floxif | 464a8e268f70377e852561e4317f2b321bef9f4ade2ba556b20b1844d501406b

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 05:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Size 6.0MB
Sample261011-gnm7macg92
SHA256 464a8e268f70377e852561e4317f2b321bef9f4ade2ba556b20b1844d501406b
MD5 aafe67c24b0131e5743c4c3aea39708c
SHA1 10787b659e5038862b6bd8c5bc421c860c377717
SHA512 559e195e07e47366b5bd22144ee41b55ee216eebd5eb3cb3920c6cad6a9c769a2c71c81622660df060c691d84edb4d8d5f77988d07157f288d54b2d3b35727cc
SSDEEP 98304:mWe6nMiYeeDBBjVHUtgwqQXP4Dq18frP3wbzWFimaI7dlo3:m5QYee9BpHUOwBsgbzWFimaI7dlc
TLSH
T178569D51BE4E8176D91B1132472D9F2A1029BD28773865D3B2B43E7EEC323C16D3A61B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware backdoor discovery floxif persistence spyware stealer trojan upx

Malware Config

Signatures

Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/files/0x000600000001b6ed-1.dat	floxif

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 2 IoCs

resource	yara_rule
behavioral2/memory/3496-24-0x0000000000590000-0x0000000000B83000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/3496-461-0x0000000000590000-0x0000000000B83000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 2 IoCs

resource	yara_rule
behavioral2/memory/3496-24-0x0000000000590000-0x0000000000B83000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/3496-461-0x0000000000590000-0x0000000000B83000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

UPX dump on OEP (original entry point) 6 IoCs

resource	yara_rule
behavioral2/files/0x000600000001b6ed-1.dat	UPX
behavioral2/memory/3496-3-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/3496-19-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/3496-25-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/3496-436-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/3496-462-0x0000000010000000-0x0000000010030000-memory.dmp	UPX

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000600000001b6ed-1.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
3496	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe /onboot"	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000600000001b6ed-1.dat	upx
behavioral2/memory/3496-3-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/3496-19-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/3496-25-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/3496-436-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/3496-462-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
File created	\??\c:\program files\common files\system\symsrv.dll.000	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe

