2026-06-30_bd4d6dc44692c909d0023f55a1d82623_elex_floxif_glassworm_hijackloader_njrat_qakbot

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-30_bd4d6dc44692c909d0023f55a1d82623_elex_floxif_glassworm_hijackloader_njrat_qakbot
Size 33.0MB
Sample260701-dkwstae121
SHA256 ca9434e02f1111e03bb857cb358b7e4ac06abbf2cb49032ef7993063b900a6e8
MD5 bd4d6dc44692c909d0023f55a1d82623
SHA1 441381fa4cadd8ede1aed1a883252c3e9c3b8023
SHA512 de9979159d5317cb9bd4f21882d6bec7a49512197bbb059c4c23a69d25d6d76e7368ded9e7dacfc52989b93c7fb3815335ee9afa1efe16df8c91e3978bd192e3
SSDEEP 786432:UKL/QxuCKFXGuuQZ6n1Kl+RpQ1ob2z2EIs3faqiSHZ:9L/CtKFXGs4LpQ1obPg
TLSH
T17D7701157FC4C1B3D08A22BD6C69B3C467BBEE904E11171B258DBA9DDCB21940E8D2B7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-06-30_bd4d6dc44692c909d0023f55a1d82623_elex_floxif_glassworm_hijackloader_njrat_qakbot

File Explorer

2026-06-30_bd4d6dc44692c909d0023f55a1d82623_elex_floxif_glassworm_hijackloader_njrat_qakbot

.exe 33.0MB

2026-06-30_bd4d6dc44692c909d0023f55a1d82623_elex_floxif_glassworm_hijackloader_njrat_qakbot

IMPHASH b6198c6c6a8917528dbb84ed2835146a
SHA256 ca9434e02f1111e03bb857cb358b7e4ac06abbf2cb49032ef7993063b900a6e8
MD5 bd4d6dc44692c909d0023f55a1d82623
SHA1 441381fa4cadd8ede1aed1a883252c3e9c3b8023
SHA512 de9979159d5317cb9bd4f21882d6bec7a49512197bbb059c4c23a69d25d6d76e7368ded9e7dacfc52989b93c7fb3815335ee9afa1efe16df8c91e3978bd192e3
SSDEEP 786432:UKL/QxuCKFXGuuQZ6n1Kl+RpQ1ob2z2EIs3faqiSHZ:9L/CtKFXGs4LpQ1obPg
TLSH
T17D7701157FC4C1B3D08A22BD6C69B3C467BBEE904E11171B258DBA9DDCB21940E8D2B7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

6f:a8:8c:91:76:9d:8c:1a:b1:ba:6b:99:18:3f:cf:03:6e:d2:f4:fe

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Blizzard Entertainment\, Inc.,O=Blizzard Entertainment\, Inc.,L=Irvine,ST=California,C=US

Chains

Jul 25, 2022

CN=Blizzard Entertainment\, Inc.,O=Blizzard Entertainment\, Inc.,L=Irvine,ST=California,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Blizzard Entertainment\, Inc.,O=Blizzard Entertainment\, Inc.,L=Irvine,ST=California,C=US

Serial Number

0c:44:20:48:3c:0f:11:24:8a:ab:bb:6e:a8:a8:6e:82

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 25, 2020 - Nov 29, 2023

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 9, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Serial Number

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 29, 2022 - Mar 14, 2033

Minor OS version

Major OS version

Entry point

689616

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\BuildServer\3\work\code\branches\Release\Diablo III.pdb

