Overview

overview

10

Static

static

10

2026-07-20...er.exe

windows10-2004-x64

10

2026-07-20...er.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/07/2026, 13:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-20_792f2e49b9763fc40d089f35d82f087f_dark-comet_darkgate_elex_gcleaner_glassworm_hijackloader.exe
  • Size 12.5MB
  • Sample260720-qbppcsds8x
  • SHA256 1870750bca90d7dd32b7e30930fb89139ca0aa2ec3ca8fb0ead7888c5370590e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarebackdoordiscoveryxredpersistencephishingprivilege_escalationspywarestealer

Malware Config

Extracted

Family

  • xred

C2

  • xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
  • Drops file in Drivers directory 2 IoCs
  • A potential corporate email address has been identified in the URL: [email protected]
    phishing
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 39 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in System32 directory 17 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 45 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 16 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 28 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 63 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 41 IoCs
  • Modifies registry class 64 IoCs
  • Runs net.exe
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: LoadsDriver 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 23 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-20_792f2e49b9763fc40d089f35d82f087f_dark-comet_darkgate_elex_gcleaner_glassworm_hijackloader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-20_792f2e49b9763fc40d089f35d82f087f_dark-comet_darkgate_elex_gcleaner_glassworm_hijackloader.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4116
    • C:\Users\Admin\AppData\Local\Temp\._cache_2026-07-20_792f2e49b9763fc40d089f35d82f087f_dark-comet_darkgate_elex_gcleaner_glassworm_hijackloader.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_2026-07-20_792f2e49b9763fc40d089f35d82f087f_dark-comet_darkgate_elex_gcleaner_glassworm_hijackloader.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3504
      • C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp
        "C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp" -d "C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Installs/modifies Browser Helper Object
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3276
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2372
          • C:\Windows\system32\regsvr32.exe
            /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
            5⤵
            • Loads dropped DLL
            • Modifies registry class
            PID:4288
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5976
          • C:\Windows\system32\regsvr32.exe
            /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
            5⤵
            • Loads dropped DLL
            • Modifies registry class
            PID:1756
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2356
          • C:\Windows\system32\regsvr32.exe
            /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
            5⤵
            • Loads dropped DLL
            • Modifies registry class
            PID:4896
        • C:\Program Files (x86)\Internet Download Manager\idmBroker.exe
          "C:\Program Files (x86)\Internet Download Manager\idmBroker.exe" -RegServer
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Modifies registry class
          PID:3360
        • C:\Program Files (x86)\Internet Download Manager\IDMan.exe
          "C:\Program Files (x86)\Internet Download Manager\IDMan.exe" /rtr
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1888
          • C:\Windows\SysWOW64\regsvr32.exe
            "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
            5⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:6088
            • C:\Windows\system32\regsvr32.exe
              /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
              6⤵
              • Loads dropped DLL
              PID:1128
          • C:\Windows\SysWOW64\regsvr32.exe
            "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
            5⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5476
            • C:\Windows\system32\regsvr32.exe
              /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
              6⤵
              • Loads dropped DLL
              • Modifies registry class
              PID:4744
          • C:\Windows\SysWOW64\regsvr32.exe
            "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
            5⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4768
            • C:\Windows\system32\regsvr32.exe
              /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
              6⤵
              • Loads dropped DLL
              • Modifies registry class
              PID:5024
          • C:\Windows\SysWOW64\regsvr32.exe
            "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
            5⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2496
            • C:\Windows\system32\regsvr32.exe
              /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
              6⤵
              • Loads dropped DLL
              • Modifies registry class
              PID:5888
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3344
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
              6⤵
              • Checks processor information in registry
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:996
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1940 -prefsLen 27097 -prefMapHandle 1944 -prefMapSize 270279 -ipcHandle 2028 -initialChannelId {88bc740e-8569-49e9-8379-8833679cf110} -parentPid 996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.996" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
                7⤵
                  PID:2856
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2408 -prefsLen 27133 -prefMapHandle 2412 -prefMapSize 270279 -ipcHandle 2420 -initialChannelId {3fe8ca41-9bb1-4967-a9f7-f8ef9df7983d} -parentPid 996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
                  7⤵
                    PID:4112
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3840 -prefsLen 25213 -prefMapHandle 3844 -prefMapSize 270279 -jsInitHandle 3848 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3856 -initialChannelId {7b5dbee8-f243-41a8-8226-30624be0e7ad} -parentPid 996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
