Overview

overview

10

Static

static

10

2026-07-20...er.exe

windows10-2004-x64

10

2026-07-20...er.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    20/07/2026, 13:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-20_792f2e49b9763fc40d089f35d82f087f_dark-comet_darkgate_elex_gcleaner_glassworm_hijackloader.exe
  • Size 12.5MB
  • Sample260720-qbppcsds8x
  • SHA256 1870750bca90d7dd32b7e30930fb89139ca0aa2ec3ca8fb0ead7888c5370590e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarebackdoordiscoveryxredpersistencephishingprivilege_escalationspywarestealer

Malware Config

Extracted

Family

  • xred

C2

  • xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
  • Drops file in Drivers directory 2 IoCs
  • A potential corporate email address has been identified in the URL: [email protected]
    phishing
  • Checks computer location settings 2 TTPs 8 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 13 IoCs
  • Loads dropped DLL 39 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in System32 directory 18 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 48 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 26 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 27 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 41 IoCs
  • Modifies registry class 64 IoCs
  • Runs net.exe
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious behavior: LoadsDriver 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 27 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-20_792f2e49b9763fc40d089f35d82f087f_dark-comet_darkgate_elex_gcleaner_glassworm_hijackloader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-20_792f2e49b9763fc40d089f35d82f087f_dark-comet_darkgate_elex_gcleaner_glassworm_hijackloader.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2344
    • C:\Users\Admin\AppData\Local\Temp\._cache_2026-07-20_792f2e49b9763fc40d089f35d82f087f_dark-comet_darkgate_elex_gcleaner_glassworm_hijackloader.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_2026-07-20_792f2e49b9763fc40d089f35d82f087f_dark-comet_darkgate_elex_gcleaner_glassworm_hijackloader.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4544
      • C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp
        "C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp" -d "C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3816
    • C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4004
      • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4764
        • C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp
          "C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp" -d "C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • Installs/modifies Browser Helper Object
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:368
          • C:\Windows\SysWOW64\regsvr32.exe
            "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
            5⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2440
            • C:\Windows\system32\regsvr32.exe
              /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
              6⤵
              • Loads dropped DLL
              • Modifies registry class
              PID:4616
          • C:\Windows\SysWOW64\regsvr32.exe
            "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
            5⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3504
            • C:\Windows\system32\regsvr32.exe
              /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
              6⤵
              • Loads dropped DLL
              • Modifies registry class
              PID:2604
          • C:\Windows\SysWOW64\regsvr32.exe
            "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
            5⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4664
            • C:\Windows\system32\regsvr32.exe
              /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
              6⤵
              • Loads dropped DLL
              • Modifies registry class
              PID:1820
          • C:\Program Files (x86)\Internet Download Manager\idmBroker.exe
            "C:\Program Files (x86)\Internet Download Manager\idmBroker.exe" -RegServer
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            PID:3064
          • C:\Program Files (x86)\Internet Download Manager\IDMan.exe
            "C:\Program Files (x86)\Internet Download Manager\IDMan.exe" /rtr
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:5052
            • C:\Windows\SysWOW64\regsvr32.exe
              "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
              6⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2824
              • C:\Windows\system32\regsvr32.exe
                /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                7⤵
                • Loads dropped DLL
                PID:2148
            • C:\Windows\SysWOW64\regsvr32.exe
              "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
              6⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4276
              • C:\Windows\system32\regsvr32.exe
                /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
                7⤵
                • Loads dropped DLL
                • Modifies registry class
                PID:724
            • C:\Windows\SysWOW64\regsvr32.exe
              "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
              6⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2444
              • C:\Windows\system32\regsvr32.exe
                /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
                7⤵
                • Loads dropped DLL
                • Modifies registry class
                PID:4708
            • C:\Windows\SysWOW64\regsvr32.exe
              "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
              6⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4360
              • C:\Windows\system32\regsvr32.exe
                /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
                7⤵