??0MallocExtension@@QAE@ABV0@@Z ??0MallocExtension@@QAE@XZ ??0MiniDisassembler@sidestep@@QAE@XZ ??0MiniDisassembler@sidestep@@QAE@_N0@Z ??0PageHeap@tcmalloc@@QAE@$$QAV01@@Z ??0PageHeap@tcmalloc@@QAE@ABV01@@Z ??0PageHeap@tcmalloc@@QAE@XZ ??0StackTraceTable@tcmalloc@@QAE@XZ ??0SysAllocator@@QAE@ABV0@@Z ??0SysAllocator@@QAE@XZ ??1MallocExtension@@UAE@XZ ??1StackTraceTable@tcmalloc@@QAE@XZ ??1SysAllocator@@UAE@XZ ??4?$HookList@P6AHPBXIHHHJPAPAX@Z@internal@base@@QAEAAU012@$$QAU012@@Z ??4?$HookList@P6AHPBXIHHHJPAPAX@Z@internal@base@@QAEAAU012@ABU012@@Z ??4?$HookList@P6AHPBXIPAH@Z@internal@base@@QAEAAU012@$$QAU012@@Z ??4?$HookList@P6AHPBXIPAH@Z@internal@base@@QAEAAU012@ABU012@@Z ??4?$HookList@P6AXH@Z@internal@base@@QAEAAU012@$$QAU012@@Z ??4?$HookList@P6AXH@Z@internal@base@@QAEAAU012@ABU012@@Z ??4?$HookList@P6AXPBX0IHHHJ@Z@internal@base@@QAEAAU012@$$QAU012@@Z ??4?$HookList@P6AXPBX0IHHHJ@Z@internal@base@@QAEAAU012@ABU012@@Z ??4?$HookList@P6AXPBX0IIH0@Z@internal@base@@QAEAAU012@$$QAU012@@Z ??4?$HookList@P6AXPBX0IIH0@Z@internal@base@@QAEAAU012@ABU012@@Z ??4?$HookList@P6AXPBX@Z@internal@base@@QAEAAU012@$$QAU012@@Z ??4?$HookList@P6AXPBX@Z@internal@base@@QAEAAU012@ABU012@@Z ??4?$HookList@P6AXPBXH@Z@internal@base@@QAEAAU012@$$QAU012@@Z ??4?$HookList@P6AXPBXH@Z@internal@base@@QAEAAU012@ABU012@@Z ??4?$HookList@P6AXPBXI@Z@internal@base@@QAEAAU012@$$QAU012@@Z ??4?$HookList@P6AXPBXI@Z@internal@base@@QAEAAU012@ABU012@@Z ??4?$HookList@P6AXPBXIHHHJ@Z@internal@base@@QAEAAU012@$$QAU012@@Z ??4?$HookList@P6AXPBXIHHHJ@Z@internal@base@@QAEAAU012@ABU012@@Z ??4MallocExtension@@QAEAAV0@ABV0@@Z ??4MallocHook@@QAEAAV0@$$QAV0@@Z ??4MallocHook@@QAEAAV0@ABV0@@Z ??4MiniDisassembler@sidestep@@QAEAAV01@$$QAV01@@Z ??4MiniDisassembler@sidestep@@QAEAAV01@ABV01@@Z ??4PageHeap@tcmalloc@@QAEAAV01@$$QAV01@@Z ??4PageHeap@tcmalloc@@QAEAAV01@ABV01@@Z ??4PreamblePatcher@sidestep@@QAEAAV01@$$QAV01@@Z ??4PreamblePatcher@sidestep@@QAEAAV01@ABV01@@Z ??4Sampler@tcmalloc@@QAEAAV01@$$QAV01@@Z ??4Sampler@tcmalloc@@QAEAAV01@ABV01@@Z ??4StackTraceTable@tcmalloc@@QAEAAV01@ABV01@@Z ??4SysAllocator@@QAEAAV0@ABV0@@Z ??_7MallocExtension@@6B@ ??_7SysAllocator@@6B@ ?Add@?$HookList@P6AHPBXIHHHJPAPAX@Z@internal@base@@QAE_NP6AHPBXIHHHJPAPAX@Z@Z ?Add@?$HookList@P6AHPBXIPAH@Z@internal@base@@QAE_NP6AHPBXIPAH@Z@Z ?Add@?$HookList@P6AXH@Z@internal@base@@QAE_NP6AXH@Z@Z ?Add@?$HookList@P6AXPBX0IHHHJ@Z@internal@base@@QAE_NP6AXPBX0IHHHJ@Z@Z ?Add@?$HookList@P6AXPBX0IIH0@Z@internal@base@@QAE_NP6AXPBX0IIH0@Z@Z ?Add@?$HookList@P6AXPBX@Z@internal@base@@QAE_NP6AXPBX@Z@Z ?Add@?$HookList@P6AXPBXH@Z@internal@base@@QAE_NP6AXPBXH@Z@Z ?Add@?$HookList@P6AXPBXI@Z@internal@base@@QAE_NP6AXPBXI@Z@Z ?Add@?