floxif | 8bc43f6803ead33f2da85f49709768f0cdd4646cff58c632b50c2d9c8617e007

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/10/2026, 10:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Size 6.0MB
Sample261015-mcm1dadc83
SHA256 8bc43f6803ead33f2da85f49709768f0cdd4646cff58c632b50c2d9c8617e007
MD5 7b8755914072bbea39dc6c6054a903d3
SHA1 7a703826184c7d3d13afbd2978a9fee97b98445d
SHA512 a55e05688c1862264454f1e560f592c2225721acf586b26a62a3b99d331c4b420393b00de715962576c8f30a9eeccd699e4164caab572cb4c3d17ee49d05ccdd
SSDEEP 98304:mWe6nM2xeeDBBjVHU8gwqQXP4Dq18frP3wbzWFimaI7dloY:m5Ixee9BpHU/wBsgbzWFimaI7dlL
TLSH
T1BA569D51BE4E8176D91B1132472D9F2A1029BD28373865D3B2B43E7EEC363C16D3A61B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware backdoor discovery floxif persistence spyware stealer trojan upx

Malware Config

Signatures

Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/files/0x000b00000001b2c5-1.dat	floxif

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 2 IoCs

resource	yara_rule
behavioral2/memory/952-35-0x0000000000A90000-0x0000000001083000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/952-455-0x0000000000A90000-0x0000000001083000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 2 IoCs

resource	yara_rule
behavioral2/memory/952-35-0x0000000000A90000-0x0000000001083000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/952-455-0x0000000000A90000-0x0000000001083000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

UPX dump on OEP (original entry point) 6 IoCs

resource	yara_rule
behavioral2/memory/952-3-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/files/0x000b00000001b2c5-1.dat	UPX
behavioral2/memory/952-22-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/952-36-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/952-428-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/952-456-0x0000000010000000-0x0000000010030000-memory.dmp	UPX