Modifies Internet Explorer settings 1 TTPs 22 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\Low Rights	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243"	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3"	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm"	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe"	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3"	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe"	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe"	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3"	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe"	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User"	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Model = "283"	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Therad = "1"	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1"	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter"	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan"	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3496	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
3496	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
3496	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
3496	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
3496	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
3496	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
3496	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
3496	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3496	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Token: SeRestorePrivilege	3496	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Token: SeDebugPrivilege	2256	firefox.exe
Token: SeDebugPrivilege	2256	firefox.exe
Token: SeDebugPrivilege	2256	firefox.exe
Token: SeDebugPrivilege	2256	firefox.exe
Token: SeDebugPrivilege	2256	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
2256	firefox.exe
2256	firefox.exe
2256	firefox.exe
2256	firefox.exe
2256	firefox.exe
2256	firefox.exe
3496	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3496	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3496	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
3496	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
3496	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
2256	firefox.exe
3496	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
3496	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3496 wrote to memory of 3516	3496	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe	89
PID 3496 wrote to memory of 5696	3496	2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe	90
PID 5696 wrote to memory of 2256	5696	firefox.exe	91
PID 5696 wrote to memory of 2256	5696	firefox.exe	91
PID 2256 wrote to memory of 52	2256	firefox.exe	92
PID 2256 wrote to memory of 52	2256	firefox.exe	92
PID 2256 wrote to memory of 52	2256	firefox.exe	92
PID 2256 wrote to memory of 2092	2256	firefox.exe	93
PID 2256 wrote to memory of 2092	2256	firefox.exe	93
PID 2256 wrote to memory of 2092	2256	firefox.exe	93
PID 2256 wrote to memory of 2092	2256	firefox.exe	93
PID 2256 wrote to memory of 1480	2256	firefox.exe	94
PID 2256 wrote to memory of 1480	2256	firefox.exe	94
PID 2256 wrote to memory of 1480	2256	firefox.exe	94
PID 2256 wrote to memory of 1480	2256	firefox.exe	94
PID 2256 wrote to memory of 1980	2256	firefox.exe	95
PID 2256 wrote to memory of 1980	2256	firefox.exe	95
PID 2256 wrote to memory of 1980	2256	firefox.exe	95
PID 2256 wrote to memory of 5828	2256	firefox.exe	96
PID 2256 wrote to memory of 5828	2256	firefox.exe	96
PID 2256 wrote to memory of 5828	2256	firefox.exe	96
PID 2256 wrote to memory of 5828	2256	firefox.exe	96
PID 2256 wrote to memory of 1092	2256	firefox.exe	97
PID 2256 wrote to memory of 1092	2256	firefox.exe	97
PID 2256 wrote to memory of 1092	2256	firefox.exe	97
PID 2256 wrote to memory of 1092	2256	firefox.exe	97
PID 2256 wrote to memory of 1076	2256	firefox.exe	98
PID 2256 wrote to memory of 1076	2256	firefox.exe	98
PID 2256 wrote to memory of 1076	2256	firefox.exe	98
PID 2256 wrote to memory of 1076	2256	firefox.exe	98
PID 2256 wrote to memory of 4380	2256	firefox.exe	99
PID 2256 wrote to memory of 4380	2256	firefox.exe	99
PID 2256 wrote to memory of 4380	2256	firefox.exe	99
PID 2256 wrote to memory of 4380	2256	firefox.exe	99
PID 2256 wrote to memory of 5384	2256	firefox.exe	100
PID 2256 wrote to memory of 5384	2256	firefox.exe	100
PID 2256 wrote to memory of 5384	2256	firefox.exe	100
PID 2256 wrote to memory of 5384	2256	firefox.exe	100
PID 2256 wrote to memory of 1136	2256	firefox.exe	101
PID 2256 wrote to memory of 1136	2256	firefox.exe	101
PID 2256 wrote to memory of 1136	2256	firefox.exe	101
PID 2256 wrote to memory of 1136	2256	firefox.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-10_aafe67c24b0131e5743c4c3aea39708c_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Windows\system32\regsvr32.exe
  C:\Windows\Sysnative\regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  PID:3516
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
    3⤵
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2256
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1948 -prefsLen 27097 -prefMapHandle 1952 -prefMapSize 270279 -ipcHandle 2008 -initialChannelId {e131f92e-4a19-4ad2-b5e2-a157b1cde06b} -parentPid 2256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2256" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:52
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2416 -prefsLen 27133 -prefMapHandle 2420 -prefMapSize 270279 -ipcHandle 2428 -initialChannelId {80482095-9949-46cb-bbe7-c2ec1779d0d3} -parentPid 2256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2256" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:2092
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3696 -prefsLen 25164 -prefMapHandle 3700 -prefMapSize 270279 -jsInitHandle 3704 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3712 -initialChannelId {5c06c7f9-f058-42fe-b10b-0d884715aca6} -parentPid 2256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2256" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:1480
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3860 -prefsLen 27274 -prefMapHandle 3864 -prefMapSize 270279 -ipcHandle 3952 -initialChannelId {dd2807c9-ecde-42e1-9b10-e861ff4b678d} -parentPid 2256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2256" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:1980
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4400 -prefsLen 34773 -prefMapHandle 4404 -prefMapSize 270279 -jsInitHandle 4408 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4416 -initialChannelId {5010d80e-968c-4385-b014-65b3510e9264} -parentPid 2256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2256" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:5828
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4564 -prefsLen 35010 -prefMapHandle 2844 -prefMapSize 270279 -jsInitHandle 4800 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5032 -initialChannelId {435c87da-d634-4312-81b2-89f4410efd2d} -parentPid 2256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2256" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
      4⤵
      Checks processor information in registry
      PID:1092
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5056 -prefsLen 35010 -prefMapHandle 5060 -prefMapSize 270279 -ipcHandle 5084 -initialChannelId {574ec399-41a1-47af-901f-cc812d1ae53c} -parentPid 2256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2256" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 utility
      4⤵
      Checks processor information in registry
      PID:1076
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5660 -prefsLen 32952 -prefMapHandle 5664 -prefMapSize 270279 -jsInitHandle 5668 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5676 -initialChannelId {cc94765f-6b79-496f-8318-191ea464b10e} -parentPid 2256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2256" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:4380
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5848 -prefsLen 32952 -prefMapHandle 5852 -prefMapSize 270279 -jsInitHandle 5856 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5868 -initialChannelId {64a83664-a996-4525-a851-0f2ece0dc750} -parentPid 2256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2256" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:5384
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5884 -prefsLen 32952 -prefMapHandle 5888 -prefMapSize 270279 -jsInitHandle 5892 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5900 -initialChannelId {15e0c295-a4b4-4843-b9f5-00f3292f8b26} -parentPid 2256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2256" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
      4⤵
      Checks processor information in registry
      PID:1136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