$HookList@P6AXPBXIHHHJ@Z@internal@base@@QAE_NP6AXPBXIHHHJ@Z@Z ?AddDeleteHook@MallocHook@@SA_NP6AXPBX@Z@Z ?AddMmapHook@MallocHook@@SA_NP6AXPBX0IHHHJ@Z@Z ?AddMremapHook@MallocHook@@SA_NP6AXPBX0IIH0@Z@Z ?AddMunmapHook@MallocHook@@SA_NP6AXPBXI@Z@Z ?AddNewHook@MallocHook@@SA_NP6AXPBXI@Z@Z ?AddPreMmapHook@MallocHook@@SA_NP6AXPBXIHHHJ@Z@Z ?AddPreSbrkHook@MallocHook@@SA_NP6AXH@Z@Z ?AddSbrkHook@MallocHook@@SA_NP6AXPBXH@Z@Z ?AddTrace@StackTraceTable@tcmalloc@@QAEXABUStackTrace@2@@Z ?AllocLarge@PageHeap@tcmalloc@@AAEPAUSpan@2@I@Z ?AllocPageNear@PreamblePatcher@sidestep@@CAPAXPAX@Z ?AllocPreambleBlockNear@PreamblePatcher@sidestep@@SAPAEPAX@Z ?CacheSizeClass@PageHeap@tcmalloc@@QBEXII@Z ?Carve@PageHeap@tcmalloc@@AAEPAUSpan@2@PAU32@I@Z ?Check@PageHeap@tcmalloc@@QAE_NXZ ?CheckExpensive@PageHeap@tcmalloc@@QAE_NXZ ?CheckList@PageHeap@tcmalloc@@QAE_NPAUSpan@2@IIH@Z ?CommitSpan@PageHeap@tcmalloc@@AAEXPAUSpan@2@@Z ?DecommitSpan@PageHeap@tcmalloc@@AAE_NPAUSpan@2@@Z ?Delete@PageHeap@tcmalloc@@QAEXPAUSpan@2@@Z ?Disassemble@MiniDisassembler@sidestep@@QAE?AW4InstructionType@2@PAEAAI@Z ?EnsureLimit@PageHeap@tcmalloc@@AAE_NI_N@Z ?ExchangeSingular@?$HookList@P6AXH@Z@internal@base@@QAEP6AXH@ZP6AXH@Z@Z ?ExchangeSingular@?$HookList@P6AXPBX0IHHHJ@Z@internal@base@@QAEP6AXPBX0IHHHJ@ZP6AX00IHHHJ@Z@Z ?ExchangeSingular@?$HookList@P6AXPBX0IIH0@Z@internal@base@@QAEP6AXPBX0IIH0@ZP6AX00IIH0@Z@Z ?ExchangeSingular@?$HookList@P6AXPBX@Z@internal@base@@QAEP6AXPBX@ZP6AX0@Z@Z ?ExchangeSingular@?$HookList@P6AXPBXH@Z@internal@base@@QAEP6AXPBXH@ZP6AX0H@Z@Z ?ExchangeSingular@?$HookList@P6AXPBXI@Z@internal@base@@QAEP6AXPBXI@ZP6AX0I@Z@Z ?ExchangeSingular@?$HookList@P6AXPBXIHHHJ@Z@internal@base@@QAEP6AXPBXIHHHJ@ZP6AX0IHHHJ@Z@Z ?FLAGS_tcmalloc_heap_limit_mb@FLAG__namespace_do_not_use_directly_use_DECLARE_int64_instead@@3_JA ?FLAGS_tcmalloc_large_alloc_report_threshold@FLAG__namespace_do_not_use_directly_use_DECLARE_int64_instead@@3_JA ?FLAGS_tcmalloc_release_rate@FLAG__namespace_do_not_use_directly_use_DECLARE_double_instead@@3NA ?FLAGS_tcmalloc_sample_parameter@FLAG__namespace_do_not_use_directly_use_DECLARE_int64_instead@@3_JA ?FLAGS_verbose@FLAG__namespace_do_not_use_directly_use_DECLARE_int32_instead@@3HA ?FastLog2@Sampler@tcmalloc@@SANABN@Z ?FixupPrivEndLocked@?$HookList@P6AHPBXIHHHJPAPAX@Z@internal@base@@QAEXXZ ?FixupPrivEndLocked@?$HookList@P6AHPBXIPAH@Z@internal@base@@QAEXXZ ?FixupPrivEndLocked@?$HookList@P6AXH@Z@internal@base@@QAEXXZ ?FixupPrivEndLocked@?$HookList@P6AXPBX0IHHHJ@Z@internal@base@@QAEXXZ ?FixupPrivEndLocked@?$HookList@P6AXPBX0IIH0@Z@internal@base@@QAEXXZ ?FixupPrivEndLocked@?$HookList@P6AXPBX@Z@internal@base@@QAEXXZ ?FixupPrivEndLocked@?$HookList@P6AXPBXH@Z@internal@base@@QAEXXZ ?FixupPrivEndLocked@?$HookList@P6AXPBXI@Z@internal@base@@QAEXXZ ?FixupPrivEndLocked@?