                    7⤵
                    • Checks processor information in registry
                    PID:2980
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4052 -prefsLen 27323 -prefMapHandle 4056 -prefMapSize 270279 -ipcHandle 4128 -initialChannelId {cf49b31f-252a-420a-b2df-681f5d2b4d53} -parentPid 996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.996" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
                    7⤵
                      PID:4888
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4556 -prefsLen 34822 -prefMapHandle 4560 -prefMapSize 270279 -jsInitHandle 4564 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3232 -initialChannelId {e6c7cf22-543c-4f09-b501-e56e59277210} -parentPid 996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                      7⤵
                      • Checks processor information in registry
                      PID:5416
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4516 -prefsLen 34929 -prefMapHandle 2564 -prefMapSize 270279 -jsInitHandle 5044 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1636 -initialChannelId {a8ba0aa7-6f1e-4d6a-8f16-d94e2082b820} -parentPid 996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
                      7⤵
                      • Checks processor information in registry
                      PID:6592
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5144 -prefsLen 35010 -prefMapHandle 5148 -prefMapSize 270279 -ipcHandle 5156 -initialChannelId {e5535294-02ad-4f63-80ac-8ee390cd0d8d} -parentPid 996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 utility
                      7⤵
                      • Checks processor information in registry
                      PID:6608
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5632 -prefsLen 32952 -prefMapHandle 5636 -prefMapSize 270279 -jsInitHandle 5640 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5616 -initialChannelId {df9211c1-07b0-4ad7-b521-03fc7b860bcd} -parentPid 996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                      7⤵
                      • Checks processor information in registry
                      PID:7116
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5816 -prefsLen 32952 -prefMapHandle 5820 -prefMapSize 270279 -jsInitHandle 5824 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5828 -initialChannelId {91bdbc75-fc66-441b-ade7-f95ea40d83dc} -parentPid 996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                      7⤵
                      • Checks processor information in registry
                      PID:7124
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6000 -prefsLen 32952 -prefMapHandle 6004 -prefMapSize 270279 -jsInitHandle 6008 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6016 -initialChannelId {7cd15ad1-24d2-4cfb-a6da-447f6d7bfd67} -parentPid 996 -crashReporter "\\.\pipe\gecko-crash-server-pipe.996" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
                      7⤵
                      • Checks processor information in registry
                      PID:7132
                • C:\Program Files (x86)\Internet Download Manager\Uninstall.exe
                  "C:\Program Files (x86)\Internet Download Manager\Uninstall.exe" -instdriv
                  5⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:5696
                  • C:\Windows\system32\RUNDLL32.EXE
                    "C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Program Files (x86)\Internet Download Manager\idmwfp.inf
                    6⤵
                    • Adds Run key to start application
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:4772
                    • C:\Windows\system32\runonce.exe
                      "C:\Windows\system32\runonce.exe" -r
                      7⤵
                      • Checks processor information in registry
                      • Suspicious use of WriteProcessMemory
                      PID:3944
                      • C:\Windows\System32\grpconv.exe
                        "C:\Windows\System32\grpconv.exe" -o
                        8⤵
                          PID:4852
                    • C:\Windows\SysWOW64\net.exe
                      "C:\Windows\System32\net.exe" start IDMWFP
                      6⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:256
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 start IDMWFP
                        7⤵
                        • System Location Discovery: System Language Discovery
                        PID:3120
                    • C:\Windows\SysWOW64\net.exe
                      "C:\Windows\System32\net.exe" start IDMWFP
                      6⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:6900
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 start IDMWFP
                        7⤵
                        • System Location Discovery: System Language Discovery
                        PID:6988
                    • C:\Windows\SysWOW64\net.exe
                      "C:\Windows\System32\net.exe" start IDMWFP
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:6120
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 start IDMWFP
                        7⤵
                        • System Location Discovery: System Language Discovery
                        PID:1144
                    • C:\Windows\SysWOW64\net.exe
                      "C:\Windows\System32\net.exe" start IDMWFP
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:2520
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 start IDMWFP
                        7⤵
                        • System Location Discovery: System Language Discovery
                        PID:3012
                    • C:\Windows\SysWOW64\net.exe
                      "C:\Windows\System32\net.exe" start IDMWFP
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:6168
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 start IDMWFP
                        7⤵
                        • System Location Discovery: System Language Discovery
                        PID:6224
                    • C:\Windows\SysWOW64\net.exe
                      "C:\Windows\System32\net.exe" start IDMWFP
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:6244
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 start IDMWFP
                        7⤵
                        • System Location Discovery: System Language Discovery
                        PID:6292
                    • C:\Windows\SysWOW64\regsvr32.exe