symsrv.dll

Path C:\Program Files\Common Files\System\symsrv.dll
Size 67KB
SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
MD5 7574cf2c64f35161ab1292e2f532aabf
SHA1 14ba3fa927a06224dfe587014299e834def4644f
SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
TLSH
T17863F1372AB5807DDD210D37949F835AB771E5A76C20643FC25907D988B8DD0E3239AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

symsrv.dll.000

Path C:\Program Files\Common Files\System\symsrv.dll.000
Size 114B
SHA256 aefc503b1ed462d7b6280228a7b5b710792273b78934426f88325341ac5b5a92
MD5 e609411db8aa6775d0344c75c23ae79b
SHA1 1d2ff6194bf159ce36cd0461cd3da29486d1e97d
SHA512 6884ff5c07bc687132c965a59cb8c5a898a25da74c6c846c1d6089ddca8007cb7e4d2f8520bdce9fbcf6e2f9c9e5c28d8c8d6d049d3522470bdc7d38bbfa0ad0
TLSH
T1FFB09262AA2791EAE1AA224505A0248C1ED0B62AB48638002EBA5A4E93256A85916147
MD5 SHA1 SHA512 TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\activity-stream.contile.json
Size 4KB
SHA256 33c9560315932a506f813b29f00aa76d6e731526680204ba296c52b8ec460559
MD5 7d6a23da100e9aa8a146e9bae8831a53
SHA1 2f48f55e2cbd26f2a3faa69529298ac366413550
SHA512 7160017593733dc738f600f16c85e6525f7292b97a5612a80e690e8a6039983cb2e7c6964236e26305f85cb8520b6bcbccee457bb5a6957542bb1a108d3fca97
SSDEEP 48:YdbA+8reDZyyd7WMDCpqLTio3Qjmqp4J48reDZBNyd7N1YQvGjy6T+jiRlQqOnqC:T5RMunjm2NOG3T+mR2qOnmyKFWbEolz
TLSH
T1B991E85B94644D131771EBD41C4B3A5CF117F05BDDF1EA98B23A8C22C1AD3EA90DA898
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 094e9feb2f07a9ef67f0decbedf9c1e3a06d63f9eed50fe2f7f34597da3cbfc1
MD5 234d5873af6492c9bc5338a343e010b1
SHA1 cd434b2e47be7f9717a55ba38387e728a01ec141
SHA512 c3ad18ece335750b6760843c5f062c9ee0a954add233290b3303bc2ea68de1eb68ea8b62e8939e00f1e4ede8161d76288dabe42b27448d581a1964c25221abb6
SSDEEP 768:NyC+QrCBiA9K28LMRO51viBWWOTOOWHu+GHvXEJmMm8Y:cC3QP9K2rROJQ3OTTWHfGH8Y
TLSH
T187730AA3A7E8B2BB0B9137CB2C0F796B62D10155E78605CDECEDC91C81CD754523E6A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E9338C5CCF1E2FCF149487351399F198A4F9FCD6