                • Loads dropped DLL
                • Modifies registry class
                PID:1736
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:2544
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
                7⤵
                • Checks processor information in registry
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:1192
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2020 -prefsLen 27099 -prefMapHandle 2024 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {aa31de9e-773e-4410-8512-651e1ee1700f} -parentPid 1192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1192" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
                  8⤵
                    PID:4944
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2484 -prefsLen 27135 -prefMapHandle 2488 -prefMapSize 270279 -ipcHandle 2496 -initialChannelId {8c42b6cf-86ba-4703-959e-b331d601e88c} -parentPid 1192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1192" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
                    8⤵
                      PID:1704
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3688 -prefsLen 25164 -prefMapHandle 3692 -prefMapSize 270279 -jsInitHandle 3696 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3704 -initialChannelId {6b467c9e-f203-4202-90fb-7d68481fa659} -parentPid 1192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1192" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
                      8⤵
                      • Checks processor information in registry
                      PID:2132
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3852 -prefsLen 27276 -prefMapHandle 3856 -prefMapSize 270279 -ipcHandle 3948 -initialChannelId {fa372607-f588-44af-b5af-13eecba2acb4} -parentPid 1192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1192" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
                      8⤵
                        PID:2164
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4280 -prefsLen 34775 -prefMapHandle 4284 -prefMapSize 270279 -jsInitHandle 4288 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1668 -initialChannelId {e8f48be1-9525-450d-a3e5-a3c44f953629} -parentPid 1192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1192" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                        8⤵
                        • Checks processor information in registry
                        PID:3768
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4804 -prefsLen 35012 -prefMapHandle 4808 -prefMapSize 270279 -ipcHandle 4780 -initialChannelId {190c4c37-3eae-4267-bc4b-c53655009576} -parentPid 1192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1192" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
                        8⤵
                        • Checks processor information in registry
                        PID:3860
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4924 -prefsLen 32900 -prefMapHandle 4928 -prefMapSize 270279 -jsInitHandle 4932 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4940 -initialChannelId {07e592db-3145-4fa7-a9bf-f5b204991d08} -parentPid 1192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1192" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
                        8⤵
                        • Checks processor information in registry
                        PID:3704
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5220 -prefsLen 32900 -prefMapHandle 5224 -prefMapSize 270279 -jsInitHandle 5228 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5012 -initialChannelId {c08bd1a5-258d-48d2-9861-23a07945d8d5} -parentPid 1192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1192" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                        8⤵
                        • Checks processor information in registry
                        PID:5128
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5204 -prefsLen 32900 -prefMapHandle 5232 -prefMapSize 270279 -jsInitHandle 5236 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5244 -initialChannelId {41cc2ef0-ae1e-41e0-8979-1775f295ab7f} -parentPid 1192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1192" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                        8⤵
                        • Checks processor information in registry
                        PID:5144
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5500 -prefsLen 32952 -prefMapHandle 5496 -prefMapSize 270279 -jsInitHandle 5492 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4696 -initialChannelId {d06950e4-ccb5-4169-b82d-ff072c3a3e41} -parentPid 1192 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1192" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
                        8⤵
                        • Checks processor information in registry
                        PID:5664
                  • C:\Program Files (x86)\Internet Download Manager\Uninstall.exe
                    "C:\Program Files (x86)\Internet Download Manager\Uninstall.exe" -instdriv
                    6⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:2284
                    • C:\Windows\system32\RUNDLL32.EXE
                      "C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Program Files (x86)\Internet Download Manager\idmwfp.inf
                      7⤵
                      • Adds Run key to start application
                      • Drops file in Windows directory
                      • Suspicious use of WriteProcessMemory
                      PID:1888
                      • C:\Windows\system32\runonce.exe
                        "C:\Windows\system32\runonce.exe" -r
                        8⤵
                        • Checks processor information in registry
                        • Suspicious use of WriteProcessMemory
                        PID:2068
                        • C:\Windows\System32\grpconv.exe
                          "C:\Windows\System32\grpconv.exe" -o
                          9⤵
                            PID:4140