                      "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                      6⤵
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      PID:6312
                      • C:\Windows\system32\regsvr32.exe
                        /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                        7⤵
                        • Loads dropped DLL
                        PID:6340
                  • C:\Program Files (x86)\Internet Download Manager\MediumILStart.exe
                    "C:\Program Files (x86)\Internet Download Manager\MediumILStart.exe"
                    5⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:6572
            • C:\ProgramData\Synaptics\Synaptics.exe
              "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
              2⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2952
          • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
            "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
            1⤵
            • Checks processor information in registry
            • Enumerates system info in registry
            • Suspicious behavior: AddClipboardFormatListener
            • Suspicious use of SetWindowsHookEx
            PID:52
          • C:\ProgramData\Synaptics\Synaptics.exe
            C:\ProgramData\Synaptics\Synaptics.exe
            1⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2420
          • C:\Windows\system32\DrvInst.exe
            DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{f72cdbd4-4736-8443-b967-11f0990d1091}\idmwfp.inf" "9" "4fc2928b3" "0000000000000184" "WinSta0\Default" "0000000000000188" "208" "C:\Program Files (x86)\Internet Download Manager"
            1⤵
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Modifies data under HKEY_USERS
            PID:948
          • C:\Windows\system32\DrvInst.exe
            DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\idmwfp.inf_amd64_8b0ebbc2b4585464\idmwfp.inf" "0" "4fc2928b3" "0000000000000184" "WinSta0\Default"
            1⤵
            • Drops file in Drivers directory
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Suspicious use of AdjustPrivilegeToken
            PID:3216
          • C:\Windows\system32\grpconv.exe
            grpconv -o
            1⤵
              PID:2288
            • C:\Program Files (x86)\Internet Download Manager\IDMan.exe
              "C:\Program Files (x86)\Internet Download Manager\IDMan.exe" -Embedding
              1⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of SetWindowsHookEx
              PID:3552
              • C:\Windows\SysWOW64\regsvr32.exe
                "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                2⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:6920
                • C:\Windows\system32\regsvr32.exe
                  /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                  3⤵
                  • Loads dropped DLL
                  • Modifies registry class
                  • Suspicious use of AdjustPrivilegeToken
                  PID:7060
              • C:\Program Files (x86)\Internet Download Manager\Uninstall.exe
                "C:\Program Files (x86)\Internet Download Manager\Uninstall.exe" -instdriv
                2⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:6512
                • C:\Windows\system32\RUNDLL32.EXE
                  "C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Program Files (x86)\Internet Download Manager\idmwfp.inf
                  3⤵
                  • Adds Run key to start application
                  • Drops file in Windows directory
                  • Suspicious use of AdjustPrivilegeToken
                  PID:7160
                  • C:\Windows\system32\runonce.exe
                    "C:\Windows\system32\runonce.exe" -r
                    4⤵
                    • Checks processor information in registry
                    PID:1512
                    • C:\Windows\System32\grpconv.exe
                      "C:\Windows\System32\grpconv.exe" -o
                      5⤵
                        PID:5484
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" start IDMWFP
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:3204
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start IDMWFP
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:4232
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" start IDMWFP
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:4960
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start IDMWFP
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:1964
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" start IDMWFP
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:788
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start IDMWFP
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:5888
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" start IDMWFP
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:5024
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start IDMWFP
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:2752
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" start IDMWFP
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:2980
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start IDMWFP
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:6220
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" start IDMWFP
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:6240
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start IDMWFP
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:6288
                  • C:\Windows\SysWOW64\regsvr32.exe
                    "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                    3⤵
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    PID:2600
                    • C:\Windows\system32\regsvr32.exe
                      /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                      4⤵
                      • Loads dropped DLL
                      • Suspicious use of AdjustPrivilegeToken
                      PID:6308
              • C:\Windows\system32\DrvInst.exe
                DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\idmwfp.inf_amd64_8b0ebbc2b4585464\idmwfp.inf" "0" "4fc2928b3" "0000000000000114" "WinSta0\Default"
                1⤵
                • Drops file in Drivers directory
                • Drops file in Windows directory
                • Suspicious use of AdjustPrivilegeToken
                PID:1212

