floxif | 21cc8c8ba2dee20b64015628dfd2b135afe5fcacf53e5f494d6bd96a587e8262

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 01:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Size 6.0MB
Sample261014-cet7csty9l
SHA256 21cc8c8ba2dee20b64015628dfd2b135afe5fcacf53e5f494d6bd96a587e8262
MD5 ee6b6c812cb4202fde18a3abc16bd0f8
SHA1 f206c3155a6864850e27a676559707b7f17f3796
SHA512 e8aef6dca079028ac3c523b58b62b956e116e1f704a9f59c35a250b8c008285ce62f5c445592e6513ebcc6ba4ac963818edc4d858ef46aa294f0991b6e702777
SSDEEP 98304:mWe6nM2aeeDBBjVHU3gwqQXP4Dq18frP3wbzWFimaI7dlop:m5Iaee9BpHUQwBsgbzWFimaI7dli
TLSH
T1B3569D51BE4E8176D91B1132472D9F2A1029BD28373865D3B2B43E7EEC363C16D3A61B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware backdoor discovery floxif persistence spyware stealer trojan upx

Malware Config

Signatures

Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/files/0x000e00000001b2f6-1.dat	floxif

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 3 IoCs

resource	yara_rule
behavioral2/memory/5808-24-0x00000000008B0000-0x0000000000EA3000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5808-428-0x00000000008B0000-0x0000000000EA3000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5808-792-0x00000000008B0000-0x0000000000EA3000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 3 IoCs

resource	yara_rule
behavioral2/memory/5808-24-0x00000000008B0000-0x0000000000EA3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/5808-428-0x00000000008B0000-0x0000000000EA3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/5808-792-0x00000000008B0000-0x0000000000EA3000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

UPX dump on OEP (original entry point) 6 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001b2f6-1.dat	UPX
behavioral2/memory/5808-3-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/5808-19-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/5808-25-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/5808-394-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/5808-429-0x0000000010000000-0x0000000010030000-memory.dmp	UPX

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000e00000001b2f6-1.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
5808	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe /onboot"	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000e00000001b2f6-1.dat	upx
behavioral2/memory/5808-3-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/5808-19-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/5808-25-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/5808-394-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/5808-429-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	\??\c:\program files\common files\system\symsrv.dll.000	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
File created	C:\Program Files\Common Files\System\symsrv.dll	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies Internet Explorer settings 1 TTPs 22 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243"	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe"	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3"	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3"	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm"	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Low Rights	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe"	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3"	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe"	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe

Modifies registry class 16 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter"	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe"	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan"	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User"	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1"	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Model = "286"	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Therad = "1"	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5808	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
5808	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
5808	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
5808	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
5808	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
5808	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
5808	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
5808	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	5808	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Token: SeRestorePrivilege	5808	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Token: SeDebugPrivilege	1104	firefox.exe
Token: SeDebugPrivilege	1104	firefox.exe
Token: SeDebugPrivilege	1104	firefox.exe
Token: SeDebugPrivilege	1104	firefox.exe
Token: SeDebugPrivilege	1104	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
1104	firefox.exe
1104	firefox.exe
1104	firefox.exe
1104	firefox.exe
1104	firefox.exe
1104	firefox.exe
5808	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
5808	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
5808	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
5808	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
5808	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
1104	firefox.exe
5808	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
5808	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 5808 wrote to memory of 5864	5808	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe	89
PID 5808 wrote to memory of 4884	5808	2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe	90
PID 4884 wrote to memory of 1104	4884	firefox.exe	91
PID 4884 wrote to memory of 1104	4884	firefox.exe	91
PID 1104 wrote to memory of 4584	1104	firefox.exe	92
PID 1104 wrote to memory of 4584	1104	firefox.exe	92
PID 1104 wrote to memory of 4584	1104	firefox.exe	92
PID 1104 wrote to memory of 5408	1104	firefox.exe	93
PID 1104 wrote to memory of 5408	1104	firefox.exe	93
PID 1104 wrote to memory of 5408	1104	firefox.exe	93
PID 1104 wrote to memory of 5408	1104	firefox.exe	93
PID 1104 wrote to memory of 3408	1104	firefox.exe	94
PID 1104 wrote to memory of 3408	1104	firefox.exe	94
PID 1104 wrote to memory of 3408	1104	firefox.exe	94
PID 1104 wrote to memory of 3408	1104	firefox.exe	94
PID 1104 wrote to memory of 5876	1104	firefox.exe	95
PID 1104 wrote to memory of 5876	1104	firefox.exe	95
PID 1104 wrote to memory of 5876	1104	firefox.exe	95
PID 1104 wrote to memory of 4456	1104	firefox.exe	96
PID 1104 wrote to memory of 4456	1104	firefox.exe	96
PID 1104 wrote to memory of 4456	1104	firefox.exe	96
PID 1104 wrote to memory of 4456	1104	firefox.exe	96
PID 1104 wrote to memory of 944	1104	firefox.exe	97
PID 1104 wrote to memory of 944	1104	firefox.exe	97
PID 1104 wrote to memory of 944	1104	firefox.exe	97
PID 1104 wrote to memory of 944	1104	firefox.exe	97
PID 1104 wrote to memory of 5656	1104	firefox.exe	98
PID 1104 wrote to memory of 5656	1104	firefox.exe	98
PID 1104 wrote to memory of 5656	1104	firefox.exe	98
PID 1104 wrote to memory of 5656	1104	firefox.exe	98
PID 1104 wrote to memory of 4916	1104	firefox.exe	99
PID 1104 wrote to memory of 4916	1104	firefox.exe	99
PID 1104 wrote to memory of 4916	1104	firefox.exe	99
PID 1104 wrote to memory of 4916	1104	firefox.exe	99
PID 1104 wrote to memory of 3560	1104	firefox.exe	100
PID 1104 wrote to memory of 3560	1104	firefox.exe	100
PID 1104 wrote to memory of 3560	1104	firefox.exe	100
PID 1104 wrote to memory of 3560	1104	firefox.exe	100
PID 1104 wrote to memory of 2712	1104	firefox.exe	101
PID 1104 wrote to memory of 2712	1104	firefox.exe	101
PID 1104 wrote to memory of 2712	1104	firefox.exe	101
PID 1104 wrote to memory of 2712	1104	firefox.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-13_ee6b6c812cb4202fde18a3abc16bd0f8_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5808
- C:\Windows\system32\regsvr32.exe
  C:\Windows\Sysnative\regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  PID:5864
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4884
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
    3⤵
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1104
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1964 -prefsLen 27097 -prefMapHandle 1968 -prefMapSize 270279 -ipcHandle 1940 -initialChannelId {0f5cbe32-5b53-4f47-b518-50e4a0f34bb1} -parentPid 1104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1104" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:4584
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2436 -prefsLen 27133 -prefMapHandle 2440 -prefMapSize 270279 -ipcHandle 2448 -initialChannelId {9ec47faa-ae98-4a85-ace4-753769e3ab5a} -parentPid 1104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:5408
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3844 -prefsLen 25164 -prefMapHandle 3848 -prefMapSize 270279 -jsInitHandle 3852 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3860 -initialChannelId {91bd578d-b16e-4b2d-8802-1f131f9b942f} -parentPid 1104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:3408
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4012 -prefsLen 27274 -prefMapHandle 4016 -prefMapSize 270279 -ipcHandle 4100 -initialChannelId {43ece1aa-719b-4900-8420-0791310ceefb} -parentPid 1104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1104" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:5876
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4456 -prefsLen 34773 -prefMapHandle 4460 -prefMapSize 270279 -jsInitHandle 4464 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2576 -initialChannelId {de1b3819-1d90-488f-81dd-63f728445c97} -parentPid 1104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:4456
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3232 -prefsLen 35010 -prefMapHandle 2680 -prefMapSize 270279 -ipcHandle 4972 -initialChannelId {484475b8-d521-4227-9e0b-273a4a1bba3a} -parentPid 1104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:944
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2908 -prefsLen 35062 -prefMapHandle 4728 -prefMapSize 270279 -jsInitHandle 5468 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3176 -initialChannelId {709842b3-9bff-4b8e-8d29-227679ceac87} -parentPid 1104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:5656
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3892 -prefsLen 32952 -prefMapHandle 3856 -prefMapSize 270279 -jsInitHandle 4024 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2652 -initialChannelId {d76dd4b3-bd51-4657-bc51-c37a39198d73} -parentPid 1104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:4916
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2572 -prefsLen 32952 -prefMapHandle 5624 -prefMapSize 270279 -jsInitHandle 4960 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5696 -initialChannelId {64bf9ab1-d047-4532-85c2-9662974a048b} -parentPid 1104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:3560
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6008 -prefsLen 32952 -prefMapHandle 6012 -prefMapSize 270279 -jsInitHandle 6016 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6024 -initialChannelId {7919b6e0-5593-4919-8f8c-77a9eec64b2f} -parentPid 1104 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1104" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
      4⤵
      Checks processor information in registry
      PID:2712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