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000b00000001b2c5-1.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
952	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe /onboot"	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/952-3-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/files/0x000b00000001b2c5-1.dat	upx
behavioral2/memory/952-22-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/952-36-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/952-428-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/952-456-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
File created	\??\c:\program files\common files\system\symsrv.dll.000	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Modifies Internet Explorer settings 1 TTPs 22 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3"	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm"	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243"	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3"	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\MenuExt\Download with IDM	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3"	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe"	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Low Rights	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe"	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe"	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe"	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan"	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User"	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Model = "287"	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter"	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1"	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Therad = "1"	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
952	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
952	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
952	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
952	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
952	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
952	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
952	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
952	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	952	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Token: SeRestorePrivilege	952	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
Token: SeDebugPrivilege	3008	firefox.exe
Token: SeDebugPrivilege	3008	firefox.exe
Token: SeDebugPrivilege	3008	firefox.exe
Token: SeDebugPrivilege	3008	firefox.exe
Token: SeDebugPrivilege	3008	firefox.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
3008	firefox.exe
3008	firefox.exe
3008	firefox.exe
3008	firefox.exe
3008	firefox.exe
3008	firefox.exe
952	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
952	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
952	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
952	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
952	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
3008	firefox.exe
952	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
952	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 4624	952	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe	89
PID 952 wrote to memory of 2752	952	2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe	90
PID 2752 wrote to memory of 3008	2752	firefox.exe	91
PID 2752 wrote to memory of 3008	2752	firefox.exe	91
PID 3008 wrote to memory of 3476	3008	firefox.exe	92
PID 3008 wrote to memory of 3476	3008	firefox.exe	92
PID 3008 wrote to memory of 3476	3008	firefox.exe	92
PID 3008 wrote to memory of 856	3008	firefox.exe	93
PID 3008 wrote to memory of 856	3008	firefox.exe	93
PID 3008 wrote to memory of 856	3008	firefox.exe	93
PID 3008 wrote to memory of 856	3008	firefox.exe	93
PID 3008 wrote to memory of 5540	3008	firefox.exe	94
PID 3008 wrote to memory of 5540	3008	firefox.exe	94
PID 3008 wrote to memory of 5540	3008	firefox.exe	94
PID 3008 wrote to memory of 5540	3008	firefox.exe	94
PID 3008 wrote to memory of 2492	3008	firefox.exe	95
PID 3008 wrote to memory of 2492	3008	firefox.exe	95
PID 3008 wrote to memory of 2492	3008	firefox.exe	95
PID 3008 wrote to memory of 4556	3008	firefox.exe	96
PID 3008 wrote to memory of 4556	3008	firefox.exe	96
PID 3008 wrote to memory of 4556	3008	firefox.exe	96
PID 3008 wrote to memory of 4556	3008	firefox.exe	96
PID 3008 wrote to memory of 4320	3008	firefox.exe	97
PID 3008 wrote to memory of 4320	3008	firefox.exe	97
PID 3008 wrote to memory of 4320	3008	firefox.exe	97
PID 3008 wrote to memory of 4320	3008	firefox.exe	97
PID 3008 wrote to memory of 3124	3008	firefox.exe	98
PID 3008 wrote to memory of 3124	3008	firefox.exe	98
PID 3008 wrote to memory of 3124	3008	firefox.exe	98
PID 3008 wrote to memory of 3124	3008	firefox.exe	98
PID 3008 wrote to memory of 900	3008	firefox.exe	99
PID 3008 wrote to memory of 900	3008	firefox.exe	99
PID 3008 wrote to memory of 900	3008	firefox.exe	99
PID 3008 wrote to memory of 900	3008	firefox.exe	99
PID 3008 wrote to memory of 1980	3008	firefox.exe	100
PID 3008 wrote to memory of 1980	3008	firefox.exe	100
PID 3008 wrote to memory of 1980	3008	firefox.exe	100
PID 3008 wrote to memory of 1980	3008	firefox.exe	100
PID 3008 wrote to memory of 6024	3008	firefox.exe	101
PID 3008 wrote to memory of 6024	3008	firefox.exe	101
PID 3008 wrote to memory of 6024	3008	firefox.exe	101
PID 3008 wrote to memory of 6024	3008	firefox.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-13_7b8755914072bbea39dc6c6054a903d3_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:952
- C:\Windows\system32\regsvr32.exe
  C:\Windows\Sysnative\regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  PID:4624
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
    3⤵
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3008
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1964 -prefsLen 27097 -prefMapHandle 1968 -prefMapSize 270279 -ipcHandle 1940 -initialChannelId {80972a75-26fd-411d-9515-6384d3a0af9a} -parentPid 3008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3008" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:3476
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2440 -prefsLen 27133 -prefMapHandle 2444 -prefMapSize 270279 -ipcHandle 2448 -initialChannelId {4c3239de-51f1-46c8-83b7-e2b900316fec} -parentPid 3008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3008" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:856
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3836 -prefsLen 25164 -prefMapHandle 3840 -prefMapSize 270279 -jsInitHandle 3844 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3852 -initialChannelId {7f0bef0b-9a6c-492f-aca0-0f83bada7686} -parentPid 3008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3008" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:5540
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4004 -prefsLen 27274 -prefMapHandle 4008 -prefMapSize 270279 -ipcHandle 4084 -initialChannelId {8b890266-bb8c-4e30-880d-fa601306d9a6} -parentPid 3008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3008" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:2492
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4596 -prefsLen 34773 -prefMapHandle 4600 -prefMapSize 270279 -jsInitHandle 4604 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2860 -initialChannelId {351bbe4f-b9c2-4a67-a74d-05c205c3d627} -parentPid 3008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3008" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:4556
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2932 -prefsLen 35010 -prefMapHandle 3060 -prefMapSize 270279 -ipcHandle 4768 -initialChannelId {c4d606dd-51ab-4e36-b32b-97881b579edb} -parentPid 3008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3008" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:4320
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5536 -prefsLen 35062 -prefMapHandle 5540 -prefMapSize 270279 -jsInitHandle 5544 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5552 -initialChannelId {ed7320ba-ab2e-4641-852d-7841160b6532} -parentPid 3008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3008" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:3124
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3900 -prefsLen 32952 -prefMapHandle 3976 -prefMapSize 270279 -jsInitHandle 3964 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4132 -initialChannelId {22068bbd-76e9-47ae-9d8d-5d0372d55516} -parentPid 3008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3008" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:900
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3916 -prefsLen 32952 -prefMapHandle 3904 -prefMapSize 270279 -jsInitHandle 3856 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4236 -initialChannelId {a44b265a-eadf-4e82-9cb1-ac9b10bd08c0} -parentPid 3008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3008" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:1980
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6104 -prefsLen 32952 -prefMapHandle 6108 -prefMapSize 270279 -jsInitHandle 6112 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6120 -initialChannelId {d3b8470b-6fc9-4037-b35c-e86ff773c8cb} -parentPid 3008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3008" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
      4⤵
      Checks processor information in registry
      PID:6024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