                      • C:\Windows\SysWOW64\net.exe
                        "C:\Windows\System32\net.exe" start IDMWFP
                        7⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:936
                        • C:\Windows\SysWOW64\net1.exe
                          C:\Windows\system32\net1 start IDMWFP
                          8⤵
                          • System Location Discovery: System Language Discovery
                          PID:1460
                      • C:\Windows\SysWOW64\net.exe
                        "C:\Windows\System32\net.exe" start IDMWFP
                        7⤵
                        • System Location Discovery: System Language Discovery
                        PID:5556
                        • C:\Windows\SysWOW64\net1.exe
                          C:\Windows\system32\net1 start IDMWFP
                          8⤵
                          • System Location Discovery: System Language Discovery
                          PID:5892
                      • C:\Windows\SysWOW64\net.exe
                        "C:\Windows\System32\net.exe" start IDMWFP
                        7⤵
                        • System Location Discovery: System Language Discovery
                        PID:6136
                        • C:\Windows\SysWOW64\net1.exe
                          C:\Windows\system32\net1 start IDMWFP
                          8⤵
                          • System Location Discovery: System Language Discovery
                          PID:4796
                      • C:\Windows\SysWOW64\net.exe
                        "C:\Windows\System32\net.exe" start IDMWFP
                        7⤵
                        • System Location Discovery: System Language Discovery
                        PID:5220
                        • C:\Windows\SysWOW64\net1.exe
                          C:\Windows\system32\net1 start IDMWFP
                          8⤵
                          • System Location Discovery: System Language Discovery
                          PID:5488
                      • C:\Windows\SysWOW64\net.exe
                        "C:\Windows\System32\net.exe" start IDMWFP
                        7⤵
                        • System Location Discovery: System Language Discovery
                        PID:5548
                        • C:\Windows\System32\Conhost.exe
                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          8⤵
                            PID:724
                          • C:\Windows\SysWOW64\net1.exe
                            C:\Windows\system32\net1 start IDMWFP
                            8⤵
                            • System Location Discovery: System Language Discovery
                            PID:5632
                        • C:\Windows\SysWOW64\net.exe
                          "C:\Windows\System32\net.exe" start IDMWFP
                          7⤵
                          • System Location Discovery: System Language Discovery
                          PID:5780
                          • C:\Windows\SysWOW64\net1.exe
                            C:\Windows\system32\net1 start IDMWFP
                            8⤵
                            • System Location Discovery: System Language Discovery
                            PID:5876
                        • C:\Windows\SysWOW64\regsvr32.exe
                          "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                          7⤵
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          PID:5912
                          • C:\Windows\system32\regsvr32.exe
                            /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                            8⤵
                            • Loads dropped DLL
                            • Modifies registry class
                            PID:5952
                      • C:\Program Files (x86)\Internet Download Manager\MediumILStart.exe
                        "C:\Program Files (x86)\Internet Download Manager\MediumILStart.exe"
                        6⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:3984
            • C:\ProgramData\Synaptics\Synaptics.exe
              C:\ProgramData\Synaptics\Synaptics.exe
              1⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Drops file in System32 directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1856
              • C:\Windows\SysWOW64\._cache_Synaptics.exe
                "C:\Windows\system32\._cache_Synaptics.exe"
                2⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:968
            • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
              "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
              1⤵
              • Checks processor information in registry
              • Enumerates system info in registry
              • Suspicious behavior: AddClipboardFormatListener
              • Suspicious use of SetWindowsHookEx
              PID:64
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
              1⤵
              • Drops file in Windows directory
              • Checks SCSI registry key(s)
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1916
              • C:\Windows\system32\DrvInst.exe
                DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{f93efd25-762e-a848-88e0-d4af33633376}\idmwfp.inf" "9" "4fc2928b3" "0000000000000140" "WinSta0\Default" "0000000000000158" "208" "C:\Program Files (x86)\Internet Download Manager"
                2⤵
                • Drops file in System32 directory
                • Drops file in Windows directory
                • Checks SCSI registry key(s)
                • Modifies data under HKEY_USERS
                PID:2144
              • C:\Windows\system32\DrvInst.exe
                DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\idmwfp.inf_amd64_8b0ebbc2b4585464\idmwfp.inf" "0" "4fc2928b3" "0000000000000158" "WinSta0\Default"
                2⤵
                • Drops file in Drivers directory
                • Drops file in System32 directory