symsrv.dll

Path C:\Program Files\Common Files\System\symsrv.dll
Size 67KB
SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
MD5 7574cf2c64f35161ab1292e2f532aabf
SHA1 14ba3fa927a06224dfe587014299e834def4644f
SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
TLSH
T17863F1372AB5807DDD210D37949F835AB771E5A76C20643FC25907D988B8DD0E3239AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

symsrv.dll.000

Path C:\Program Files\Common Files\System\symsrv.dll.000
Size 114B
SHA256 aefc503b1ed462d7b6280228a7b5b710792273b78934426f88325341ac5b5a92
MD5 e609411db8aa6775d0344c75c23ae79b
SHA1 1d2ff6194bf159ce36cd0461cd3da29486d1e97d
SHA512 6884ff5c07bc687132c965a59cb8c5a898a25da74c6c846c1d6089ddca8007cb7e4d2f8520bdce9fbcf6e2f9c9e5c28d8c8d6d049d3522470bdc7d38bbfa0ad0
TLSH
T1FFB09262AA2791EAE1AA224505A0248C1ED0B62AB48638002EBA5A4E93256A85916147
MD5 SHA1 SHA512 TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\60jcq5gl.default-release\activity-stream.contile.json
Size 4KB
SHA256 dc7251326c98b18b7541d68affa265f3ac2e170dd9b520b1a37bf9efa86dd7a1
MD5 0cbf16a238a34b3adc0c00c773a16352
SHA1 6c82f24ecb1620f79812d565c99a333e67a38a84
SHA512 33919427cc32fb194176f0260571c16f566c53162fb7aaa5ce066ac8eac437ec47a82799cf87994139e0b8241dc57a0b046c7c77d70689993f79d952226d6865
SSDEEP 96:T5fEj6MuycImPfO3jRVVT+mRAcOonywfPji/LcNlz:Nfg6MXcIyfOzRVUmRAcOoywfri/LcNF
TLSH
T184A1C9978C684886173195E61C0F22ACF113B00ADAF4CE7DB1BDDD6295AC7E980DB989
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\60jcq5gl.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 822c1eabffe09c8026584b3df597a824137f78f6bc90a2b7414a2fa656be5047
MD5 41620330b452f40c962fd820ae8001e4
SHA1 808e98c91ae420467cf6d3390264c665e490c9cd
SHA512 79a86943bdfd7deda79d0e41950f3913f5a2ca34ec7e80d5b47273bdd10a7f0b05e6e4915329825aad05a13ce4ed963fba1f405d0a0a85edd534a9f4f6d314af
SSDEEP 768:Yy40gnnxS0yIfnWvX7uvXiU51vbWEqc+GSOOrbvyxJmSJaOeO1:jLgE0yIfkuvXlVbWEq9GlaVO1
TLSH
T1257319E3A6E9B2BB1B9077C71C0F799B66D20145E38606CCFCEDCA1C81CD754423A5A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E9338C5CCF1E2FCF149487351399F198A4F9FCD6