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\cache2\entries\E9338C5CCF1E2FCF149487351399F198A4F9FCD6
Size 16KB
SHA256 41d0421bfa48240d2e3c4b4290167fb6ca620765579a467d30a29f06e941670e
MD5 6aff950472f781a7e2a1a1e179cf447b
SHA1 5fdf6ecd738d4fb147f4107a96252967fd924de6
SHA512 1f55e7e5a2778954bb013d32c661572904d3c1b7482ea1c8c880c2c3e1992cc40054a59c95c87aeda8515cbdef1fe09ac0e1791a947c99a8346a48d97fc068d4
SSDEEP 384:HGNQiO024YfWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMAQ:mDZYfWTToXJWTTogB7S/AmVAf+hRMJ
TLSH
T150729F7D8F013CAD175780E9C8B543598D18B7A7DFB6C02D269C3D09C988A1671F945F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 7d6404a2544e1032c7114062118e249ea59685bbadf0adbad26cdcc0e8b64bc9
MD5 2d43b6ecc9363e4bef99e21a7e321563
SHA1 55645548bf243c0972d7f0fe4650f0e4ac00c7e9
SHA512 cc746d6d883af98b0bbdd8e15b567e78009cd8e1a6d4fe063c962c6b7d7ab401a0663434cdefcd8c869ff511700fabb1579c6cc153941e3b22b7a5938f173f9e
SSDEEP 3072:j3lyHCqh/oyTfFe9yGZjePAYa25vxI2nyZ6bErA:pyRhQyb+fNeYYV5nETA
TLSH
T14DB3AEB6DFA28D3D55FFD01C6B82C83EF9266444F3E72009C963632462C6B787679648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 ae0ca3e477ac47eae5cf1528021b73976749519fc22c0607895e2666e5ae5b51
MD5 bd2c14d29e1be03af546c7cee19cf8eb
SHA1 b465fcd2842b7dffbc486adeaf4e13c5d0ea42e3
SHA512 e02adfaade365dbde354d2cff7c6a470644c8b0b43f5eade82a3b54cbcaf6eefb769176367bb1f83761b10d2e2d8e1aae267e85bdd6b0633df2179a7dea54097
SSDEEP 3072:X3lyHCqD/o2lf+0fnPXFVf8OjePAYa25vxI2nyZ6bErl:FyRjtf+MndVECeYYV5nETl
TLSH
T162B3AEB6DFA28D7D55FFD4186B82883EFD266404F3E7200AC923631462C7B787679648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 21.6MB
SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
MD5 40bf410fa9ef0d5499907e34885af6f4
SHA1 4d7722337a0e26bf4a1c6478129356acb2f7b720
SHA512 b763712aa4bd9819b7972a40216c08fd32338b14fab7ce4b166e39ce441ad62678bf0e1f25da436ffdb56ff1b1a21e3dbbaf47c0f5918c252e70656f5d0307ac
SSDEEP 393216:KYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHY:3mghF5QDwWCm/2YU8Ivq9u5P
TLSH
T14F37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addonStartup.json.lz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\addonStartup.json.lz4
Size 4KB
SHA256 51ff4007fc4cf6c259b73dd149f3b72e41a33d9ee0a005fd9f9978a84f8ace7c
MD5 a5060baca7f5a3df637b8c5d9a10b28e
SHA1 c6a2315bc12fe9b7e02fc4220e180f528de9274d
SHA512 08e325f1c71362ba44a783cb050f2395e6a9ca5f19177eebd0e234cf8b05a998e4e7f325a3073b8d7fb0f9e5a14decb015f4f4a342af0b9aee75c41981c8a8cd
SSDEEP 96:NbfYb4sHNw6M2xWGhD41MgGvmHhF+rUpO1LnOYvhQhIRhN:NbwW52xxhD8rGvm6ApwnHUuhN
TLSH
T157A17DB6D541EFB2FE32C04358D93FB2EAA6AB3424A9C4D4F16EB1294D64A731704340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