              Network

                    MITRE ATT&CK Enterprise v16

                    Reconnaissance

                    Resource Development

                    Initial Access

                    Execution

                    Persistence

                    Boot or Logon Autostart Execution

                    1
                    T1547

                    Registry Run Keys / Startup Folder

                    1
                    T1547.001

                    Browser Extensions

                    1
                    T1176

                    Event Triggered Execution

                    1
                    T1546

                    Component Object Model Hijacking

                    1
                    T1546.015

                    Privilege Escalation

                    Boot or Logon Autostart Execution

                    1
                    T1547

                    Registry Run Keys / Startup Folder

                    1
                    T1547.001

                    Event Triggered Execution

                    1
                    T1546

                    Component Object Model Hijacking

                    1
                    T1546.015

                    Defense Evasion

                    Modify Registry

                    3
                    T1112

                    Credential Access

                    Credentials from Password Stores

                    1
                    T1555

                    Credentials from Web Browsers

                    1
                    T1555.003

                    Unsecured Credentials

                    1
                    T1552

                    Credentials In Files

                    1
                    T1552.001

                    Discovery

                    Peripheral Device Discovery

                    1
                    T1120

                    Query Registry

                    5
                    T1012

                    System Information Discovery

                    4
                    T1082

                    System Location Discovery

                    1
                    T1614

                    System Language Discovery

                    1
                    T1614.001

                    Lateral Movement

                    Collection

                    Data from Local System

                    1
                    T1005

                    Command and Control

                    Exfiltration

                    Impact

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    IDMGetAll.dll
                    • Path C:\Program Files (x86)\Internet Download Manager\IDMGetAll.dll
                    • Size 73KB
                    • SHA256 33a8a6b9413d60a38237bafc4c331dfebf0bf64f8057abc335b4a6a6b95c9381
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    IDMGetAll64.dll
                    • Path C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll
                    • Size 93KB
                    • SHA256 117abaeb27451944c72ffee804e674046c58d769bd2e940c71e66edec0725bd1
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    IDMIECC.dll
                    • Path C:\Program Files (x86)\Internet Download Manager\IDMIECC.dll
                    • Size 463KB
                    • SHA256 9a9989644213043f2cfff177b907ef2bdd496c2f65803d8f158eae9034918878
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    IDMIECC64.dll
                    • Path C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll
                    • Size 656KB
                    • SHA256 d0c6d455d067e8717efe2cfb9bdcbeae27b48830fe77e9d45c351fbfb164716d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    IDMNetMon64.dll
                    • Path C:\Program Files (x86)\Internet Download Manager\IDMNetMon64.dll
                    • Size 516KB
                    • SHA256 061e3839574c96ff2eed28d6bdd0eb3d0654c45f3abbd414ed46d6be73af3c72
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    IDMShellExt64.dll
                    • Path C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll
                    • Size 36KB
                    • SHA256 48e5c5916f100880e68c9e667c4457eb0065c5c7ab40fb6d85028fd23d3e4838
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    IDMan.exe
                    • Path C:\Program Files (x86)\Internet Download Manager\IDMan.exe
                    • Size 5.8MB
                    • SHA256 6177f946b79dbf2657e2c8990345d0f3b7c9ede4336b73bee8607043882e1cc3
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    MediumILStart.exe
                    • Path C:\Program Files (x86)\Internet Download Manager\MediumILStart.exe
                    • Size 51KB
                    • SHA256 a4fda3af1c386028b46629e6f5113b36aab7e76278ea6683b82eb575dfb9be7b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    downlWithIDM.dll
                    • Path C:\Program Files (x86)\Internet Download Manager\downlWithIDM.dll
                    • Size 197KB
                    • SHA256 38ac192d707f3ec697dd5fe01a0c6fc424184793df729f427c0cf5dfab6705fe
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    downlWithIDM64.dll
                    • Path C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll
                    • Size 155KB
                    • SHA256 8a51ece1c4c8bcb8c56ca10cb9d97bff0dfe75052412a8d8d970a5eb6933427b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    idmBroker.exe
                    • Path C:\Program Files (x86)\Internet Download Manager\idmBroker.exe