symsrv.dll

Path C:\Program Files\Common Files\System\symsrv.dll
Size 67KB
SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
MD5 7574cf2c64f35161ab1292e2f532aabf
SHA1 14ba3fa927a06224dfe587014299e834def4644f
SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
TLSH
T17863F1372AB5807DDD210D37949F835AB771E5A76C20643FC25907D988B8DD0E3239AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

symsrv.dll.000

Path C:\Program Files\Common Files\System\symsrv.dll.000
Size 114B
SHA256 aefc503b1ed462d7b6280228a7b5b710792273b78934426f88325341ac5b5a92
MD5 e609411db8aa6775d0344c75c23ae79b
SHA1 1d2ff6194bf159ce36cd0461cd3da29486d1e97d
SHA512 6884ff5c07bc687132c965a59cb8c5a898a25da74c6c846c1d6089ddca8007cb7e4d2f8520bdce9fbcf6e2f9c9e5c28d8c8d6d049d3522470bdc7d38bbfa0ad0
TLSH
T1FFB09262AA2791EAE1AA224505A0248C1ED0B62AB48638002EBA5A4E93256A85916147
MD5 SHA1 SHA512 TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ej9v93ms.default-release\activity-stream.contile.json
Size 4KB
SHA256 116424de3dad34919250caba8084bb039216c145086debb3aa47e8436cf307f0
MD5 d5d4f01ab628c035199a690591c786c9
SHA1 1ccdbc622e79dbe4cad75f875af53130aefd3f2b
SHA512 906b4bef382bd2a02cf27cc41b85937e1cb09e1aae64319804326dd1da90cb0d1fd090a55c872ebe3bf4e7faef78bece064b0f3f871e597cc7c2c7916129d2eb
SSDEEP 96:TAmMD67m+ZrQUNGrObzEo/yncydgdT+mR+xolz:9M27FZBNsObzEuy/gsmR+mF
TLSH
T19691D76FD42444161730A7F46C1F27ACF103B41689E4EAACB25A8E62916C7BEC1DED8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ej9v93ms.default-release\activity-stream.discovery_stream.json
Size 75KB
SHA256 a857641f0fb7110e597ca547a4f4c6bcd20ffcf771621b245456135332a00f46
MD5 13853175b38a36c11671b53a71856dba
SHA1 f02e66ec5459b5a74f9f5e58c15ceb3e376f26b9
SHA512 f8ffe9dfef323a3c9da8bd2834d5e41a403f0df19219827a65dacb544acafe8294f65a5115b51648ba7f353a90ca715c228a244a88a7f903424f96595602e671
SSDEEP 768:sybjKvUJQsDJDVC6di+j9aKUvpl0S518ih+6uBwbvQm+GghOOr+7eZKHqo8:3bOgP7XUvplJ2AMBWQ3GgU4V
TLSH
T177730AE7A6E871FB0B9037C72C0F795B66E10189E34502C9ECADCA1DC1ED754123A6AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E9338C5CCF1E2FCF149487351399F198A4F9FCD6