                • Drops file in Windows directory
                • Suspicious use of AdjustPrivilegeToken
                PID:3984
              • C:\Windows\system32\DrvInst.exe
                DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\idmwfp.inf_amd64_8b0ebbc2b4585464\idmwfp.inf" "0" "4fc2928b3" "000000000000015C" "WinSta0\Default"
                2⤵
                • Drops file in Drivers directory
                • Drops file in Windows directory
                • Suspicious use of AdjustPrivilegeToken
                PID:5040
            • C:\Windows\system32\grpconv.exe
              grpconv -o
              1⤵
                PID:4844
              • C:\Windows\System32\Conhost.exe
                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                1⤵
                  PID:2144
                • C:\Program Files (x86)\Internet Download Manager\IDMan.exe
                  "C:\Program Files (x86)\Internet Download Manager\IDMan.exe" -Embedding
                  1⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Modifies Internet Explorer settings
                  • Modifies registry class
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of SetWindowsHookEx
                  PID:3368
                  • C:\Windows\SysWOW64\regsvr32.exe
                    "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                    2⤵
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    PID:4812
                    • C:\Windows\system32\regsvr32.exe
                      /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                      3⤵
                      • Loads dropped DLL
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5312
                  • C:\Program Files (x86)\Internet Download Manager\Uninstall.exe
                    "C:\Program Files (x86)\Internet Download Manager\Uninstall.exe" -instdriv
                    2⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:3384
                    • C:\Windows\system32\RUNDLL32.EXE
                      "C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Program Files (x86)\Internet Download Manager\idmwfp.inf
                      3⤵
                      • Adds Run key to start application
                      • Drops file in Windows directory
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4688
                      • C:\Windows\system32\runonce.exe
                        "C:\Windows\system32\runonce.exe" -r
                        4⤵
                        • Checks processor information in registry
                        PID:2032
                        • C:\Windows\System32\grpconv.exe
                          "C:\Windows\System32\grpconv.exe" -o
                          5⤵
                            PID:5204
                      • C:\Windows\SysWOW64\net.exe
                        "C:\Windows\System32\net.exe" start IDMWFP
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:5212
                        • C:\Windows\SysWOW64\net1.exe
                          C:\Windows\system32\net1 start IDMWFP
                          4⤵
                          • System Location Discovery: System Language Discovery
                          PID:5536
                      • C:\Windows\SysWOW64\net.exe
                        "C:\Windows\System32\net.exe" start IDMWFP
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:5836
                        • C:\Windows\SysWOW64\net1.exe
                          C:\Windows\system32\net1 start IDMWFP
                          4⤵
                          • System Location Discovery: System Language Discovery
                          PID:5856
                      • C:\Windows\SysWOW64\net.exe
                        "C:\Windows\System32\net.exe" start IDMWFP
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:5416
                        • C:\Windows\SysWOW64\net1.exe
                          C:\Windows\system32\net1 start IDMWFP
                          4⤵
                          • System Location Discovery: System Language Discovery
                          PID:4976
                      • C:\Windows\SysWOW64\net.exe
                        "C:\Windows\System32\net.exe" start IDMWFP
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:6068
                        • C:\Windows\SysWOW64\net1.exe
                          C:\Windows\system32\net1 start IDMWFP
                          4⤵
                          • System Location Discovery: System Language Discovery
                          PID:6120
                      • C:\Windows\SysWOW64\net.exe
                        "C:\Windows\System32\net.exe" start IDMWFP
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:6076
                        • C:\Windows\SysWOW64\net1.exe
                          C:\Windows\system32\net1 start IDMWFP
                          4⤵
                          • System Location Discovery: System Language Discovery
                          PID:6044
                      • C:\Windows\SysWOW64\net.exe
                        "C:\Windows\System32\net.exe" start IDMWFP
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:2180
                        • C:\Windows\SysWOW64\net1.exe
                          C:\Windows\system32\net1 start IDMWFP
                          4⤵
                          • System Location Discovery: System Language Discovery
                          PID:1544
                      • C:\Windows\SysWOW64\regsvr32.exe
                        "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                        3⤵
                        • Loads dropped DLL
                        • System Location Discovery: System Language Discovery
                        PID:2852
                        • C:\Windows\system32\regsvr32.exe
                          /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                          4⤵
                          • Loads dropped DLL
                          • Suspicious use of AdjustPrivilegeToken
                          PID:5200