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\60jcq5gl.default-release\cache2\entries\E9338C5CCF1E2FCF149487351399F198A4F9FCD6
Size 16KB
SHA256 5652750d44f68d8ecaf9fdc3cf5a855bdcc4ba4350e4762975383dd7eb24a4c5
MD5 0847cd075889c6110f1ee5960bb5d5bb
SHA1 56ba7d31c3ae9a5a732ed0dfef1c1e7aba175b04
SHA512 c50fb6217a37beeb57bd92c973f1f34e17e33c4b6ad73c204f423dabfdcd03b466c611dc8449c258fadfb2162676320e4c03db530d53abcce678cd1909dce090
SSDEEP 384:HGNQiO024Y2WTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMAL:mDZY2WTToXJWTTogB7S/AmVAf+hRMO
TLSH
T1CF729E7D8F013CAD175780E4C8B983598D18B7A7DFB5C06D26883D09C984A6A71FA45F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\60jcq5gl.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 eb1aa905b830709d27e2e85d5bccce488bcd3ad4e46fb57a5320cf637d4df2d6
MD5 04c402418c5ba0f4fded5a7080fae9bd
SHA1 4051958aa77508dbe8ad58bde38d2b51f8a306ca
SHA512 094b70db182a597a7ea5d47e2e80fa7e923bcce34f7f5368ded3614816adc07c11f1463b79e73ba5230380ed064ea2bab3e7eef62cb3e3627e17258aec32df2c
SSDEEP 3072:j3lFcspjcbIlXYLtGM4MnufkCPTubEsTnn+VDp:pFPUIlXYLtyVfkCP3Vl
TLSH
T105B3AFF6DF92CD7D54FF942DAA82893EFD276400B3A32009C8536315A1C6BB86679748
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\60jcq5gl.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 578a133dbf26d7ab3c33950d8ba4bf16aad300ce26f5692c184b0ada33a3a437
MD5 74c3905bb1c307544a8fa8a520e9a01a
SHA1 266d630b4bebb63961dd0684842f56d686f087ee
SHA512 a3d636da552259db7dc10320e4a1aaaa7071f1764d98c0a1f0f5c3f82274a7098b83820eeae87c110e8e3049b77cb11806170d684909be6b022fe49657c7ca3a
SSDEEP 3072:X3lFcspjcbeZiLdQYLtGM4MnufkCPTubEsTnn+VD7:FFPUeuCYLtyVfkCP3VH
TLSH
T16CB3AFF6DFD2CD6D54FF942DAA82853FFD276410B3A3200AC8536314A1C6BB86679748
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 21.6MB
SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
MD5 40bf410fa9ef0d5499907e34885af6f4
SHA1 4d7722337a0e26bf4a1c6478129356acb2f7b720
SHA512 b763712aa4bd9819b7972a40216c08fd32338b14fab7ce4b166e39ce441ad62678bf0e1f25da436ffdb56ff1b1a21e3dbbaf47c0f5918c252e70656f5d0307ac
SSDEEP 393216:KYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHY:3mghF5QDwWCm/2YU8Ivq9u5P
TLSH
T14F37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addonStartup.json.lz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\addonStartup.json.lz4
Size 4KB
SHA256 fc9c68d43469eb79341b42ffde8bd326631ca038ba126f71ff5abab4c66fedc7
MD5 bb656cce712a60559dc59ed860ceb936
SHA1 b0f4436de71b0909ccb7e598986829ada4f85484
SHA512 e857002c3d90956e6cd4ebce4a5cc925c0dc1e2af16a8ea1fe8b941e2fa4e9c0ed2cd453fbe47092464c44b7bb65071875854b8892aa14bc6639e28c77d47a71
SSDEEP 96:NbQf4sHNw6M2xWGhD41MgGvmHC+rUpO1LnOYvhQhIRhN:Nb752xxhD8rGvmjApwnHUuhN
TLSH
T130A18DAAD541FFA1FD32C04348E43FB2E699AB3424A8C8D4F1AB71290D64A735700340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

