a0f687a92d02dddb50b3ade7c9273660088fbd46037be5b609dd57d85d905996

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/07/2026, 01:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Size 5.8MB
Sample260723-ccf7qafb49
SHA256 a0f687a92d02dddb50b3ade7c9273660088fbd46037be5b609dd57d85d905996
MD5 3699f8f804284d31c8e17fe84c4c9c60
SHA1 c518b0066d7a93c22bb18d0a7889133150609416
SHA512 fbe8699643436068d5897fa1fc9ecadf79d6d6fa588ba447fc1442fc99b707400d0992b26115cd9d5e2db4c5b379ea78035c5627e7114a75313ccff6f3db9f31
SSDEEP 98304:tYXCdr6aF5j5kbb3DX0P4Z9zqAM18frP3wbzWFimaI7dloI2a:7rX5ebbTXrZgbzWFimaI7dlT
TLSH
T11F569D52BF8C817AC95A11310B2DAF2A542AFC64773465D3B2743E7EEC753C12C3A61A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery persistence phishing spyware stealer

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe /onboot"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies Internet Explorer settings 1 TTPs 22 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\Low Rights	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Model = "203"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Therad = "1"	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	3724	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
Token: SeDebugPrivilege	4888	firefox.exe
Token: SeDebugPrivilege	4888	firefox.exe
Token: SeDebugPrivilege	4888	firefox.exe
Token: SeDebugPrivilege	4888	firefox.exe
Token: SeDebugPrivilege	4888	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
4888	firefox.exe
4888	firefox.exe
4888	firefox.exe
4888	firefox.exe
4888	firefox.exe
4888	firefox.exe
4888	firefox.exe
3724	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3724	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
3724	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
3724	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
3724	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
4888	firefox.exe
3724	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
3724	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
3724	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
3724	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
3724	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
3724	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
3724	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 3724 wrote to memory of 4552	3724	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe	85
PID 3724 wrote to memory of 4420	3724	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe	86
PID 4420 wrote to memory of 4888	4420	firefox.exe	87
PID 4420 wrote to memory of 4888	4420	firefox.exe	87
PID 4888 wrote to memory of 512	4888	firefox.exe	88
PID 4888 wrote to memory of 512	4888	firefox.exe	88
PID 4888 wrote to memory of 512	4888	firefox.exe	88
PID 4888 wrote to memory of 3416	4888	firefox.exe	89
PID 4888 wrote to memory of 3416	4888	firefox.exe	89
PID 4888 wrote to memory of 3416	4888	firefox.exe	89
PID 4888 wrote to memory of 3416	4888	firefox.exe	89
PID 4888 wrote to memory of 1812	4888	firefox.exe	90
PID 4888 wrote to memory of 1812	4888	firefox.exe	90
PID 4888 wrote to memory of 1812	4888	firefox.exe	90
PID 4888 wrote to memory of 1812	4888	firefox.exe	90
PID 4888 wrote to memory of 1816	4888	firefox.exe	91
PID 4888 wrote to memory of 1816	4888	firefox.exe	91
PID 4888 wrote to memory of 1816	4888	firefox.exe	91
PID 4888 wrote to memory of 3876	4888	firefox.exe	92
PID 4888 wrote to memory of 3876	4888	firefox.exe	92
PID 4888 wrote to memory of 3876	4888	firefox.exe	92
PID 4888 wrote to memory of 3876	4888	firefox.exe	92
PID 4888 wrote to memory of 3640	4888	firefox.exe	93
PID 4888 wrote to memory of 3640	4888	firefox.exe	93
PID 4888 wrote to memory of 3640	4888	firefox.exe	93
PID 4888 wrote to memory of 3640	4888	firefox.exe	93
PID 4888 wrote to memory of 4164	4888	firefox.exe	94
PID 4888 wrote to memory of 4164	4888	firefox.exe	94
PID 4888 wrote to memory of 4164	4888	firefox.exe	94
PID 4888 wrote to memory of 4164	4888	firefox.exe	94
PID 4888 wrote to memory of 4696	4888	firefox.exe	95
PID 4888 wrote to memory of 4696	4888	firefox.exe	95
PID 4888 wrote to memory of 4696	4888	firefox.exe	95
PID 4888 wrote to memory of 4696	4888	firefox.exe	95
PID 4888 wrote to memory of 1124	4888	firefox.exe	96
PID 4888 wrote to memory of 1124	4888	firefox.exe	96
PID 4888 wrote to memory of 1124	4888	firefox.exe	96
PID 4888 wrote to memory of 1124	4888	firefox.exe	96
PID 4888 wrote to memory of 2336	4888	firefox.exe	97
PID 4888 wrote to memory of 2336	4888	firefox.exe	97
PID 4888 wrote to memory of 2336	4888	firefox.exe	97