                  Network

                        MITRE ATT&CK Enterprise v16

                        Reconnaissance

                        Resource Development

                        Initial Access

                        Execution

                        Persistence

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Browser Extensions

                        1
                        T1176

                        Event Triggered Execution

                        1
                        T1546

                        Component Object Model Hijacking

                        1
                        T1546.015

                        Privilege Escalation

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Event Triggered Execution

                        1
                        T1546

                        Component Object Model Hijacking

                        1
                        T1546.015

                        Defense Evasion

                        Modify Registry

                        3
                        T1112

                        Credential Access

                        Credentials from Password Stores

                        1
                        T1555

                        Credentials from Web Browsers

                        1
                        T1555.003

                        Unsecured Credentials

                        1
                        T1552

                        Credentials In Files

                        1
                        T1552.001

                        Discovery

                        Peripheral Device Discovery

                        1
                        T1120

                        Query Registry

                        6
                        T1012

                        System Information Discovery

                        5
                        T1082

                        System Location Discovery

                        1
                        T1614

                        System Language Discovery

                        1
                        T1614.001

                        Lateral Movement

                        Collection

                        Data from Local System

                        1
                        T1005

                        Command and Control

                        Exfiltration

                        Impact

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        IDMGetAll.dll
                        • Path C:\Program Files (x86)\Internet Download Manager\IDMGetAll.dll
                        • Size 73KB
                        • SHA256 33a8a6b9413d60a38237bafc4c331dfebf0bf64f8057abc335b4a6a6b95c9381
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        IDMGetAll64.dll
                        • Path C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll
                        • Size 93KB
                        • SHA256 117abaeb27451944c72ffee804e674046c58d769bd2e940c71e66edec0725bd1
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        IDMIECC.dll
                        • Path C:\Program Files (x86)\Internet Download Manager\IDMIECC.dll
                        • Size 463KB
                        • SHA256 9a9989644213043f2cfff177b907ef2bdd496c2f65803d8f158eae9034918878
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        IDMIECC64.dll
                        • Path C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll
                        • Size 656KB
                        • SHA256 d0c6d455d067e8717efe2cfb9bdcbeae27b48830fe77e9d45c351fbfb164716d
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        IDMNetMon64.dll
                        • Path C:\Program Files (x86)\Internet Download Manager\IDMNetMon64.dll
                        • Size 516KB
                        • SHA256 061e3839574c96ff2eed28d6bdd0eb3d0654c45f3abbd414ed46d6be73af3c72
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        IDMShellExt64.dll
                        • Path C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll
                        • Size 36KB
                        • SHA256 48e5c5916f100880e68c9e667c4457eb0065c5c7ab40fb6d85028fd23d3e4838
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        IDMan.exe
                        • Path C:\Program Files (x86)\Internet Download Manager\IDMan.exe
                        • Size 5.8MB
                        • SHA256 6177f946b79dbf2657e2c8990345d0f3b7c9ede4336b73bee8607043882e1cc3
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        MediumILStart.exe
                        • Path C:\Program Files (x86)\Internet Download Manager\MediumILStart.exe
                        • Size 51KB
                        • SHA256 a4fda3af1c386028b46629e6f5113b36aab7e76278ea6683b82eb575dfb9be7b
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        downlWithIDM.dll
                        • Path C:\Program Files (x86)\Internet Download Manager\downlWithIDM.dll
                        • Size 197KB
                        • SHA256 38ac192d707f3ec697dd5fe01a0c6fc424184793df729f427c0cf5dfab6705fe
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        downlWithIDM64.dll
                        • Path C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll
                        • Size 155KB
                        • SHA256 8a51ece1c4c8bcb8c56ca10cb9d97bff0dfe75052412a8d8d970a5eb6933427b
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        idmBroker.exe
                        • Path C:\Program Files (x86)\Internet Download Manager\idmBroker.exe
                        • Size 153KB
                        • SHA256 97810e0b3838a7dca94d73a8b9e170107642b064713c084c231de6632cb68a9c
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        idmfsa.dll
                        • Path C:\Program Files (x86)\Internet Download Manager\idmfsa.dll
                        • Size 90KB
                        • SHA256 801d3a802a641212b54c9f0ef0d762b08bcca9ab4f2c8603d823a1c1bc38c75a