store.json.mozlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\crashes\store.json.mozlz4
Size 66B
SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
MD5 a6338865eb252d0ef8fcf11fa9af3f0d
SHA1 cecdd4c4dcae10c2ffc8eb938121b6231de48cd3
SHA512 d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c
TLSH
T175A022C28E0C83BACF000833008AF00300E83B020B8B0F882AC2AEF8200200C8082082
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 36c2973fa0e280a7095d406539df17af2bf76a39368c02d49f3d4eb7debe59d0
MD5 7c9619384680a34a354430f0a416f0e5
SHA1 16186ddee0ca83876e27f4c2d201ed588927e44e
SHA512 1bc53fc5be8ffeae9273f3d49defeb3b85280b3ccb050229e687935db349c8a6e0f9d352a08ca062e857dcde70f46a56d8800d5ff6369522c65818f9de944143
SSDEEP 768:/1lhEe1s7cfGcm+ukcK/MRctp/8mtbeb3bnbH2Fv:/hEe1s7630R8
TLSH
T13CD2F044EB1E913FD41812BBDCA54B002F79B88A58192FA73A4C646C6C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 b319c65f346101322aa28a366ec37ee1f7d9b6795102256fb342a8ffd9b410f6
MD5 3c0195d1e259a22907b3be4adee31a36
SHA1 5a1a44507242c24b95ebcd74e5a444511973bf07
SHA512 1b55d919ac6a5676912915cbe8b496b7867affd66b86aa54433e799b3ac6db8f8ce91238940a2f09310df0ba71c65e2d106e1899328b8c5e5abae83a82e72c4f
SSDEEP 768:/1lhEe1s7cfGcm+ukcK/MRctp/8mtbeb3bnbHwiM:/hEe1s7630Ry
TLSH
T143D2F144EB1E953FD41412BBDCA54B002F79B88A59092FA73A4C646C6C872DC3D9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\datareporting\glean\events\events
Size 1KB
SHA256 6b3888751d9142dc5b5adbe4da225e347e05dbc385d86f430dbb949d235d0dfb
MD5 c022b94766996cb1655c91e50f5135ad
SHA1 d84db414353f45cff7e5aa70e01dba7f280397b3
SHA512 e58896e62c81247445487936116aa815a304a84faf8c4e3c651e9d9a0e3220bedd8f71ce929bf3997fe7b19f7e1205d3a88274243f7d9858dbf8159b9952d95d
TLSH
T17B21794C39B9AD2AACC7FAAC7481068F53554E0B28871C474E12DF8CCC81AD933AE43D
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\datareporting\glean\events\events
Size 2KB
SHA256 a8e8ae3d24aa477d3ebec5a0f2a566fe7fb0145ff7f4a58556cdcd2c05e1dce0
MD5 69604b5164572ef4af063bd26a423843
SHA1 524b93f5f0dff4166fcddacef014fae526a9c416
SHA512 b472af680663356f31c53ec2259a26553202139747d1af0aeb37e4b30109382edd5d958943e3d80650b34996f5bfbedbcbfb2b9cb63f35a4b17d26daac8df182
TLSH
T147416B0C36AAAD7A6C87E6ECF841068E57454A0774C32D874D82DE4DCC92A99329F43D
MD5 SHA1 SHA512 TLSH

Submit Download

498cb2fe-f36b-4509-8b86-ef67a1d9a233

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\datareporting\glean\pending_pings\498cb2fe-f36b-4509-8b86-ef67a1d9a233
Size 235B
SHA256 9fc83fcc821cc86aad09c004bc8050fbce29b131bd70ee3fb62a0700cd6fbfd9
MD5 4d1f9f8d80e93eaf95d012192538eb2f
SHA1 ab89e8f3ba917fafeeade751c0507c6ed09d6d97
SHA512 e2917672022e61a190a39379628589ffda4d455022dbb8c262477fffffc8bfad663e7af104949448db20e744fb8b26d0ce23bf926472915610edbfbda79bbe7f
TLSH
T14ED09784248823AC0C205F0EB1A06CD630544C3310B6A8948D91863A9DFCEC58261827
MD5 SHA1 SHA512 TLSH

