processor information in registry
      PID:492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

symsrv.dll

Path C:\Program Files\Common Files\System\symsrv.dll
Size 67KB
SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
MD5 7574cf2c64f35161ab1292e2f532aabf
SHA1 14ba3fa927a06224dfe587014299e834def4644f
SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
TLSH
T17863F1372AB5807DDD210D37949F835AB771E5A76C20643FC25907D988B8DD0E3239AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

symsrv.dll.000

Path C:\Program Files\Common Files\System\symsrv.dll.000
Size 114B
SHA256 aefc503b1ed462d7b6280228a7b5b710792273b78934426f88325341ac5b5a92
MD5 e609411db8aa6775d0344c75c23ae79b
SHA1 1d2ff6194bf159ce36cd0461cd3da29486d1e97d
SHA512 6884ff5c07bc687132c965a59cb8c5a898a25da74c6c846c1d6089ddca8007cb7e4d2f8520bdce9fbcf6e2f9c9e5c28d8c8d6d049d3522470bdc7d38bbfa0ad0
TLSH
T1FFB09262AA2791EAE1AA224505A0248C1ED0B62AB48638002EBA5A4E93256A85916147
MD5 SHA1 SHA512 TLSH

Submit Download

C5643FFFEA92A5665EA3F3F42C97FA8CC3904334

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\e4veoxpw.default-release\cache2\entries\C5643FFFEA92A5665EA3F3F42C97FA8CC3904334
Size 13KB
SHA256 edf947f9585f97a259bdaf58b9d6de4d10bdfdeab3c7be9ea005fe0754cc86c5
MD5 91610738e302a6653436be1421643bfe
SHA1 f2f092418cf01331f6e2a9416f106aae41bf6c12
SHA512 9ddb636d41cf10dec817cdbd77dcec726c6d05d066459a1501c0b7f8d5b3c39b6d5aa94e9870e6b0b6c2a7e719e5c56bcd4f7b5a597cf650891150e78d552861
SSDEEP 384:HUr7iO024YJo6J+Sl1xDnZBPsac4j0lpDII+zLGLU:0SZYJo0+Sl7zZlsac4ID8Lj
TLSH
T129527CBE9F0139A92A27C091D9FE52448E05E6BBEFE3D06605143C04CA847A9F4F649F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 3ae4ec341e70304d4a9187d3a4bffa78fb9c41095f76e581d61a45beebe33a4a
MD5 374cee6436c85d24183308460218fae8
SHA1 3764fccc4cf94cdab677decc5b57436aa4857a1f
SHA512 f7e933ffbf52b3915e67e1eb2c7a5f72b55cc3535b097961da0ff72e19e1ea56d198fda543d87da79c5d67f1600b744d4a551b7f0bb27d17b6fbebbfe2dd7422
SSDEEP 192:x1d66Joz0dzgCl6mc0dBOv5zbooZLayjw:vd66JozQzgC1jobooZLayj
TLSH
T1B9D1BBA8E629963BC408023BCCB61B501E75389B984F3F25719C744E2C976DD7B8D27E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 122ddea37cb13850a8c85234f83171872952a9f0453fb52326240538c4362db8
MD5 8e5d2e1701314beda8e124da5e4c4091
SHA1 9d1d48090b7b6601c140b91a2593c3c53cf9268c
SHA512 461394d5183385de6417435e1ab451a81158d7abede814800d4c5f7be1cdc046bb48ab044d807c43bfb6427648d94c114c2bae6528b54e30e3cf3f88bb5440b9
SSDEEP 192:q1d66Joz0dzgCl6mc0diOv5zboHaZLayjSwP:Ud66JozQzgC1jPbo6ZLayjz
TLSH
T1EBE10CA4E629863FC408027BCCA61B440F35389B984F3F1975AC75592C572DD7B8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\events\events
Size 1KB
SHA256 21ff2a5b0b519ee6379b5f946646a36ac74337dbdb7255eb2065662f688cdc8f
MD5 98d5a9ae754647e154a7c2e6e9decee6
SHA1 1df8e201f21e28bb7d61f4084b9074250de397bf
SHA512 5d9d9be9a50adfc7a312ceb4f9f77939670ca74826cc66cae36eda44c2112e516cbd964c914d9683534ccfdc7cd036d0e2c9ccd450d08e30ab4290f58a463225
TLSH
T18A217C5E79B84D2BAAC7E39C74D001CE53958E0704872E834D12EF8DCED1ADA326E438
MD5 SHA1 SHA512 TLSH

Submit Download

21d458bd-6bd9-4d7b-b453-b140ae4dcbd5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\21d458bd-6bd9-4d7b-b453-b140ae4dcbd5
Size 235B
SHA256 f701cb936542e23a1e5115a15614740ca0eed771cce2f4df7e6c373f7417c604
MD5 41d8397840e9ae0108ee6dfbb65122ce
SHA1 5cb122ac4d2422cbe8089feb0dd728afc1a065f5
SHA512 e7cad50a2008fd97fd964aa47399c609c9fa424b4cc1f0bbe2abbe0668a699c885d9bb5775eb6a97b4c00b7ca39f0a7f81672a4e3d8cc4fbbbd352ed91668da0
TLSH
T1BFD097D818982B5C08140F4BF4A02AC230A98C3B10A06860C56201788EFDDC40221857
MD5 SHA1 SHA512 TLSH