store.json.mozlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\crashes\store.json.mozlz4
Size 66B
SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
MD5 a6338865eb252d0ef8fcf11fa9af3f0d
SHA1 cecdd4c4dcae10c2ffc8eb938121b6231de48cd3
SHA512 d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c
TLSH
T175A022C28E0C83BACF000833008AF00300E83B020B8B0F882AC2AEF8200200C8082082
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 610da241b4d6a1e080f0f21b32ee71846266f7df3b9e51aab58629b4a6b9e63f
MD5 6c29bbb147b403e86bbbef3dc1429582
SHA1 0be6824ea0f7ee5494037d71c41d1bfddbe01856
SHA512 62414c0eae83b9828f36893feb0421f567f17f3a7ad3e8cd1ffa63ea8ac760c2424e6e4d3979393da196b4fb290c0b2543f8ae9d1e500097b4a3ee301c7c13fe
SSDEEP 192:q1d66JoztdzgCl6mc0dIOv5zbo7mZMoyj56mm:Ud66Joz/zgC1jpbo6ZMoyjUt
TLSH
T189E11F64EA29863FC408037BDCA52F410F39399B984E3F19359CA5182D5B2DE3B9E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 6dd887971dd0679dfc63d2404f7474096a64fabbd6df067d846eccf6944c6d96
MD5 891ec9cfb5a948c8ee5b1623b2010554
SHA1 b46dca7276ea1c9cfb7e10f7b714c07eb6c73b85
SHA512 cb7f32f9d8848213ca7b1322812d96435fe66ad64ae2d9ee18640a5da092868c9fa6693b5429f19f2860029f1368e4f717b430740f0e248c6a4034636d86f837
SSDEEP 192:j1d66JoztdzgCl6mc0d8Ov5zbo7mMMoyj56m:Bd66Joz/zgC1j9bo6MMoyjU
TLSH
T191E10E64EA29863FC448037BCCA52F410F39355B984E3F1935DCA5082D5A2DE7B9E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\datareporting\glean\events\events
Size 1KB
SHA256 0e9a5cb507adfe8ad6d2ec34530e61c3ecdc4ee21a8d32806d44ad1c7ce4efbb
MD5 4c8fe0e787c4e40d5dafdd0e1832deff
SHA1 2d401531f0a9654b4cfd20b3a6d6fe954fb64380
SHA512 a8e120a0528e57dd8775abbf50a2aaa6df9f8e93cce4e96497307bab3ee10c64599ea871a880668c5140f5cc104e633dd19fa967c26f67f38fd3cf55a68a9f21
TLSH
T1FA216A4CB6B88D2B68C7E6AC7481128E93954E0B65871C4F5D12DF8CCC85AD933EA4B8
MD5 SHA1 SHA512 TLSH

Submit Download

4df91f92-49c6-4e3f-bd47-ef7b43662765

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\datareporting\glean\pending_pings\4df91f92-49c6-4e3f-bd47-ef7b43662765
Size 2KB
SHA256 11a9c2976c9d35f7be7f10605b3ef3a830e49630521825b51c8a3c44ab42296e
MD5 ce61c63b2db35b1d74bf70f07ff17ae9
SHA1 7b80710689d8e3fa1d1c924440d32796537ee4e3
SHA512 337be57839f4107713aad3015bab1f1fc54a7bcb0622f9e3b819c0edbcde64dc407fa5606260ce143c6a4ea68aa2739c55574fafa178e39c4f5d028ca145e042
TLSH
T12641452836B85DBB8CCAE15DA491334E53A08E0300C628435D91EF4CCD9679D736B51A
MD5 SHA1 SHA512 TLSH