Submit Download

4a906ab1-6bf6-412f-9a56-73a7f029acb2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\datareporting\glean\pending_pings\4a906ab1-6bf6-412f-9a56-73a7f029acb2
Size 235B
SHA256 011ec42aa827eccbcdb7e75a975b841cef7c262aa1a32b93accbb4a1bdc98280
MD5 b6ff7eeeaefa24d9ae98ba6dcfc4ec22
SHA1 527381e9f8d28f3667a8c585530e7bfc8a05b4bb
SHA512 2cc6ea446c70b15d94f30161c551ed0d2fbd62b1d1aac43d599206856109480333ea678f6619fa5d8f3f0f6972addcd59478d06e30ac0959ab8852eec9574492
TLSH
T1C1D097C824C8632D08181F03F0A0ADC73048CC3350B95810D6704A7499BEDC44152927
MD5 SHA1 SHA512 TLSH

Submit Download

62b678b8-9764-49d3-b3d5-05f06f4bc413

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\datareporting\glean\pending_pings\62b678b8-9764-49d3-b3d5-05f06f4bc413
Size 871B
SHA256 4f56e6ba250195a7fb7f34912487790b8bb139fee3f5120176539a9e5f5899b2
MD5 29cb32d54053e92e4f9cb837bcefa38b
SHA1 98637d57cd624036cc6df9f59718d367a92d960c
SHA512 8e38bbbc252b60593371a797bf3ed755486ef024ba1e987acbdeacc538849b1c113fdedce4c36195846bb1d3034886a9542416493ca7c736631adec9e6a89cd7
TLSH
T185112390C534F4F2CC78D34B89913757CBF47023C0C995187EE19A180CBEA1E676620B
MD5 SHA1 SHA512 TLSH

Submit Download

b3df7d2b-dcb4-4a2b-aeb3-d3b3a22c4976

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\datareporting\glean\pending_pings\b3df7d2b-dcb4-4a2b-aeb3-d3b3a22c4976
Size 886B
SHA256 d2d496d7ac926a97d3dd952cdd41fc5ec12314f0e439740eaf9a969900cf06d6
MD5 3ede6b360b2d8026547a516e1564463c
SHA1 b58dd328ebb6410bd0183281f7d04cc930561f54
SHA512 2b68dc3a7aa46a14f6134d6585c846c2922a43c983ecde0a6ceeb7f78f196c9dcc03a97b9b51d4a6d9e02a0a9f2da4821a1a4f18580f8c759b40adc685a18556
TLSH
T1311104805924F5B2CC78D39B5AA1B7538BE1B03380C549187EE15B1C4DAEA1D636670B
MD5 SHA1 SHA512 TLSH

Submit Download

d6229f14-665a-4982-b7a9-362a595e33b3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\datareporting\glean\pending_pings\d6229f14-665a-4982-b7a9-362a595e33b3
Size 2KB
SHA256 f99c7f4fc50cefc715da5cff0e60d35bb99d1ee8d493eda8ebf10167d7614040
MD5 c86e700284e4440dd6976cd5f0117d5b
SHA1 f99db15987891ddf47569bad709f1bd63f1fdbe3
SHA512 819cae2fec05347bb35291ed6e17da7b7f9957f0e5d98fc88cc11313002b434e2bd298d647417d04b1159e3917cbc630195b4efa029db10100fb8c98710d5446
TLSH
T1D541416C35B85D779C9AF25D9442338E5BA1891380861C836F91EF0C8D9679D736E02F
MD5 SHA1 SHA512 TLSH