                    • Size 153KB
                    • SHA256 97810e0b3838a7dca94d73a8b9e170107642b064713c084c231de6632cb68a9c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    idmfsa.dll
                    • Path C:\Program Files (x86)\Internet Download Manager\idmfsa.dll
                    • Size 90KB
                    • SHA256 801d3a802a641212b54c9f0ef0d762b08bcca9ab4f2c8603d823a1c1bc38c75a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    idmftype.dll
                    • Path C:\Program Files (x86)\Internet Download Manager\idmftype.dll
                    • Size 42KB
                    • SHA256 3a47dbb1f86f2c51f3f8fb9c3a8b1309f5e182ab9af55179959104d262ce985d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    idmindex.dll
                    • Path C:\Program Files (x86)\Internet Download Manager\idmindex.dll
                    • Size 427KB
                    • SHA256 1fdb0d5b31e080084c82e0b773dafc7860fa860938b8baef6a4d7f5bde659f73
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    idmnmcl.dll
                    • Path C:\Program Files (x86)\Internet Download Manager\idmnmcl.dll
                    • Size 38KB
                    • SHA256 445b14c8a5f5a605298984b3be79551aa90aca4db399802d891aa032f10ba181
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    idmvs.dll
                    • Path C:\Program Files (x86)\Internet Download Manager\idmvs.dll
                    • Size 20KB
                    • SHA256 a2e28177b51a556742a164955f8b62dcf2bdf848c2f6907fea0c92ee8e4ccddd
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Synaptics.exe
                    • Path C:\ProgramData\Synaptics\Synaptics.exe
                    • Size 753KB
                    • SHA256 c2b049e3a2f12d959c2a4e87cc04dcb91b0ae31df69d814090df3f60374385e1
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ExplorerStartupLog_RunOnce.etl
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl
                    • Size 8KB
                    • SHA256 9c123390bb6ae24b7e9251db0ffaa2cc54ae0dc9f375215f9658664b92b77be3
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
                    • Size 15KB
                    • SHA256 e1a43f4aa3a84a49ffbe8a2a16385ab67d693eb6dd2822d17fd3939fb2645bac
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    9512A4488B00CC053350DAC32D417B4A35C11513
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
                    • Size 15KB
                    • SHA256 ab3c43a4c42f820d5a1adc17a525e9709e6c9fd344b5caff47d08f23b8787128
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    webext.sc.lz4
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\startupCache\webext.sc.lz4
                    • Size 104KB
                    • SHA256 6d7b0cdf31aec00ac0e01e672abcf1fa5270fd54eb7d0fc0474e6f2bffef6259
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ._cache_2026-07-20_792f2e49b9763fc40d089f35d82f087f_dark-comet_darkgate_elex_gcleaner_glassworm_hijackloader.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\._cache_2026-07-20_792f2e49b9763fc40d089f35d82f087f_dark-comet_darkgate_elex_gcleaner_glassworm_hijackloader.exe
                    • Size 11.7MB
                    • SHA256 49f862f66a39600d1778fc29ef3a8c8f3c1854a4b3eaa17e5a9ae445ad50c3e3
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    5v8b9qzK.xlsm
                    • Path C:\Users\Admin\AppData\Local\Temp\5v8b9qzK.xlsm
                    • Size 17KB
                    • SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    IDM1.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp
                    • Size 162KB
                    • SHA256 645ee6e64ed04825b25964d992d0205963498bb9d61f5a52be7e76ddb2074003
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    IDMSetup2.log
                    • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDMSetup2.log
                    • Size 1KB
                    • SHA256 45005e575d3b8f1bd3853aaa1de6874c0d82434c9cb842fe27bc3ab3ac65522a
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    IDMSetup2.log
                    • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDMSetup2.log
                    • Size 4KB
                    • SHA256 4ff66e3c1e781d92abb757f537af13b1fb3fa167b86d330b7ed302728c7da53a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    tmpaddon
                    • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                    • Size 11KB
                    • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    tmpaddon
                    • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                    • Size 502KB
                    • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    s_1.dt
                    • Path C:\Users\Admin\AppData\Roaming\IDM\Scheduler\s_1.dt
                    • Size 316B
                    • SHA256 6d059e9c4670699aaa1b1594917d1be5fe752517d7c7e505f227e8dd181dcebb
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    defextmap.dat
                    • Path C:\Users\Admin\AppData\Roaming\IDM\defextmap.dat
                    • Size 3KB
                    • SHA256 9d1f79719b84eec484602b501d3d9eab89336c25b6d0cc586957bc2e10e845a1
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    urlexclist.dat
                    • Path C:\Users\Admin\AppData\Roaming\IDM\urlexclist.dat
                    • Size 3KB
                    • SHA256 9efd5d506f16932728de5c0fb7dc0e4b75713920bbcefb108a610c6c1ae45430