$HookList@P6AXPBXIHHHJ@Z@internal@base@@QAEXXZ ?FreePreambleBlock@PreamblePatcher@sidestep@@SAXPAE@Z ?GetAggressiveDecommit@PageHeap@tcmalloc@@QAE_NXZ ?GetAllocatedSize@MallocExtension@@UAEIPBX@Z ?GetCallerStackTrace@MallocHook@@SAHPAPAXHH@Z ?GetDeleteHook@MallocHook@@SAP6AXPBX@ZXZ ?GetDescriptor@PageHeap@tcmalloc@@QBEPAUSpan@2@I@Z ?GetEstimatedAllocatedSize@MallocExtension@@UAEII@Z ?GetFreeListSizes@MallocExtension@@UAEXPAV?$vector@UFreeListInfo@MallocExtension@@V?$allocator@UFreeListInfo@MallocExtension@@@std@@@std@@@Z ?GetHeapGrowthStacks@MallocExtension@@UAEXPAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?GetHeapSample@MallocExtension@@UAEXPAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?GetLargeSpanStats@PageHeap@tcmalloc@@QAEXPAULargeSpanStats@12@@Z ?GetMemoryReleaseRate@MallocExtension@@UAENXZ ?GetMmapHook@MallocHook@@SAP6AXPBX0IHHHJ@ZXZ ?GetMremapHook@MallocHook@@SAP6AXPBX0IIH0@ZXZ ?GetMunmapHook@MallocHook@@SAP6AXPBXI@ZXZ ?GetNewHook@MallocHook@@SAP6AXPBXI@ZXZ ?GetNextRange@PageHeap@tcmalloc@@QAE_NIPAUMallocRange@base@@@Z ?GetNumericProperty@MallocExtension@@UAE_NPBDPAI@Z ?GetOwnership@MallocExtension@@UAE?AW4Ownership@1@PBX@Z ?GetPreMmapHook@MallocHook@@SAP6AXPBXIHHHJ@ZXZ ?GetPreSbrkHook@MallocHook@@SAP6AXH@ZXZ ?GetSamplePeriod@Sampler@tcmalloc@@QAEHXZ ?GetSbrkHook@MallocHook@@SAP6AXPBXH@ZXZ ?GetSingular@?$HookList@P6AXH@Z@internal@base@@QBEP6AXH@ZXZ ?GetSingular@?$HookList@P6AXPBX0IHHHJ@Z@internal@base@@QBEP6AXPBX0IHHHJ@ZXZ ?GetSingular@?$HookList@P6AXPBX0IIH0@Z@internal@base@@QBEP6AXPBX0IIH0@ZXZ ?GetSingular@?$HookList@P6AXPBX@Z@internal@base@@QBEP6AXPBX@ZXZ ?GetSingular@?$HookList@P6AXPBXH@Z@internal@base@@QBEP6AXPBXH@ZXZ ?GetSingular@?$HookList@P6AXPBXI@Z@internal@base@@QBEP6AXPBXI@ZXZ ?GetSingular@?$HookList@P6AXPBXIHHHJ@Z@internal@base@@QBEP6AXPBXIHHHJ@ZXZ ?GetSizeClassIfCached@PageHeap@tcmalloc@@QBEII@Z ?GetSmallSpanStats@PageHeap@tcmalloc@@QAEXPAUSmallSpanStats@12@@Z ?GetStackFrames@@YAHPAPAXPAHHH@Z ?GetStackFramesWithContext@@YAHPAPAXPAHHHPBX@Z ?GetStackTrace@@YAHPAPAXHH@Z ?GetStackTraceWithContext@@YAHPAPAXHHPBX@Z ?GetStats@MallocExtension@@UAEXPADH@Z ?GetSystemAllocator@MallocExtension@@UAEPAVSysAllocator@@XZ ?GetThreadCacheSize@MallocExtension@@UAEIXZ ?GrowHeap@PageHeap@tcmalloc@@AAE_NI@Z ?IncrementalScavenge@PageHeap@tcmalloc@@AAEXI@Z ?Init@Sampler@tcmalloc@@QAEXI@Z ?InitStatics@Sampler@tcmalloc@@SAXXZ ?Initialize@MallocExtension@@SAXXZ ?Initialize@MiniDisassembler@sidestep@@AAEXXZ ?Initialize@PreamblePatcher@sidestep@@CAXXZ ?InvokeDeleteHook@MallocHook@@SAXPBX@Z ?InvokeDeleteHookSlow@MallocHook@@CAXPBX@Z ?InvokeMmapHook@MallocHook@@SAXPBX0IHHHJ@Z ?InvokeMmapHookSlow@MallocHook@@CAXPBX0IHHHJ@Z ?InvokeMmapReplacement@MallocHook@@SA_NPBXIHHHJPAPAX@Z ?InvokeMmapReplacementSlow@MallocHook@@CA_NPBXIHHHJPAPAX@Z ?InvokeMremapHook@MallocHook@@SAXPBX0IIH0@Z ?InvokeMremapHookSlow@MallocHook@@CAXPBX0IIH0@Z ?InvokeMunmapHook@MallocHook@@SAXPBXI@Z ?InvokeMunmapHookSlow@MallocHook@@CAXPBXI@Z ?InvokeMunmapReplacement@MallocHook@@SA_NPBXIPAH@Z ?InvokeMunmapReplacementSlow@MallocHook@@CA_NPBXIPAH@Z ?InvokeNewHook@MallocHook@@SAXPBXI@Z ?InvokeNewHookSlow@MallocHook@@CAXPBXI@Z ?InvokePreMmapHook@MallocHook@@SAXPBXIHHHJ@Z ?InvokePreMmapHookSlow@MallocHook@@CAXPBXIHHHJ@Z ?InvokePreSbrkHook@MallocHook@@SAXH@Z ?InvokePreSbrkHookSlow@MallocHook@@CAXH@Z ?InvokeSbrkHook@MallocHook@@SAXPBXH@Z ?InvokeSbrkHookSlow@MallocHook@@CAXPBXH@Z ?IsMovWithDisplacement@PreamblePatcher@sidestep@@CA_NPAEI@Z ?IsNearAbsoluteCall@PreamblePatcher@sidestep@@CA_NPAEI@Z ?IsNearConditionalJump@PreamblePatcher@sidestep@@CA_NPAEI@Z ?IsNearRelativeCall@PreamblePatcher@sidestep@@CA_NPAEI@Z ?IsNearRelativeJump@PreamblePatcher@sidestep@@CA_NPAEI@Z ?IsShortConditionalJump@PreamblePatcher@sidestep@@CA_NPAEI@Z ?IsShortJump@PreamblePatcher@sidestep@@CA_NPAEI@Z ?Log@tcmalloc@@YAXW4LogMode@1@PBDHVLogItem@1@222@Z ?MallocMemoryStats@MallocExtension@@UAE_NPAHPAIQAH@Z ?MarkThreadBusy@MallocExtension@@UAEXXZ ?MarkThreadIdle@MallocExtension@@UAEXXZ ?MarkThreadTemporarilyIdle@MallocExtension@@UAEXXZ ?MayMergeSpans@PageHeap@tcmalloc@@AAE_NPAUSpan@2@0@Z ?MergeIntoFreeList@PageHeap@tcmalloc@@AAEXPAUSpan@2@@Z ?New@PageHeap@tcmalloc@@QAEPAUSpan@2@I@Z ?NextRandom@Sampler@tcmalloc@@SA_K_K@Z ?PatchMovWithDisplacement@PreamblePatcher@sidestep@@CA?AW4SideStepError@2@PAEI0PAII@Z ?PatchNearJumpOrCall@PreamblePatcher@sidestep@@CA?AW4SideStepError@2@PAEI0PAII@Z ?PatchShortConditionalJump@PreamblePatcher@sidestep@@CA?AW4SideStepError@2@PAEI0PAII@Z ?PatchShortJump@PreamblePatcher@sidestep@@CA?AW4SideStepError@2@PAEI0PAII@Z ?PickNextSamplingPoint@Sampler@tcmalloc@@QAEIXZ ?PopulateFastLog2Table@Sampler@tcmalloc@@SAXXZ ?PrependToFreeList@PageHeap@tcmalloc@@AAEXPAUSpan@2@@Z ?ProcessModrm@MiniDisassembler@sidestep@@AAE_NPAEAAI@Z ?ProcessOpcode@MiniDisassembler@sidestep@@AAE?AW4InstructionType@2@PAEIAAI@Z ?ProcessOperand@MiniDisassembler@sidestep@@AAE_NH@Z ?ProcessPrefixes@MiniDisassembler@sidestep@@AAE?AW4InstructionType@2@PAEAAI@Z ?ProcessSib@MiniDisassembler@sidestep@@AAE_NPAEEAAI@Z ?Ranges@MallocExtension@@UAEXPAXP6AX0PBUMallocRange@base@@@Z@Z ?RawPatch@PreamblePatcher@sidestep@@SA?AW4SideStepError@2@PAX0PAPAX@Z ?RawPatchWithStub@PreamblePatcher@sidestep@@CA?AW4SideStepError@2@PAX0PAEKPAK@Z ?RawPatchWithStubAndProtections@PreamblePatcher@sidestep@@CA?AW4SideStepError@2@PAX0PAEKPAK@Z ?ReadHeapGrowthStackTraces@MallocExtension@@UAEPAPAXXZ ?ReadStackTraces@MallocExtension@@UAEPAPAXPAH@Z ?ReadStackTracesAndClear@StackTraceTable@tcmalloc@@QAEPAPAXXZ ?RecordSpan@PageHeap@tcmalloc@@AAEXPAUSpan@2@@Z ?Register@MallocExtension@@SAXPAV1@@Z ?RegisterSizeClass@PageHeap@tcmalloc@@QAEXPAUSpan@2@I@Z ?ReleaseAtLeastNPages@PageHeap@tcmalloc@@QAEII@Z ?ReleaseFreeMemory@MallocExtension@@UAEXXZ ?ReleaseLastNormalSpan@PageHeap@tcmalloc@@AAEIPAUSpanList@12@@Z ?ReleaseToSystem@MallocExtension@@UAEXI@Z ?Remove@?