Submit Download

extension-preferences.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\extension-preferences.json
Size 942B
SHA256 6ed98b279beeb5d176af2fb95d1a50d77da719f5930865c3b377d142de136451
MD5 91111530e09495547b87580f830440e3
SHA1 71024801517a60a030b40c5bc0f39acea3377a9d
SHA512 42a78c56525f357ed2ed9567c409fae6921404ba13e2d32ba025e58fecbed5523a0421256e1ad3795ac756ff7385e9ef4acc7586b8455030e20a9af922a71b68
TLSH
T16C11F13A640B6EB01E8E5625FA384A92E791111B50B7F2E47E69934A13D3970C1ED39C
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\extensions.json
Size 14KB
SHA256 a0b2d6a16589faf21f50405aedd656c977d3ad070d28794e1c4f29761387bb1c
MD5 5a9aeacd5dc00d2e6763c1dc700737a6
SHA1 8e9df07daf37c0d3bf8c79b0eaca5b63dd6088fa
SHA512 d8b87a09cb927184a44ae207ab230f1766ae5523042fb392dcaf84b48e80fe063581ca6ca4765f84c4f9b161740361e7662dd43e3ecd5d8e9a05840427bff271
SSDEEP 384:MkI4vbUmldv18dhWX94zY96ouL4H2L4PEL4HcL4HEL4HC:DI4TRfGXC4g6z4c424W4+4i
TLSH
T19362311545148EB8298EA78AAA267E02C37D473B70445C78F4DD8FC842FA5B902BB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll.sig
Size 1KB
SHA256 c5f50bed6afd38490baca2ce8e8fdd1a39849c9f0dc06478a8a2e9226526607b
MD5 61d51cf075ad6dcbaaebf956c6bc1dcd
SHA1 f176331dcdb84327afd47ecf8ede3b0664c7d05a
SHA512 de263ed43f1112786186afa7bb942f25482fe60b04e7138c3687ec09956e0247307e5a6303a4297f785a572ed9a0059747a9b870c2fb6e84483373cfe27ca6c5
TLSH
T1C421B6DDAD2426542DC0EB2D5EF8E826DD3112C2F96404BB426666C3FCA3BA038C466D
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\prefs-1.js
Size 8KB
SHA256 f7a0fe591a721ece8e165b32ebdaf214b8f0b1aec69ab4f4476898667c64e3a3
MD5 f2acf7ecaa04ab32bc8139561a17b50e
SHA1 eafbbb586c63532adeef1525f567b176925b1b7f
SHA512 3c0d47c464e01edf3583fbf9f341b8f28da19aac3ec6b9d12736dc0957efa096a3e401f4a7abdbab9551879e3c63d6c7a323299eb7f480715c720a7c62248899
SSDEEP 96:xHz0OXCIoeTUX7qGqOfTI8ObzSjSSlXdv9j5n1WRq0/Tz3X6RBw88CQR68L4cn1C:V0OXCIoIROfTI8lSS4RT/TjqRBw88HO
TLSH
T13A020D789008DF6F74B6767CAC2449315AB2013BBABF68C750B944C5454CF3852FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\prefs.js
Size 6KB
SHA256 46bce763573a5bd17c178d6b576e84af7e06cabe00a6ac412e156d7318b5576b
MD5 5e83eb358599b180a1c4804104715296
SHA1 61a3f168a5b82041516ece32603b47616e23d9c1
SHA512 6703fa195916577fb31ec9391da6956c704ae78744e91199159cef472ffef0269e1d6299ef80111371c73fd3465d3b76ab9802e6ce917ec8b972f3166c821dc0
SSDEEP 96:xHzUTUX7qGqOfE4/1zSGSSlXdv9j/ln1HA/Tz3EBw88u8L4cn1I++:VWROfE4/fSSxA/TjEBw886
TLSH
T1D2E132789448CB7F74B6776CAC6888316AB2413BBBBF68C750B55484050CF3845F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\prefs.js