Submit Download

66a43755-f690-427f-a378-a2e5320c228a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\datareporting\glean\pending_pings\66a43755-f690-427f-a378-a2e5320c228a
Size 235B
SHA256 a1f90758c6d123aa0a83d18c65dd834dcf0b148e855ea69411e07273311a7d05
MD5 77ed82859a46c38b2ac83e61586f88b7
SHA1 deecabfdd7bdcdd50e6b4a5b77db08f326f1f65a
SHA512 623ef6a87879398c47893e326620bfb18b4c219b495ac2dca0a5ac3405f2523ac7452c6c40a77be1c5a05a8c3f6d2df0ff2f3236335615ab0da59d3af9ed8bb8
TLSH
T13ED0978018DCBBBE88080F07B0E028CE30848C3334A86810D65285BD89FDEC8419280B
MD5 SHA1 SHA512 TLSH

Submit Download

6838a879-50cd-43a9-8579-b8eecff1fa91

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\datareporting\glean\pending_pings\6838a879-50cd-43a9-8579-b8eecff1fa91
Size 883B
SHA256 7fdac5011e64d42a91d19b0ead9720f1306425333f7d073a318221b404ac0439
MD5 2110e1a7b1f45140e6fc32d86dd89f0f
SHA1 cfcaa5a86c11b76d6ea4d9bf449be629e6c194a5
SHA512 583c64888036405043137ea06c885fbc4f3b7c3e0e3c82d761840bfe556b712fd3e11787fadb4f1104d0a9d8091ba39acc764e2e3558956f871d8ddaf0f2cc0b
TLSH
T1E411C4509636B9B3CC6CD25FC59537474BA4762380CA88082DE1DE180C6EA1DA77770B
MD5 SHA1 SHA512 TLSH

Submit Download

6d007465-6309-430c-9d62-153ac128a542

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\datareporting\glean\pending_pings\6d007465-6309-430c-9d62-153ac128a542
Size 886B
SHA256 117168aa7975e1948acd1c7d653c8e061fa2cea424f455f2c3e122d42f80c6a9
MD5 63b79528cb374add8d94ec622751bfd1
SHA1 260e011a5858ee4842c189cc5020af2f24ab15fe
SHA512 7175072758804f645035a8066c00d2a68813dca70313477aec5b514a342bdef6d6bdd39e7807d112758225aa2bda70dff26fd6e43c18f3df4d485e6d2fd5efb6
TLSH
T17511D0504A25B5B3CC6CD25BD4A0774356A4652380CA4C083D94DB180DEE61EA36770B
MD5 SHA1 SHA512 TLSH

Submit Download

e36de9b1-8834-4935-95de-60858283b699

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\datareporting\glean\pending_pings\e36de9b1-8834-4935-95de-60858283b699
Size 235B
SHA256 b54b887d549ac9f251dbb9bb555b922dbb5155cf62660528b8d8da4eda91ffce
MD5 29cd8321d3f21db643d4084e34aadb51
SHA1 aebbae755667e170cba029ec84f34cea5191cf94
SHA512 9bf5e3a42ac303cbfb82479b28bf5cacce483174781a2ed7be694f9e7f0d009e5d383b6ad1daff134e63880f288456d7064c18b26aba86fc292a007727a09bcc
TLSH
T127D0A7A024986B5D09158F17F0A56ACA70598C3728F49814E6A14778ABBEEC44151D57
MD5 SHA1 SHA512 TLSH