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ej9v93ms.default-release\cache2\entries\E9338C5CCF1E2FCF149487351399F198A4F9FCD6
Size 16KB
SHA256 de737250625d42371b75d3ca10f2788d5ffca4f640ed1bc1ee1795cf0ccf82ad
MD5 d173ae254e4ccbf37811b81e01809202
SHA1 eb241509d4fafaf64fecd1bfeae6c59943697e04
SHA512 f318f30c509a77cbc003e545ebf34803b71cb46c3969a8dcf47619a83872d3a6eabd7e8e62b374f74970e072b77c3b3fc77378ba041b44ff552c212287b686d5
SSDEEP 384:HGNQiO024YgWTT78XJWTT78gB7SOEAd9KVRaAcP+AWRMAh:mDZYgWTToXJWTTogB7S/AmVAf+hRMy
TLSH
T10C728D7D8F013CAD275780E8C8B583588D18B6EBDFE6C06D168C3D09C98496A71F945F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ej9v93ms.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 ed2e6499f1106802ad1181e7c103660e94bad5634fa84e11b255df24fdd29491
MD5 fe2adb8eb2bcdb5bc223f61486fdea86
SHA1 4cea64760b98cb59f2f7cd00fefd8b87744dd33c
SHA512 88515731ec1ea276222cc73f11c0e879c64cd003982a0634076d82d8b53de89b8ce4dac3228ddaadb04a0cbecae77f123f60cd99b798d0a8173c1c33d06cace1
SSDEEP 1536:jTrli+d0GtDCJH2lVt6Qi6cKlgvJ/BYZCv2M3cp71cd/x7DlrE7REyypsgGwNmEf:j3lcWlVH2gov2Mex8/tSKGgGQxnaBHg
TLSH
T104B3AFF7DBA2897D59FFD42DABC2883EFD266010B3A33109C863635061C7AB86775644
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ej9v93ms.default-release\startupCache\webext.sc.lz4
Size 106KB
SHA256 10d44f1782faecc6aae13723bdcf966435ebab7687c67256b4f4147beb02b51f
MD5 3544a2dc378966d12262ea107c9db29b
SHA1 b6d4a6ad132bac43d5dd659f5dd316637c5bb804
SHA512 1c735eaa36017ab1746fd5bb6c0483fe7503d10d098f9eb39fae2075435e4250085bc31e039aa4404f3c12cdb9ec22436a1320cae541b52d0deed51c331bfc6a
SSDEEP 3072:X3lcWlVH7vR6vVbO988/tSKGgGQxnaBHix:FcwHb8NY88lSKG9QtaBCx
TLSH
T1D1B3AFF7DBA2C97C59FF942D9BC2883EFD266014B3A33109C863635062C7BB86675644
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 21.6MB
SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
MD5 40bf410fa9ef0d5499907e34885af6f4
SHA1 4d7722337a0e26bf4a1c6478129356acb2f7b720
SHA512 b763712aa4bd9819b7972a40216c08fd32338b14fab7ce4b166e39ce441ad62678bf0e1f25da436ffdb56ff1b1a21e3dbbaf47c0f5918c252e70656f5d0307ac
SSDEEP 393216:KYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHY:3mghF5QDwWCm/2YU8Ivq9u5P
TLSH
T14F37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

addonStartup.json.lz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\addonStartup.json.lz4
Size 4KB
SHA256 79fff4abd736d3416188589a60351aea01236688cd5097f931e126f235d1d89d
MD5 504dd1089fb0548b936e1034ab64faa3
SHA1 7631283248a1c4fbf55298e318d51bde59aec041
SHA512 a005b44be00c8366c20b2b2c5c27c76dfdaa5e989010fdb043621eb841072288ca0beeaa9a6498caed243254c5a655a7827eaaf26fdd385c392ce41f9f55fe5e
SSDEEP 96:Ncej4sHNw6M2xWchD41MgGvmHhF+rUpO1LnOYvhQhIRhN:No52xthD8rGvm6ApwnHUuhN
TLSH
T1A9A17D7AD541EFA1FE22C04348D57FB2EAA69B7414A9C8E4F1ABB1154D74E735704340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