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    data.safe.tmp
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\db\data.safe.tmp
                    • Size 6KB
                    • SHA256 5c209813abfa7b244794c59c08806de9ac25fb4459f7912ded27d896425934f7
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    data.safe.tmp
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\db\data.safe.tmp
                    • Size 2KB
                    • SHA256 d87d77724a1e17d06447bfd809df18df3bf59f1b6e21c38d07f65b595642a069
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    data.safe.tmp
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\db\data.safe.tmp
                    • Size 7KB
                    • SHA256 1c417d31494f5a4c3252a66a4eb340993b65db76020a499de25f0dbe2119a89a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    events
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\events\events
                    • Size 1KB
                    • SHA256 38705e23648bbb196bb82cbee9a20d3a2d933df0f5f1075244d46cffa523e316
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    72523275-cfc1-4f87-be75-6ba27fc3c65f
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\pending_pings\72523275-cfc1-4f87-be75-6ba27fc3c65f
                    • Size 2KB
                    • SHA256 2ee356b8919617d42ee4cdffd341d3421d67783e3325a0db122440c30e153380
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    7eaa0829-1676-4bcf-b627-2788dea9597b
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\pending_pings\7eaa0829-1676-4bcf-b627-2788dea9597b
                    • Size 235B
                    • SHA256 b31c2e18e1937ef8b1fc6624885c1b478dd9413ecede493f3b13504f14e40af6
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    e0e0e12e-a2f0-4044-96b6-bb3b08144bde
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\pending_pings\e0e0e12e-a2f0-4044-96b6-bb3b08144bde
                    • Size 883B
                    • SHA256 970ecd4f96d6e65047aa98e2d99d2b463595bf856865bd83aabc02cc25d3857b
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    e7a01fc6-9591-4d5d-a130-fb1983b92165
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\pending_pings\e7a01fc6-9591-4d5d-a130-fb1983b92165
                    • Size 235B
                    • SHA256 7e5d18a4268f7053512cb531ed4da3a922cc582b16f4aff8d58f4c0df900313d
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    f5ec8256-4405-4a40-b167-fd1187737830
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\pending_pings\f5ec8256-4405-4a40-b167-fd1187737830
                    • Size 16KB
                    • SHA256 9b4fc2564298e8f382e1fa292943866dfacd248423ef6aa393cd76eb787fbe19
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    f750a576-4791-47d3-9bbf-ad8dfc828fdd
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\datareporting\glean\pending_pings\f750a576-4791-47d3-9bbf-ad8dfc828fdd
                    • Size 886B
                    • SHA256 cf4c84a5eab8b3eb72e72fd168cd16740622dc69fa77ff571347308872fb3cef
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    extensions.json
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\extensions.json
                    • Size 16KB
                    • SHA256 d45b003921d6411b31c95b683882a87a41e41e8eb15865a833deb430d1c7a4a8
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    gmpopenh264.dll
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                    • Size 1.1MB
                    • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    gmpopenh264.info
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                    • Size 116B
                    • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    manifest.json
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
                    • Size 1002B
                    • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    widevinecdm.dll
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
                    • Size 21.6MB
                    • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    prefs-1.js
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\prefs-1.js
                    • Size 8KB
                    • SHA256 6060c774ef2c0ac56cf87aa14463e63806fb5252cbf463f831d0cfdcd6f0d121
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    prefs-1.js
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\prefs-1.js
                    • Size 6KB
                    • SHA256 07b17b750c98b062412a85c75e6380171e4fe1c6ee63cbbfda0b318cd5836ae1
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    prefs.js
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\prefs.js
                    • Size 6KB
                    • SHA256 e53cda44335dd492d7cb2737c0b32089ce50684914cc1aa60e61294c509f7f59
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    recovery.baklz4
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\sessionstore-backups\recovery.baklz4
                    • Size 4KB
                    • SHA256 b02ad87531170584246087e92d11c0a8a6e41842557f526f12a66b912d15d245
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    idmwfp.inf_amd64_8b0ebbc2b4585464.ini
                    • Path C:\Windows\System32\DriverStore\FileRepository\idmwfp.inf_amd64_8b0ebbc2b4585464.ini
                    • Size 415B
                    • SHA256 3bc4abf62f75cdde035ef73ea09577f31ef2fdfb33dc3ba2e6f04cef4359c745
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    memory/52-125-0x00007FFB29300000-0x00007FFB29310000-memory.dmp
                    Download