Submit Download

f06dfbb9-2f32-459d-a7e1-0fa698ee6031

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\datareporting\glean\pending_pings\f06dfbb9-2f32-459d-a7e1-0fa698ee6031
Size 16KB
SHA256 ffd72b92e2bfa07d2f69e3a820a0e4fc0bd5519c0d3eb5e9c15e44a2b27be800
MD5 cef08dce40fb3bdc1c00de8c3bd3a2e1
SHA1 1ed8cef7b51d7aad27ca9b3523eb0e2a28b6b1ad
SHA512 483348f3a232159a66e9df7add0c72e55241e6417109d1bd25939a0ea84d8282ab0cd9b925380b9af528f31d8ee859d15ba83eab0d9ec8aa77246293899db228
SSDEEP 192:la9oUNxjWoAN55DSWUHPa1YuBQ9uezjNzPm+M7NwcIMoUPuKzZtcpAjbF8HSjpuC:PYxjWn5AWUOy9uazCF18HxBo7i5DvSf
TLSH
T10172DA56286045BAC291E36998FCBFC7E1F628CF4C419FCD9BE4BD0859DE06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extension-preferences.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\extension-preferences.json
Size 942B
SHA256 00dc2290dbbdce30a85e06ded26d7ee786412fa45c1348a801bfe2c13b9c63d0
MD5 b9aeb15420f1636d61ab0f72e3852464
SHA1 34f4c6b664d0d5b663678c1552686723e8cd9cbd
SHA512 f5d138a42649ea001273d8f516dd0e5f91aae04ccedcaa1da9a27e3f5aed14859f02733629a52af8c98fee0b5dc70998b4c27821fb8a459349eef4b1dc15b14d
TLSH
T15411F13A640B6EB01E8E5625FE384A92E791111B50B7F2E47E69934A13D3970C1ED39C
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\extensions.json
Size 14KB
SHA256 0b4bf999b598dea81cd1f149dc2a54fcddc282670c35cd0f674bf677fd10ceb1
MD5 9b8cbce843e8c026fdb706b7d9c276a3
SHA1 d30336e988892c0f2f3e6e49c42d138c9963ed33
SHA512 17d2d08ed2be406a2486ff757cf5065a1d3bac9156d138e40654096668d139d58364c3f70ccfee0a575b28efe4a758049062af2903a29b975fce4ab6c7730469
SSDEEP 384:XkI4vnUmldvf8dhWF94z096o1L4H3L4P7L4HAL4HkL4HC:0I4vRfMXI4s6K4b4P4C4e4i
TLSH
T1E962431545049EB8298FA79BAA367E02C37D473B60445C78F4DD8FC842FA5B902FB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll.sig
Size 1KB
SHA256 c5f50bed6afd38490baca2ce8e8fdd1a39849c9f0dc06478a8a2e9226526607b
MD5 61d51cf075ad6dcbaaebf956c6bc1dcd
SHA1 f176331dcdb84327afd47ecf8ede3b0664c7d05a
SHA512 de263ed43f1112786186afa7bb942f25482fe60b04e7138c3687ec09956e0247307e5a6303a4297f785a572ed9a0059747a9b870c2fb6e84483373cfe27ca6c5
TLSH
T1C421B6DDAD2426542DC0EB2D5EF8E826DD3112C2F96404BB426666C3FCA3BA038C466D
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\prefs-1.js
Size 6KB
SHA256 37bf10898049d38f6ab9b2a7721cf4456fda7bb70190f2f29bc729480303248d
MD5 b9891dfbdc8306b6a6998abd3580c767
SHA1 0346311d85750ababb847ecab7ff12add14dcfaa
SHA512 1450fa8755a9173c452f96e5af41d88be6a594ec8c54a408ca10047b9695722e14ca2f58ef4e09b21f52f63c9d3cd4e4f76e9bf891ec8d2dfe3143670d101ab6
SSDEEP 96:xHMUTU2qGqmvfulK1zSM9SSledv9jeKn2rHtQqMBw88u8L4cncQ1CKQ:2RRIfulKN9SSjBTtaBw88zMb
TLSH