store.json.mozlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\crashes\store.json.mozlz4
Size 66B
SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
MD5 a6338865eb252d0ef8fcf11fa9af3f0d
SHA1 cecdd4c4dcae10c2ffc8eb938121b6231de48cd3
SHA512 d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c
TLSH
T175A022C28E0C83BACF000833008AF00300E83B020B8B0F882AC2AEF8200200C8082082
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 023a312f72e30a9fb4e10a4b97bfcdd37087882fbf8529c43e49ae626c165cbc
MD5 e6f9480b65769a853a26ade23e4ea37a
SHA1 af3753cf3c58db4e4c264aa5cd5d52710e960b5b
SHA512 b612a5a732f6601df0734ec9ea147d581a0118aedbc15105cdd0b7c9e68e27d817d5d8436edeff039e6f47f44e8c1532c4d35c377ffbf53043f3c846e773084e
SSDEEP 192:C1d66JoztdzgCl6mc0d/kuOv5zboSZ2DQyjIoxI:Md66Joz/zgC1jRklboSZ2DQyjIX
TLSH
T198D1EE28E629867BC448023BDCA61B400F76389B985E7F2931EC741C2D972DD7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 ed1b1c6a5016610d711bda5ca7a742d0520e29abd6a69f1ce94baaa40b1eb5ac
MD5 a5a8bab6ad530540068a0c884f440ea8
SHA1 0f1fecafb394b8aaed2645a57ebf1bc25cffe51a
SHA512 9c71f104e21481b4492e793d105a848267a689490460f741d18ec369bca97697522f7329c2308e44abe6d77ef4b8bfb55174123634349ad8f5ae9cc7db64aa4b
SSDEEP 192:C1d66JoztdzgCl6mc0dJkuOv5zbo7rZ2DQyjIcyv:Md66Joz/zgC1jHklboHZ2DQyjIr
TLSH
T126E10F68EA28867BC404127BDCA61B410F39389BD84E7F2935AD611C2C5B2DD778E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\events\events
Size 1KB
SHA256 2e7e4a980609af81487d254fb7b3e5b834083851b2d6373abc79b838526d2d87
MD5 138c9ab01359371d64c796cc80743667
SHA1 011cebd76e0f648832c6a194ac2298493a2a410a
SHA512 6383b1163613361b48eb035ebc595d2fc85285c3c368d38d0ff35d846b0ddb20470616ac285cd0e6c4701df4c279ed420007616f1d24822fab08bd3d3e7c8ff8
TLSH
T1C3217C4C3DB84D2A9C87FB9D744102CE53694E0B84871C430D02DE8CCC91AD933FA679
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\events\events
Size 2KB
SHA256 f50ee6eb6551e27abba50db78280d14be172b7de41cff2dfba2a16998495b859
MD5 152ceff428783316c386c40c4dfe397d
SHA1 93485368df432c11aa43e73b0cc8c1675193aa2f
SHA512 ff7c183774dca72308b589aa2fed4658138d125407f269c297d7d37703b8286b0002b6152705fbbe2b35dc121b6ff553a62d24e0cf458e88a8daaa978b8d1d5c
TLSH
T15041AA4C2ABA8D7A688BF7CEF44102CD47694A0684C31C874DC2DE4CCC42A9932EF57D
MD5 SHA1 SHA512 TLSH

Submit Download

08fbf03a-ad97-4fa5-a3a6-d5547fd324e2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\pending_pings\08fbf03a-ad97-4fa5-a3a6-d5547fd324e2
Size 235B
SHA256 e036e05130c71571d9256ba836471884e8d591af9d7a3885181ba6ab0849d313
MD5 feefdcd4ba06a081a3c63b7bc57b3fe4
SHA1 d74b6a03eacc7e322dcc7fcf355cc2306a7a8430
SHA512 70837ae042c84bbac273085254edd18a9cc8c33b8915da98f6d99e7191fb4e4dbd4fe198eca8347bae9a460820496174b7f3845a0539f81f3a68d68e1023cb62
TLSH
T1ACD097D064D82B9E481D0F06F0E03AD631848C3714A09860E69184759ABCAC84221C1A
MD5 SHA1 SHA512 TLSH

Submit Download

0ea51378-1577-4874-a478-580f7809ba95

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\pending_pings\0ea51378-1577-4874-a478-580f7809ba95
Size 883B
SHA256 eb3ec99be9d5c53a22b564c2efeb523b2d8de69b908f3a1a20bd91377a39650d
MD5 6247d4b6a22a4c07faa43329a76c48cb
SHA1 1cc153537b7c595bc2de67f727f3d19a7c22e4de
SHA512 76a3125e9fdd5bcfc698ecd365d5b370520b12bbac8a1ee51348c20065ea1fe3551b2f77eed97d8ef86e9677e2bb1dca30cd6a623919e60b13959f0ae1d9297f
TLSH
T1B7112740DB30B5B2CC68D24BC49B770247F46413C0C9D1143EB49F1C097F51EA76621B
MD5 SHA1 SHA512 TLSH