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        idmvs.dll
                        • Path C:\Program Files (x86)\Internet Download Manager\idmvs.dll
                        • Size 20KB
                        • SHA256 a2e28177b51a556742a164955f8b62dcf2bdf848c2f6907fea0c92ee8e4ccddd
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        Synaptics.exe
                        • Path C:\ProgramData\Synaptics\Synaptics.exe
                        • Size 12.5MB
                        • SHA256 1870750bca90d7dd32b7e30930fb89139ca0aa2ec3ca8fb0ead7888c5370590e
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        ExplorerStartupLog_RunOnce.etl
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl
                        • Size 8KB
                        • SHA256 89e66f488283263d6da73c1ba39524988cc8fdde895ace2acc2ad585df38acb8
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nxqdpovk.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
                        • Size 15KB
                        • SHA256 dcb4138fd67fdadac9df953c11b4c2daf71a939cd7164c1b9cae2911e6e6074f
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        9512A4488B00CC053350DAC32D417B4A35C11513
                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nxqdpovk.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
                        • Size 15KB
                        • SHA256 cfa7146178353b49807b281461967b6e9c0bf6bd8165303d8ef877139b8a1335
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        webext.sc.lz4
                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nxqdpovk.default-release\startupCache\webext.sc.lz4
                        • Size 104KB
                        • SHA256 b2ca3b4af6d0583437447c4f0d2546d45920f7945285358c115dfda23de51ce3
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        ._cache_2026-07-20_792f2e49b9763fc40d089f35d82f087f_dark-comet_darkgate_elex_gcleaner_glassworm_hijackloader.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\._cache_2026-07-20_792f2e49b9763fc40d089f35d82f087f_dark-comet_darkgate_elex_gcleaner_glassworm_hijackloader.exe
                        • Size 11.7MB
                        • SHA256 49f862f66a39600d1778fc29ef3a8c8f3c1854a4b3eaa17e5a9ae445ad50c3e3
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        3F985E00
                        • Path C:\Users\Admin\AppData\Local\Temp\3F985E00
                        • Size 21KB
                        • SHA256 0e04bd07625f4e22c2dd766494edb65cf5a92b7df46a6dff8bd2483594908029
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        IDM1.tmp
                        • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp
                        • Size 162KB
                        • SHA256 645ee6e64ed04825b25964d992d0205963498bb9d61f5a52be7e76ddb2074003
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        IDMSetup2.log
                        • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDMSetup2.log
                        • Size 354B
                        • SHA256 9e204b604538ddc273eb7ac2ebcc92add539ae01d228d055ce99d4a08370fbd4
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        IDMSetup2.log
                        • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDMSetup2.log
                        • Size 982B
                        • SHA256 21694fa059623f228cd594023b52128012b62124e00142dbc058f77eba51b08f
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        IDMSetup2.log
                        • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDMSetup2.log
                        • Size 2KB
                        • SHA256 dc52201539f1fc31738c348d92c326c831b50dfce10419de7ac3d9f89531abca
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        IDMSetup2.log
                        • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDMSetup2.log
                        • Size 4KB
                        • SHA256 11fe14785ab857ecde9157059b748a02ba11707154347b71833f1aa13f982c31
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        gp2rld5S.xlsm
                        • Path C:\Users\Admin\AppData\Local\Temp\gp2rld5S.xlsm
                        • Size 17KB
                        • SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        tmpaddon
                        • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                        • Size 11KB
                        • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        tmpaddon
                        • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                        • Size 502KB
                        • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        defextmap.dat
                        • Path C:\Users\Admin\AppData\Roaming\IDM\defextmap.dat
                        • Size 3KB
                        • SHA256 9d1f79719b84eec484602b501d3d9eab89336c25b6d0cc586957bc2e10e845a1
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        urlexclist.dat
                        • Path C:\Users\Admin\AppData\Roaming\IDM\urlexclist.dat
                        • Size 3KB
                        • SHA256 9efd5d506f16932728de5c0fb7dc0e4b75713920bbcefb108a610c6c1ae45430
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        data.safe.tmp
                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
                        • Size 7KB
                        • SHA256 896a77e1e71c0b65ce25cf28498ffd6677a7069d038d0d25afe7d762cdd22a60
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        data.safe.tmp
                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
                        • Size 5KB
                        • SHA256 a90ac61f98e36a484aec8dd6952051d05e2ef181ccd1346bac4a4e256c0153fe
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        events
                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\events\events
                        • Size 1KB
                        • SHA256 e05bead801b26f525f177daf0f522198a87901c57268d66f2c66f835c837af18