$HookList@P6AHPBXIHHHJPAPAX@Z@internal@base@@QAE_NP6AHPBXIHHHJPAPAX@Z@Z ?Remove@?$HookList@P6AHPBXIPAH@Z@internal@base@@QAE_NP6AHPBXIPAH@Z@Z ?Remove@?$HookList@P6AXH@Z@internal@base@@QAE_NP6AXH@Z@Z ?Remove@?$HookList@P6AXPBX0IHHHJ@Z@internal@base@@QAE_NP6AXPBX0IHHHJ@Z@Z ?Remove@?$HookList@P6AXPBX0IIH0@Z@internal@base@@QAE_NP6AXPBX0IIH0@Z@Z ?Remove@?$HookList@P6AXPBX@Z@internal@base@@QAE_NP6AXPBX@Z@Z ?Remove@?$HookList@P6AXPBXH@Z@internal@base@@QAE_NP6AXPBXH@Z@Z ?Remove@?$HookList@P6AXPBXI@Z@internal@base@@QAE_NP6AXPBXI@Z@Z ?Remove@?$HookList@P6AXPBXIHHHJ@Z@internal@base@@QAE_NP6AXPBXIHHHJ@Z@Z ?RemoveDeleteHook@MallocHook@@SA_NP6AXPBX@Z@Z ?RemoveFromFreeList@PageHeap@tcmalloc@@AAEXPAUSpan@2@@Z ?RemoveMmapHook@MallocHook@@SA_NP6AXPBX0IHHHJ@Z@Z ?RemoveMmapReplacement@MallocHook@@SA_NP6AHPBXIHHHJPAPAX@Z@Z ?RemoveMremapHook@MallocHook@@SA_NP6AXPBX0IIH0@Z@Z ?RemoveMunmapHook@MallocHook@@SA_NP6AXPBXI@Z@Z ?RemoveMunmapReplacement@MallocHook@@SA_NP6AHPBXIPAH@Z@Z ?RemoveNewHook@MallocHook@@SA_NP6AXPBXI@Z@Z ?RemovePreMmapHook@MallocHook@@SA_NP6AXPBXIHHHJ@Z@Z ?RemovePreSbrkHook@MallocHook@@SA_NP6AXH@Z@Z ?RemoveSbrkHook@MallocHook@@SA_NP6AXPBXH@Z@Z ?ResolveTargetImpl@PreamblePatcher@sidestep@@CAPAXPAE0_N@Z ?SampleAllocation@Sampler@tcmalloc@@QAE_NI@Z ?SearchFreeAndLargeLists@PageHeap@tcmalloc@@AAEPAUSpan@2@I@Z ?SetAggressiveDecommit@PageHeap@tcmalloc@@QAEX_N@Z ?SetDeleteHook@MallocHook@@SAP6AXPBX@ZP6AX0@Z@Z ?SetMemoryReleaseRate@MallocExtension@@UAEXN@Z ?SetMmapHook@MallocHook@@SAP6AXPBX0IHHHJ@ZP6AX00IHHHJ@Z@Z ?SetMmapReplacement@MallocHook@@SA_NP6AHPBXIHHHJPAPAX@Z@Z ?SetMremapHook@MallocHook@@SAP6AXPBX0IIH0@ZP6AX00IIH0@Z@Z ?SetMunmapHook@MallocHook@@SAP6AXPBXI@ZP6AX0I@Z@Z ?SetMunmapReplacement@MallocHook@@SA_NP6AHPBXIPAH@Z@Z ?SetNewHook@MallocHook@@SAP6AXPBXI@ZP6AX0I@Z@Z ?SetNumericProperty@MallocExtension@@UAE_NPBDI@Z ?SetPreMmapHook@MallocHook@@SAP6AXPBXIHHHJ@ZP6AX0IHHHJ@Z@Z ?SetPreSbrkHook@MallocHook@@SAP6AXH@ZP6AXH@Z@Z ?SetSbrkHook@MallocHook@@SAP6AXPBXH@ZP6AX0H@Z@Z ?SetSystemAllocator@MallocExtension@@UAEXPAVSysAllocator@@@Z ?Split@PageHeap@tcmalloc@@QAEPAUSpan@2@PAU32@I@Z ?TCMalloc_SystemAlloc@@YAPAXIPAII@Z ?TCMalloc_SystemCommit@@YAXPAXI@Z ?TCMalloc_SystemRelease@@YA_NPAXI@Z ?TCMalloc_SystemTaken@@3IA ?Traverse@?$HookList@P6AHPBXIHHHJPAPAX@Z@internal@base@@QBEHPAP6AHPBXIHHHJPAPAX@ZH@Z ?Traverse@?$HookList@P6AHPBXIPAH@Z@internal@base@@QBEHPAP6AHPBXIPAH@ZH@Z ?Traverse@?$HookList@P6AXH@Z@internal@base@@QBEHPAP6AXH@ZH@Z ?Traverse@?