Submit Download

353fc561-fbf4-4372-81c5-40e0dc2b7797

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\353fc561-fbf4-4372-81c5-40e0dc2b7797
Size 2KB
SHA256 e0a734bbb237f0e3ab689df9ea994fa23ec8064d4774586d8e49d9dc72b57930
MD5 c5bc6488c925831d82fe5a5d075694ca
SHA1 1cc272a550f0bb90c5c714b71a814cf0f863ff87
SHA512 e62324e261a1ccee624f182390a22f61f51eeddebe5099e2fff90b7a57c8108d1f7059910af6f88f56930a3b780083dc5c6306252df3b4b348472b55cd714c31
TLSH
T15151B9694120D8BFC879A31BDD2537828BF2140B408F194DAEECAF0B157FD5D9359745
MD5 SHA1 SHA512 TLSH

Submit Download

9e844314-4386-44ae-9f2e-788d4c91046f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\9e844314-4386-44ae-9f2e-788d4c91046f
Size 2KB
SHA256 cc3df7f903c50db6190fba2f800593beea13d691c035830b3707dc57f032eace
MD5 841c8f7581aadad5374a9b07d498e9f3
SHA1 e7dd2e7dcbada78c400ed51ef6d0982bdf9bc0a9
SHA512 53a0841fc13446085471e8020e843aedab6e7743152b615c570b8e9e268e1648f175e478a3609ed374522e9e5d386ac3408895793b5382b7e384b0f99cbbedbd
TLSH
T1A341219C36759CB79C9AF19DD582278E53A0890300C728832E55EF0D8C967AE337A53F
MD5 SHA1 SHA512 TLSH

Submit Download

bce8aa7e-e5fb-496a-8055-19a3dba35c42

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\bce8aa7e-e5fb-496a-8055-19a3dba35c42
Size 235B
SHA256 808d6e0051e56de4e0da7cca2808a10420a35dabe4ae6526a854fc40c9ddf96c
MD5 43fab5028a04c811b74268677acbe24e
SHA1 1e28f3b3b3790667654c35f7d7e7d4dea21ac561
SHA512 25059f406d3385ecda04d809ff0c782a3425c9210a967d707a069529b166ec91c53f09417601370981f73542f4da345c9f17c600894605a526ebb12090b8218e
TLSH
T1A6D097E014DC672C08140F16F0F02AC230688C3314B0D810C59241788ABCFC8629182B
MD5 SHA1 SHA512 TLSH

Submit Download

e175da73-214e-487c-ab03-1cea7c87b5fa

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\e175da73-214e-487c-ab03-1cea7c87b5fa
Size 883B
SHA256 09233a4964ba790ecf9b045379f57ec10c0445d51066748377f8f0ddad973cf6
MD5 29786f11faec220d03d658b462889aab
SHA1 8000f66fc01d1a2bc400a02d57f5d396d5e8b1a7
SHA512 e3ca87392649d741db279eefe245127486481e7178dc37887e1049cac96bff9677c43707960b582c2253a18d02f181f1ba1561e2f690c475201bf3e73b35e2df
TLSH
T1FB1100C0D635B5F3CC78D14FC9A677414BF4752380CA56143DA59E050C7A52DA36A70B
MD5 SHA1 SHA512 TLSH