T1BFE11E789508CF6F64B677BC6C6888715AB2013BBBBF68D750BA4484050CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\prefs.js
Size 6KB
SHA256 43347364374adbd2751a295b011098323c3c57074673ba1bdb5cf1893f27e552
MD5 0e45d11fec71745779e7f82e39cfa524
SHA1 06722f753a49841e7c218530f61a7ede5d6d5378
SHA512 e0bca7b544f67f4acbf75ec65b688eb7b530941e7941f1f4e577738f60c86842e3d437e7f953567fc6bd531f05465c431ab49c93873c071817745b7cc02437a8
SSDEEP 96:xHMUTU2qGqmvfu9H1zS5SSledv9jeKn2rHtQqMBw88u8L4cncQ1CKQ:2RRIfu9HESSjBTtaBw88zMb
TLSH
T1E3E12F789518CF7F64B6776C6C6888315AB2013BBBBF28D750B55484050CF3846F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\prefs.js
Size 6KB
SHA256 54fe9f3655e7c398b4a4bf78f4da3380adacd0d42e6b13b1d34073170284725a
MD5 b30bf03d9ae9650b57d7a949ddf45c22
SHA1 44a72e0e30fc0dd4ee75e2c42fe5cdaecd9a9e82
SHA512 cf2fa5e5d8fccc47e89a5f3ee4fa43bee4884b13e1e2d4e3b155913231475e1dd023105e8f0a477502a9b9f882e636d8f5b6181200f6c9d38f75440f9d21c1a4
SSDEEP 96:xHMUTU2qGqmvfulKObzSM9SSledv9jfn2rHtQqMBw88u8L4cncQ1CKQ:2RRIfulKG9SSrTtaBw88zMb
TLSH
T193E11E789508CF6F69B6776CAC6888315AB2013BBBBF28D750A944C4050CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\prefs.js
Size 7KB
SHA256 85c32e5136a2073413ba43901057b893ef73bcc5b8fb50391a6b7a6b653b6313
MD5 2995b865e75ce5726dd900783c3b0b4e
SHA1 0df379c1acadd6257300108423300055240b5888
SHA512 dd54fe48a6c1b7594b9e0d63458ccfd59a96db2d3ed5ed4fcdf5010de633e031c193c59449b0ceedc4f89537be371e962d7b5c018f2b1f3a3b7064fb5046d317
SSDEEP 96:xHMFTU2qGqmvfglKObzSM9SSledv9jfn2rHtQqMBw88Z8L4cncQ1CKQ:2QRIfglKG9SSrTtaBw88eMb
TLSH
T1E9F1ED789504CF6F64B6767CAC6888315AB2013BBBBF68DB50B944C4051CF3446FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 bb80a7e6145e5bfa8380daafe68dce132ecf432cfc521275d2d2dfacbdbd48b8
MD5 62d7d9fa55212edca093d79f59ee0143
SHA1 7f429596c779fccb5fcd3080de2e6e34ce338559
SHA512 e70ccba6bda4881cc7c7e4fdc27cbea286fdbe6b1d8924d844710d7ca91bf50a1d273e248732e72509a046bab769083ed140c63f4a4333511fd5e494f99fa4ed
SSDEEP 96:dmf+Yi9wUFqCeW9jILA0NjoB8kMJttn0YJZQbB:Oi9CyOnNcB85JttnTZAB
TLSH
T1D8917D06371B2C67F95B968FEF558CA201A4300A65C144ECD0CF7B2AB26BB4B35A85B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hjr3qzeo.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 33767b56b147df21d5a417642eab16c4106013ba3b80be4dfdf3bef101205612
MD5 abc7c341716137e5404c0b71f3ef03dd
SHA1 3e26026836e2cb274012588eeaef40f0ab3e6875
SHA512 de516afdad5152f2d8809c327b4009f93e11a4858a0a7ddb6788d48252effb2327e4b58274dd49fb19d36ef52dfdd852f4897f929c516da2f2ef754c8653c97b
SSDEEP 96:dmf+Yi9wUFq2eW9jILA0NjoB8kMJttn0YJZQbB:Oi9CGOnNcB85JttnTZAB
TLSH
T1AF918D06370B2C67F95B968FEF558CA201A4300A65C144ECC0CF7B26B26BB4B35A85B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download