Submit Download

2c0a123c-c131-4954-b38a-79c90f1a0b1e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\pending_pings\2c0a123c-c131-4954-b38a-79c90f1a0b1e
Size 16KB
SHA256 febacef7a52a17da6ee435db592d53f96e4f07289637788b3acd56005f1a1f57
MD5 71f574c897f4c9c67b2fe64c4f704f10
SHA1 19f3ecc289f33a17cdc5bef2abd790e0dc07d1e5
SHA512 5020326a75add39f2e0e051b392ca78c9c792e8d5d043d977e0e6d60c997ed69e1037c3129785dd981959a6a00276a51159e7d983297e2d3534713253f3ce565
SSDEEP 192:ZfRORxUgZTBI1YcdVePZWz7vs7doNrqTKybgZaLq4WtkC8O6hUJOxL/y4wocrkQk:XC7ZT+MPZW/s7dolWKEQaG4+UGFUR
TLSH
T17C72C856686045BB8291E758D4E8BFC3E5F628CF4C419FCE9BE4BD082DDA06E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6d008fae-e64f-4a9d-b9b1-7ae7b4acfd74

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\pending_pings\6d008fae-e64f-4a9d-b9b1-7ae7b4acfd74
Size 2KB
SHA256 fdbf3c9c4ae8dec56823c563d8ac351550eafb872ede9db2344d0da19b1b00d6
MD5 20130c442448c07f7824633bc5ea5349
SHA1 602e7a305e32944a4c25e866a955d63f370414f9
SHA512 0ce42e2ea5041a9d418dd7eb79323f42e7c5da241c8fef0b4256db4cd683ebbde2d8975af635fac88a519c8f5476860dd9ba141ce49fe01907661c59891c8537
TLSH
T10941535C75B89C779CCBF54D9482234E57748A47408A28436E51EF0C8DE67AD336A42B
MD5 SHA1 SHA512 TLSH

Submit Download

6f6eadaf-bc37-405e-862f-b3cefbc017b6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\pending_pings\6f6eadaf-bc37-405e-862f-b3cefbc017b6
Size 235B
SHA256 f9e1af9db8a50cf590cb326b46a0379ae75fdac6e0f09cffdc7fd353d4095a91
MD5 6885beb9a0ccb45b5e22c20a104580a1
SHA1 ded856e0a2c8ba6730fce11055e1e3814ec4f078
SHA512 7b8afb7ced8d402c8a1918c9752627d97ef2e2be4df61e386d7e0e82a820f16645b4aa1f179fff2c7f99fe407fa2d13b980d97118838650d9bc5d83aebb1e87e
TLSH
T1D6D0978018882B2E48080F06B0A0AAC230484C33A4709928D6A005348DFA9C8C291C0B
MD5 SHA1 SHA512 TLSH

Submit Download

dfab21f6-f6d0-4ce4-9482-45be17f7f3ea

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\pending_pings\dfab21f6-f6d0-4ce4-9482-45be17f7f3ea
Size 886B
SHA256 7784bbf76ff18d0932e4c88e61a2d0f27a15806d60bf5c639f7a6bc1aeb8b099
MD5 697f5b4e901d93388839c8658976ae0e
SHA1 e428a97f985e145a266d4f99b6a12f0b6e589665
SHA512 28409edb18dc53e00cad2a3195be1583edf6dd038dd2c4f8a2ef9bf19f0db998a0aa88bba1a25dd86bc57e48b1f9f48c8ae58d58583e5f504e01aa35f3a533cd
TLSH
T117110440CB64B5B2CCA4925794D6B7064BF42123C0CA59143FD59B1809FF15EA75230B
MD5 SHA1 SHA512 TLSH