$HookList@P6AXPBX0IHHHJ@Z@internal@base@@QBEHPAP6AXPBX0IHHHJ@ZH@Z ?Traverse@?$HookList@P6AXPBX0IIH0@Z@internal@base@@QBEHPAP6AXPBX0IIH0@ZH@Z ?Traverse@?$HookList@P6AXPBX@Z@internal@base@@QBEHPAP6AXPBX@ZH@Z ?Traverse@?$HookList@P6AXPBXH@Z@internal@base@@QBEHPAP6AXPBXH@ZH@Z ?Traverse@?$HookList@P6AXPBXI@Z@internal@base@@QBEHPAP6AXPBXI@ZH@Z ?Traverse@?$HookList@P6AXPBXIHHHJ@Z@internal@base@@QBEHPAP6AXPBXIHHHJ@ZH@Z ?UnhookedMMap@MallocHook@@SAPAXPAXIHHHJ@Z ?UnhookedMUnmap@MallocHook@@SAHPAXI@Z ?Unpatch@PreamblePatcher@sidestep@@SA?AW4SideStepError@2@PAX00@Z ?VerifyAllMemory@MallocExtension@@UAE_NXZ ?VerifyArrayNewMemory@MallocExtension@@UAE_NPBX@Z ?VerifyMallocMemory@MallocExtension@@UAE_NPBX@Z ?VerifyNewMemory@MallocExtension@@UAE_NPBX@Z ?bucket_total@StackTraceTable@tcmalloc@@QBEHXZ ?depth_total@StackTraceTable@tcmalloc@@QBEHXZ ?empty@?$HookList@P6AHPBXIHHHJPAPAX@Z@internal@base@@QBE_NXZ ?empty@?$HookList@P6AHPBXIPAH@Z@internal@base@@QBE_NXZ ?empty@?$HookList@P6AXH@Z@internal@base@@QBE_NXZ ?empty@?$HookList@P6AXPBX0IHHHJ@Z@internal@base@@QBE_NXZ ?empty@?$HookList@P6AXPBX0IIH0@Z@internal@base@@QBE_NXZ ?empty@?$HookList@P6AXPBX@Z@internal@base@@QBE_NXZ ?empty@?$HookList@P6AXPBXH@Z@internal@base@@QBE_NXZ ?empty@?$HookList@P6AXPBXI@Z@internal@base@@QBE_NXZ ?empty@?$HookList@P6AXPBXIHHHJ@Z@internal@base@@QBE_NXZ ?granularity_@PreamblePatcher@sidestep@@0JA ?initialized_@PreamblePatcher@sidestep@@0_NA ?instance@MallocExtension@@SAPAV1@XZ ?kDefaultReleaseDelay@PageHeap@tcmalloc@@0HB ?kFastlogMask@Sampler@tcmalloc@@0HB ?kFastlogNumBits@Sampler@tcmalloc@@0HB ?kHashTableSize@StackTraceTable@tcmalloc@@0HB ?kMaxReleaseDelay@PageHeap@tcmalloc@@0HB ?kMinSystemAlloc@PageHeap@tcmalloc@@0HB ?kPageMapBigAllocationThreshold@PageHeap@tcmalloc@@0IB ?log_message_writer@tcmalloc@@3P6AXPBDH@ZA ?log_table_@Sampler@tcmalloc@@0PANA ?pagesize_@PreamblePatcher@sidestep@@0JA ?preamble_pages_@PreamblePatcher@sidestep@@0PAUPreamblePage@12@A ?s_ia16_modrm_map_@MiniDisassembler@sidestep@@0QBUModrmEntry@2@B ?s_ia32_modrm_map_@MiniDisassembler@sidestep@@0QBUModrmEntry@2@B ?s_ia32_opcode_map_@MiniDisassembler@sidestep@@0QBUOpcodeTable@2@B ?stats@PageHeap@tcmalloc@@QBE?AUStats@12@XZ ?sys_alloc@@3PAVSysAllocator@@A MallocExtension_GetAllocatedSize MallocExtension_GetEstimatedAllocatedSize MallocExtension_GetNumericProperty MallocExtension_GetOwnership MallocExtension_GetStats MallocExtension_GetThreadCacheSize MallocExtension_MallocMemoryStats MallocExtension_MarkThreadBusy MallocExtension_MarkThreadIdle MallocExtension_MarkThreadTemporarilyIdle MallocExtension_ReleaseFreeMemory MallocExtension_ReleaseToSystem MallocExtension_SetNumericProperty MallocExtension_VerifyAllMemory MallocExtension_VerifyArrayNewMemory MallocExtension_VerifyMallocMemory