                    memory/52-130-0x00007FFB265D0000-0x00007FFB265E0000-memory.dmp
                    Download

                    memory/52-123-0x00007FFB29300000-0x00007FFB29310000-memory.dmp
                    Download

                    memory/52-122-0x00007FFB29300000-0x00007FFB29310000-memory.dmp
                    Download

                    memory/52-128-0x00007FFB265D0000-0x00007FFB265E0000-memory.dmp
                    Download

                    memory/52-126-0x00007FFB29300000-0x00007FFB29310000-memory.dmp
                    Download

                    memory/52-124-0x00007FFB29300000-0x00007FFB29310000-memory.dmp
                    Download

                    memory/2420-129-0x0000000000400000-0x00000000004C2000-memory.dmp
                    Download

                    memory/2952-134-0x0000000000400000-0x00000000004C2000-memory.dmp
                    Download

                    memory/2952-1098-0x0000000000400000-0x00000000004C2000-memory.dmp
                    Download

                    memory/2952-575-0x0000000000400000-0x00000000004C2000-memory.dmp
                    Download

                    memory/3276-588-0x0000000000400000-0x000000000042B000-memory.dmp
                    Download

                    memory/3276-121-0x0000000000400000-0x000000000042B000-memory.dmp
                    Download

                    memory/4116-119-0x0000000000400000-0x000000000107A000-memory.dmp
                    Download

                    memory/4116-1-0x00000000004A0000-0x00000000004A1000-memory.dmp
                    Download

                    memory/4116-0-0x0000000002F10000-0x0000000002F11000-memory.dmp
                    Download

                    memory/5696-1033-0x0000000000400000-0x000000000042B000-memory.dmp
                    Download

                    memory/6512-1074-0x0000000000400000-0x000000000042B000-memory.dmp
                    Download