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        1ed38616-6d41-4408-aae1-fa3c942cfb4e
                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\1ed38616-6d41-4408-aae1-fa3c942cfb4e
                        • Size 235B
                        • SHA256 66a7205ecb840a6f2cddf1efa4c172e66763576f140f1d0e637c489fbe83d68b
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        346f7cd2-3437-47a9-a8e2-90284c479e81
                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\346f7cd2-3437-47a9-a8e2-90284c479e81
                        • Size 883B
                        • SHA256 2692a9b8be28e67ea6f05ff70cce9ad28e292c310eb445657d36399cb9f01762
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        50ce5aa6-bd3e-4cc4-8a38-5f4e7abde239
                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\50ce5aa6-bd3e-4cc4-8a38-5f4e7abde239
                        • Size 15KB
                        • SHA256 e8b80c1999c728705cbbcbc03dbcc4642598c997d5ede524019a2b698a1484c0
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        74649a09-0bb0-44f3-8b51-27fbd14ad65e
                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\74649a09-0bb0-44f3-8b51-27fbd14ad65e
                        • Size 886B
                        • SHA256 df35eddd1425beee7fc6a0f96305878e9ffff8989c6feb2ec0b9b76d9092169b
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        86193154-9270-4588-b027-a17977fc87f2
                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\86193154-9270-4588-b027-a17977fc87f2
                        • Size 2KB
                        • SHA256 694cbe53049c8d6af08cd47a82a1214cabb4fa03ed770c402e6ee8354a63de77
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        a93124b4-8bf5-489a-b8e8-1fc8fa10683f
                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\a93124b4-8bf5-489a-b8e8-1fc8fa10683f
                        • Size 235B
                        • SHA256 7ce07a2b78a706a72054881d08c0da1c84b1679563cc286d2fb0d5d7faa8a3de
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        extensions.json
                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\extensions.json
                        • Size 16KB
                        • SHA256 2d86096bc8812c799c9ded636f12083110aeea6270993a37bf0bf0ce28ddab23
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        gmpopenh264.dll
                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                        • Size 1.1MB
                        • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        gmpopenh264.info
                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                        • Size 116B
                        • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        manifest.json
                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
                        • Size 1002B
                        • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        widevinecdm.dll
                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
                        • Size 21.6MB
                        • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        prefs-1.js
                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs-1.js
                        • Size 6KB
                        • SHA256 72aaf69fa143b34fdbf3a3d66b11d34102d6dedd6cbd37beb5371928b5add817
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        prefs-1.js
                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs-1.js
                        • Size 8KB
                        • SHA256 b0160a628ece9790052a1f0c50d75d8a897402bf65d74d4675d9141d6684a938
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        prefs.js
                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs.js
                        • Size 6KB
                        • SHA256 0224fce5364d5604a8e02db13ead92075dc29ac553352fbd860f400322812f63
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        prefs.js
                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs.js
                        • Size 7KB
                        • SHA256 aa898baa61ef37fe4612202fe75ee52161eb55bbb2fc72f1385f6c4b8a1e94b4
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        prefs.js
                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs.js
                        • Size 6KB
                        • SHA256 dfa80e71936b88ae9677a8af417b7b33611f7b3d395f1f74462538e3de33d2d9
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        recovery.baklz4
                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\sessionstore-backups\recovery.baklz4
                        • Size 4KB
                        • SHA256 727c42caa9a1cabc5db6283f36c14ed92358e36b56e9df8da94d0a8a0b2786ff
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        SET1CC5.tmp
                        • Path C:\Windows\System32\DriverStore\Temp\{e0eb3f73-a8ab-8046-a6a5-41ba41bad926}\SET1CC5.tmp
                        • Size 169KB
                        • SHA256 753a1386e7b37ee313db908183afe7238f1a2aec5e6c1e59e9c11d471b6aaa8d
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        SET1CC6.tmp
                        • Path C:\Windows\System32\DriverStore\Temp\{e0eb3f73-a8ab-8046-a6a5-41ba41bad926}\SET1CC6.tmp
                        • Size 12KB
                        • SHA256 52818c67be219bc3b05c58b40e51b99a65c2f4bcafe38a995610b4ec10928def
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        SET1CD7.tmp
                        • Path C:\Windows\System32\DriverStore\Temp\{e0eb3f73-a8ab-8046-a6a5-41ba41bad926}\SET1CD7.tmp
                        • Size 2KB
                        • SHA256 a54e0ac05254a464180e30f21a6b26651e7495427353bba9c246ba1d2388e7cc
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        memory/64-254-0x00007FFF79C70000-0x00007FFF79C80000-memory.dmp
                        Download