Submit Download

extension-preferences.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\extension-preferences.json
Size 942B
SHA256 aecfc11c0db969b2c79da2144415a8859c77d66fbfc37ca4924ac58a0ff29834
MD5 20357ec0806e9826d6daf456b6b16bd8
SHA1 7d5d7a921213989294eb5cea2ee760e562ce5293
SHA512 2333fde606ee727a6b6d9812ed40e56e5d0dba4ec35abcc11b67f8ad61d1d3d4af5db699d29b3ed6b459b9e142badae69ffbebf18974b5a1c72e45ecc8cf93cf
TLSH
T17211F13A640B6EB01E8E5625FE384A92E791111B50B7F2E47E69934A13D3970C1ED39C
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\extensions.json
Size 14KB
SHA256 87ec1ca454934723f1cf341eacdea73203f06130911d9bae7d7a1b923d06577f
MD5 66c03af5cdeb22397b0a6e49baabb366
SHA1 7bef06ec0d82ca3158e377fed81e1fe0e6236e62
SHA512 c88b64e0079fe4089663f148347fa5a0279d86eeb1bd0daaaa8e5f0bd76aeb8c2933a83842f0646154d0556fbf5eeff3d7fc7f8a65aabd1094610e0b62d4cc47
SSDEEP 384:hkI4vkUmldvc8dhW+94zCN96oyL4HzL4PyL4HozaL4H3VL4HC:SI4cRflXj4G6b4f444f4l4i
TLSH
T19062421545049EB8298FA79AAA367E01C37D473B70445C78F4DD8FC842FA5B902BB62B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE
Size 473B
SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
MD5 7406820f5d56fda6baffa951c60679d2
SHA1 e7d4894993e506e235d55b3e47aed019d0584148
SHA512 e70868507c08436b51bb4fd7a582ec0bf81ae0fb5d3d3f20374f584574e54eca81f3cb0530fddcf2d1773c33774f5df58f55ed2a45149c86d33e1e50f64c1d36
TLSH
T13AF0DC7ABA23532245D603C7011450D53B270BF4F25422D0E3E881E5336B178C1FE084
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll.sig
Size 1KB
SHA256 c5f50bed6afd38490baca2ce8e8fdd1a39849c9f0dc06478a8a2e9226526607b
MD5 61d51cf075ad6dcbaaebf956c6bc1dcd
SHA1 f176331dcdb84327afd47ecf8ede3b0664c7d05a
SHA512 de263ed43f1112786186afa7bb942f25482fe60b04e7138c3687ec09956e0247307e5a6303a4297f785a572ed9a0059747a9b870c2fb6e84483373cfe27ca6c5
TLSH
T1C421B6DDAD2426542DC0EB2D5EF8E826DD3112C2F96404BB426666C3FCA3BA038C466D
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\prefs-1.js
Size 6KB
SHA256 ad5b6f9af132ec812acf94af5e8446277f70294d706fa1d12c2e53a67ab66032
MD5 929bd9aa3a4416e71b77305f5d804c7b
SHA1 40904e27748fae491d99f9a8e84b077128140bbb
SHA512 4c29885f0cdb50d08baad87a2258fe1c883a44148e65b4353e50ec381f44b671c56c67480f08564e8b8f8c644e030dea7766979cff48c693eda579259896e0ac
SSDEEP 96:xH4UTUbqGq6fUyGZ1zSNSSl4dv9j9nXH/+FFBw88u8L4cnYQO7:umR6fUyGZwSSg/4Bw88A7
TLSH
T128E131789408CB7F74B677ACAC6888316AB2017BBBBF68D750B54484055CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\prefs.js
Size 6KB
SHA256 9f390b25dd78d73f9cdd85526c44f05c9e7de346e79923117243d631c1659f4f
MD5 59c085905020eca40c6f6e63eb6ac102
SHA1 f89963fdbbca45bfff394b16da22fa8b99168a8e
SHA512 58e6dd81ca83e8b3d5d9e79f753298d97d8d53e4bcb81089c88cb73c8fae8eff28a583974f083267624fef247473e363f0ff4d6f1a65016e732a93b38c8b859e