Size 6KB
SHA256 d73c35d8fe15911c3dc7ba0a086b94cc63770f5bd8c279067825bb094da5f156
MD5 92dd0bb7a7bcfb1c968867a14da9fa74
SHA1 a1b2b0060be7577c27a193562b83286c5efa429c
SHA512 f7db5dd9a9b8c61bca2eeca99175fbac440226f5e51ff47300a4e3bcf0dac30cf4a08838977a827d27b62f9e507217028f54008edb270e323f83cb2476d1a75a
SSDEEP 96:xHzUTUX7qGqOfEI8ObzSjSSlXdv9j5n1HA/Tz3EBw88u8L4cn1I++:VWROfEI8lSSxA/TjEBw886
TLSH
T1A2E12E789518CB7F78B677ACAC6448316AB2413BBABF68C750B54484050CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\prefs.js
Size 7KB
SHA256 9bb72f0e3c4a17cb46acf829425bdf60c2059fd5bbaaf35694337f2959d4b525
MD5 2defe442ad286f045ee44deef60c945e
SHA1 89a277961ed9a8818ec89b7a6eed8615b0323859
SHA512 1c0445d9e8c2441090999c21d483be45f07f74d9b25540dbeb701433510582ba3dbdb5a7d84436134f04ade8122b586c4bd2c2ed3180807686d405d228cb28bf
SSDEEP 96:xHz0OXCIoeTUX7qGqOfEI8ObzSjSSlXdv9j5n1HA/Tz3EBw8808L4cn1I++:V0OXCIoIROfEI8lSSxA/TjEBw88s
TLSH
T179F1ED789108DB6F74B677BCAC6448315A72013BBABF68C750B944C4450CF3846F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\prefs.js
Size 6KB
SHA256 72888e655788bf6fd3c14b4a9bfc44a7544d367a4d6d14e275d65c58c921d99f
MD5 b00585df853d5b9c93434ecbc42b5bd4
SHA1 95667bd53d58c967152202f5addb7509c5769ff8
SHA512 76658867adc390ea07ab97b4d3e70c81a9ca49d84ecbe54ef454e00dfdb3352b7c53aaaf5289aeb71b5740b55b2da86c1bb8a0d3702f46d086802b39ca90aee3
SSDEEP 96:xHzUTUX7qGqOfEI81zSjSSlXdv9j/ln1HA/Tz3EBw88u8L4cn1I++:VWROfEI8eSSxA/TjEBw886
TLSH
T13BE12F789408CB7F78B677ACAC6488316AB2413BBBBF68C750B54484050CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 c6edf7e86a966de49900984354eeb2e7b47972a56114f34aac5d529384619de2
MD5 461091388716158f07f9ae75eae69904
SHA1 d288dc96fdbd55b4b6db27e3d4caa88000d59587
SHA512 8b81be35aff53339a160370a6caf66af8f71d17bdde7133637bedfa70a959de2d4802ed0a90dfbd3bc8b1e459aff2b1a210ebae87a424433f1b3889fb88efbb1
SSDEEP 96:edfh90fFaLQeW9jILA0NjoB8kMJttn0YJZQBH:ch9HIOnNcB85JttnTZEH
TLSH
T127916D02361B3DA3BD5B828FAF5A4CE145B4300A998144EC90CF6B1AB67BA477598475
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60jcq5gl.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 3ebdcfb76abc90553d3a01c687c5abd7b5afe4c41f26ebb421c591646eb0ae49
MD5 5b54856dc65866ff5b6e2a229cf27706
SHA1 0382b718ea8d9bb698ff058d4372ee47345820a7
SHA512 dd98a9ce833b193c8d03a6bc71291f36b5752d75ea6f5e7ad84b186e949fbb06c5db8c10c8b173daa3bc901022845171cb6896e46d6d2d02afb5ea118ae3eec6
SSDEEP 96:edfh90fFa5QeW9jILA0NjoB8kMJttn0YJZQBH:ch91IOnNcB85JttnTZEH
TLSH
T1AD916D02371B3CA3BE5B828FAF5A4CE145B4340A998144EC90CF6B1AB67BE477598475
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download