                        memory/64-253-0x00007FFF79C70000-0x00007FFF79C80000-memory.dmp
                        Download

                        memory/64-255-0x00007FFF79C70000-0x00007FFF79C80000-memory.dmp
                        Download

                        memory/64-259-0x00007FFF776E0000-0x00007FFF776F0000-memory.dmp
                        Download

                        memory/64-258-0x00007FFF776E0000-0x00007FFF776F0000-memory.dmp
                        Download

                        memory/64-256-0x00007FFF79C70000-0x00007FFF79C80000-memory.dmp
                        Download

                        memory/64-252-0x00007FFF79C70000-0x00007FFF79C80000-memory.dmp
                        Download

                        memory/368-743-0x0000000000400000-0x000000000042B000-memory.dmp
                        Download

                        memory/1856-250-0x0000000000400000-0x000000000107A000-memory.dmp
                        Download

                        memory/2284-1262-0x0000000000400000-0x000000000042B000-memory.dmp
                        Download

                        memory/2284-792-0x0000000000400000-0x000000000042B000-memory.dmp
                        Download

                        memory/2344-130-0x0000000000400000-0x000000000107A000-memory.dmp
                        Download

                        memory/2344-0-0x0000000003020000-0x0000000003021000-memory.dmp
                        Download

                        memory/2344-1-0x00000000004A0000-0x00000000004A1000-memory.dmp
                        Download

                        memory/3384-1298-0x0000000000400000-0x000000000042B000-memory.dmp
                        Download

                        memory/3384-1286-0x0000000000400000-0x000000000042B000-memory.dmp
                        Download

                        memory/3816-858-0x0000000000400000-0x000000000042B000-memory.dmp
                        Download

                        memory/3816-129-0x0000000000400000-0x000000000042B000-memory.dmp
                        Download

                        memory/4004-760-0x0000000000400000-0x000000000107A000-memory.dmp
                        Download

                        memory/4004-260-0x0000000000400000-0x000000000107A000-memory.dmp
                        Download

                        memory/4004-310-0x0000000000400000-0x000000000107A000-memory.dmp
                        Download

                        memory/4004-1500-0x0000000000400000-0x000000000107A000-memory.dmp
                        Download