MallocExtension_VerifyNewMemory MallocHook_AddDeleteHook MallocHook_AddMmapHook MallocHook_AddMremapHook MallocHook_AddMunmapHook MallocHook_AddNewHook MallocHook_AddPreMmapHook MallocHook_AddPreSbrkHook MallocHook_AddSbrkHook MallocHook_GetCallerStackTrace MallocHook_RemoveDeleteHook MallocHook_RemoveMmapHook MallocHook_RemoveMremapHook MallocHook_RemoveMunmapHook MallocHook_RemoveNewHook MallocHook_RemovePreMmapHook MallocHook_RemovePreSbrkHook MallocHook_RemoveSbrkHook MallocHook_SetDeleteHook MallocHook_SetMmapHook MallocHook_SetMremapHook MallocHook_SetMunmapHook MallocHook_SetNewHook MallocHook_SetPreMmapHook MallocHook_SetPreSbrkHook MallocHook_SetSbrkHook NvOptimusEnablement WriteToStderr __sbrk __tcmalloc _tcmalloc getpagesize tc_calloc tc_cfree tc_delete tc_delete_nothrow tc_delete_sized tc_deletearray tc_deletearray_nothrow tc_deletearray_sized tc_free tc_free_sized tc_malloc tc_malloc_size tc_malloc_skip_new_handler tc_malloc_stats tc_mallopt tc_memalign tc_new tc_new_nothrow tc_newarray tc_newarray_nothrow tc_posix_memalign tc_pvalloc tc_realloc tc_set_new_mode tc_valloc tc_version

Name

.text

Size

21.8MB

Virtual Size

21.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.3MB

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

394KB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

stkresv

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

193B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

676B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

5.2MB

Virtual Size

5.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=43, id=241, version=40116,

count=193, id=243, version=40116,

count=50, id=242, version=40116,

count=13, id=199, version=41118,

count=41, id=259, version=24123,

count=2, id=261, version=23013,

count=57, id=261, version=24123,

count=24, id=260, version=24123,

count=2, id=257, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=4, id=257, productName=VS2015 UPD2 build 23918, version=23918,

count=4, id=257, version=25203,

count=64, id=264, version=24215,

count=1, id=96, productName=VS2003 (.NET) build 3077, version=3077,

count=1, id=110, productName=VS2005 build 50727, version=50727,

count=2, id=257, productName=VS2015 UPD1 build 23506, version=23506,

count=220, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=2, id=171, productName=VS2010 build 30319, version=30319,

count=4, id=123, productName=VS2005 build 50727, version=50727,

count=31, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=723, id=1, productName=Unmarked objects,

count=1381, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-30_bd4d6dc44692c909d0023f55a1d82623_elex_floxif_glassworm_hijackloader_njrat_qakbot

PE Signature issue

user32

generic