Submit Download

f0eae6f6-e042-4fbd-a083-ee1c1b3fe294

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\datareporting\glean\pending_pings\f0eae6f6-e042-4fbd-a083-ee1c1b3fe294
Size 886B
SHA256 1c192ffd10a9cd456b940ca14c559f5b4f38498c7602f6200a4ecfb434c112fc
MD5 5664080be0c0e87162bb61021287d075
SHA1 ee8dd8b2de500957e3e8d852ecb055d1fbb00ee3
SHA512 7aa3beb1b98310218e0b2c63ba2b666b30e39709b7c84daf0387f9b790a2f782134ef056d85e917e65a7d0e5a3eda946c352645472335f505360e614791c519d
TLSH
T1441104C0C631F9B3CC28924F89A1B7424AF4742380CB1E147D956E090C6A51EA77AB0F
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\extensions.json
Size 16KB
SHA256 e5ae2e52c57a94b721bd86e351c7eef0f854733213fb36ef3248dd57237e9f0b
MD5 c4ad3732bce25a349109d237772cd72f
SHA1 eaffe1d89d973084acb149e6c23f3fa728d681fa
SHA512 11d56b460495e304ffb4344ed9529720349633364d8fa4850ee1c056326c59e0db825f147dd898ce1064b8893c147a148304ed430cbef44584ce0fff5f1a6592
SSDEEP 384:0DkI4v0Umldvg8dhWSD94zY96owqL4HgL4PuL4H5L4HNL4HHe4hl:0AI4cRfJXHp446Q4i484R4t4e4D
TLSH
T12772421545049EB8294FA79AEA367E02C37D473B60845C38F4DD8FC842FA5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\prefs-1.js
Size 7KB
SHA256 7108ec70c6909dc1847fa2b7cda11f976eb9bce6045c7280d81a1063c84015a9
MD5 7ee3166818ae181955931e2af3e343b8
SHA1 374c26503f427009ae6b15016e18feac82e04333
SHA512 5be07ca9b05b6a6eaf62f421f44db84a87520f4096d6ab556bba51620a9e3512a83f902d6b2ae22daa928d631e4af0039b5e0a660e7476e06ae9224a1a535707
SSDEEP 192:CwYzYmOERQfz6faSQ9SSbGRbzmpTFBw88srDr0rF5r7:5cR29wuv2F57
TLSH
T13DF10E789004CF7F74B6376CAC6488715A62023BB6BF68D750B95489054CF3842F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\prefs.js
Size 6KB
SHA256 8f916bd0e80073476f3f2ea43112c353d236eb251626cc15c63a7b54b3fcd4c8
MD5 8a40f90cb6fe14029c12b6d4d293d17f
SHA1 b3c653f818e231e4e9540e0f5fa4dfb851290337
SHA512 fbe1147e4b0e142fa7954f395cbbdbb2429e2b910618560ff0dd9b9da85a4198229666572ae3ac0b4038cf2fe4fcd1fe2ff31a1ee44ae8712856ea73011847b4
SSDEEP 96:xHcUTU1qGqQfA151zSJmSSlZdv9jwnJH9zzBw88H8L4cnc1qGq:C4RQfA15YmSSq9zzBw88e
TLSH
T18AE12D789408CB6F74B677ACAC688C316AB2013BB7BF68D710B55485054CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\prefs.js
Size 6KB
SHA256 de7581f2999463e477ce4816490bd5c917ef57773651e4532a32d73ce19a11dd
MD5 d2a8a1fb5130a52ba4730e959c846391
SHA1 edce788980ae370c769adc3c0e065f2b5a74724f
SHA512 2456731b2ce0bfab1fca4f6f1fe891ff0c283547f6a2272995174f2c18686b2ee0db312ce07fee93850247de3e0a40dfc6c49c9ebadabaf56c8831e519a1a11a
SSDEEP 96:xHcUTU1qGqQfAfa1zSwQ9SSlZdv9jjaonJH9zzBw88H8L4cnc1qGq:C4RQfAfadQ9SSb39zzBw88e
TLSH
T13CE12E789408CB6F74B6776CAC6888316AB2013BB7BF68D750B55489054CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 e2617f0d9d6c1112ad9df04184dcc801794cdb4287abc09dbe8914924ddffbfc
MD5 ca69ba730c5bb3ddab52c9095dcdd73c
SHA1 2ac30734af22246efaf1c2d5034f938d15f394f8
SHA512 2b8670e6dd3d1d633044edb1134cb89242faa68eeaf266391a359b34725410b03023ebc782a92558cd19c3fae7ed189d6943c6dfda15ae9309120ead55b70e72
SSDEEP 96:eBfAd9qMaUiQeW9jILA0NjoB8kMJttn0YJZQBQ:0U96IOnNcB85JttnTZEQ
TLSH
T127916D02361B7867FD5B868BEE494CE205B4300A59C158E890CF7F1AA75FA4B3558475
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\e4veoxpw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.5MB
SHA256 cadf275d4c1bf886ce3caf317e2a1d24b9084c959a21893e784eae5c9bdf5c60
MD5 406a9bbf861bdbf48ded012e49729073
SHA1 7d6a44d1968d099239dc496c75dfe6049ddf8e15
SHA512 d79c27fb3011d19cd21eaa23078e6a562f75060fed23ba80ae8cf66ad3f1eb3743cfa6229a82ddc05a99ebef328ea7155f61473da1f3db249ac3cd8f3ac67999
SSDEEP 49152:I+AsRoHFaDavDuY5ZYgxsCqsQA/3El9w0CCkYX:5AsRoHFaD2Y4sCqsQyEl9w
TLSH
T155463BE860D1A243F3818073B58993EB21FFD00C6077DE4857A856A9A574CEF8E177AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4200-10-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4200-5-0x00000000009B1000-0x00000000009B2000-memory.dmp

Download

memory/4200-381-0x00000000009B0000-0x0000000000F81000-memory.dmp

Download

memory/4200-400-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4200-382-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4200-348-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4200-3-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4200-12-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4200-11-0x00000000009B0000-0x0000000000F81000-memory.dmp

Download

memory/4200-599-0x0000000010000000-0x0000000010030000-memory.dmp

Download