SSDEEP 96:xH4UTUbqGq6fUgC1zSpSSl4dv9j9nXH/+FFBw88u8L4cnYQO7:umR6fUgCUSSg/4Bw88A7
TLSH
T12CE141789448CB7F74B677ACAC6888316AB2017B77BF68D750B54484015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\prefs.js
Size 6KB
SHA256 04f48612b6a18b02938ec491dbb286eb52c942f037c6d9d387d3f37bcf7d9d62
MD5 9c9a7b73be244b1fbd6cd4566eb39dda
SHA1 0a85d531e26c7acd58a5de325519c773a3654f3f
SHA512 9bc90270af15ee9309cbbe3911db772ba4049386cdbcc2a1de7eaeeb3184532dc23c0cf7c97cc2910669efddfa907302770b0aaf77ef818f6348efe8e118db8b
SSDEEP 96:xH4UTUbqGq6fUyGZObzSNSSl4dv9jbnXH/+FFBw88u8L4cnYQO7:umR6fUyGZXSSK/4Bw88A7
TLSH
T12DE1407894188B7F74B677ACAC6888316AB2013BBBBF68D750B544C4055CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\prefs.js
Size 7KB
SHA256 2e65474b325f66e0156b9448a0ced85acda30af282108ca3fc93d0539d1ad2ed
MD5 e697a7e1515378a0bce9457c8343b67b
SHA1 14a534b5b39a0d96c581f581caadd5a46fee16b8
SHA512 c55e541623f6d82c2cc4d8c23d64f5f837a2184df61130e8da4222227abc94c9e746f622b323af953fea1bb7fc67ccfe5c693920d4d93dce5fad380514b57afe
SSDEEP 96:xH4VTUbqGq6fUyGZObzSNSSl4dv9jbnXH/+FFBw88z8L4cnYQO7:u7R6fUyGZXSSK/4Bw88v7
TLSH
T17EF10F789004CB7F64B677ACAC6888716A72013BBBBF68D650B954C4055CF3442FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\prefs.js
Size 7KB
SHA256 97aaeacee1feff0a430e0da238a5f9e7ebb3315fca371d9969cba6ad005ffdb2
MD5 7d8440b736b1daeb2af5f63b43c2c8b7
SHA1 42df21b86c3cdc62b1d4afb0387c11d94b6ff3f5
SHA512 581741131baf4ef818a9aefb43b896a8f8b72089de7781fce94cdb4b0a49b71dc8d95932dd1fd9089268f29a94bba1a45952011261c4ad98413e4c08834bfcd0
SSDEEP 96:xH4VTUbqGq6fSyGZObzSNSSl4dv9jbnXWRm7+FmBw88W8L4cnYPO7:u7R6fSyGZXSSfRC3Bw88n7
TLSH
T157F10D789004CF7F74B677ADAC6888715AB2013BBABF68D650B954840548F3442FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 8a7b944b84f6cd524acfa2a1ef2848f548b4fc3a7a5893599abbc0312ebd89ed
MD5 264702edae9954bd422598a3e5336294
SHA1 65a0640e9b699a329f4417f4d9030b6b79aad2ce
SHA512 c2fe04b0c8b62ebbb922bf30024725dafb6d1935ce48e461fd7baa12610702aed36cfc29188d2bf9bda666e914f2e0e9fb4235ae4bb91dca22eacd72df7a3980
SSDEEP 96:d2fh9R9ZGbSOeW9jILA0NjoB8kMJttn0YJZQwiB:S3R9g7OnNcB85JttnTZmB
TLSH
T127918E41371B6C77FD5B858FEB268CF20574314A85C048ED80CF2E16B62BE8736684B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 9e4db446324975d88d89ce50456fc8c2754bc2aa793f50870017e622be8bd2f6
MD5 db12a06e304ec40d037ab36cf6558269
SHA1 a4ca494169fc949b15eb916d81595d00072c4de5
SHA512 925fd5521fc5a333189d6b735e7920ea09aeb6d59cfab05d7de0fabd0363823e2105bb060651a46cca6f3b70e4fda6ea383ce671f6ac6219eefb082e95b0edb5
SSDEEP 96:d2fh9R9ZGbSOHeW9jILA0NjoB8kMJttn0YJZQwj:S3R9grOnNcB85JttnTZv
TLSH
T19C918D42371B6D67FD5B858FEB268CF20134314985C048ED80CF2E16B62BE8736690B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download