PID 4888 wrote to memory of 2336	4888	firefox.exe	97
PID 3724 wrote to memory of 3764	3724	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe	107
PID 3724 wrote to memory of 2368	3724	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe	108
PID 3724 wrote to memory of 3956	3724	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe	109
PID 3724 wrote to memory of 4464	3724	2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_3699f8f804284d31c8e17fe84c4c9c60_darkgate_elex_glassworm_remcos_stop.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3724
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4552
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
    3⤵
    - Drops desktop.ini file(s)
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4888
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1996 -prefsLen 27099 -prefMapHandle 2000 -prefMapSize 270279 -ipcHandle 2076 -initialChannelId {539db0d1-e930-493a-b8bc-40243c1368bc} -parentPid 4888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4888" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      PID:512
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2476 -prefsLen 27135 -prefMapHandle 2480 -prefMapSize 270279 -ipcHandle 2488 -initialChannelId {7f8431a3-5671-40b9-bc21-7a77d257f91d} -parentPid 4888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      PID:3416
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3776 -prefsLen 25164 -prefMapHandle 3780 -prefMapSize 270279 -jsInitHandle 3784 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3792 -initialChannelId {05baf613-e6e1-4b1a-8b5e-b21c4d2a1693} -parentPid 4888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Checks processor information in registry
      PID:1812
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3940 -prefsLen 27276 -prefMapHandle 3944 -prefMapSize 270279 -ipcHandle 4024 -initialChannelId {12bb7d8d-a46f-4b3c-9446-1e6946be7a49} -parentPid 4888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4888" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      PID:1816
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2784 -prefsLen 34775 -prefMapHandle 2788 -prefMapSize 270279 -jsInitHandle 3136 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4352 -initialChannelId {bf747dcd-d488-480a-9adf-440c559a2c0d} -parentPid 4888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Checks processor information in registry
      PID:3876
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4904 -prefsLen 35012 -prefMapHandle 4464 -prefMapSize 270279 -ipcHandle 4620 -initialChannelId {3b4bf740-1322-40a5-93d7-5543cdf718bd} -parentPid 4888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Checks processor information in registry
      PID:3640
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5136 -prefsLen 32952 -prefMapHandle 5140 -prefMapSize 270279 -jsInitHandle 5144 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5152 -initialChannelId {4911a69e-0840-4b5e-93d9-2507b9b18807} -parentPid 4888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:4164
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5176 -prefsLen 32952 -prefMapHandle 5180 -prefMapSize 270279 -jsInitHandle 5184 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5192 -initialChannelId {c46f011c-39d7-4f00-8fe1-950b684bab6f} -parentPid 4888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:4696
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5592 -prefsLen 32952 -prefMapHandle 5596 -prefMapSize 270279 -jsInitHandle 5600 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5184 -initialChannelId {98e8060b-5eb7-47fd-ac89-ad105c18ba74} -parentPid 4888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Checks processor information in registry
      PID:1124
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5520 -prefsLen 32952 -prefMapHandle 5516 -prefMapSize 270279 -jsInitHandle 5164 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5548 -initialChannelId {7b3afbd4-c986-4840-b0b9-6ca9595c8e03} -parentPid 4888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
      4⤵
      Checks processor information in registry
      PID:2336
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3764
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2368
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3956
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pltyyssw.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 15KB
SHA256 e2ad43ff96983b3cccb63b5dad8256b6547b8a151bf2ea3552eaa8cdbfc821ed
MD5 6b475967287a21112fc56bb7e8394fd4
SHA1 b95ad04117d09cc28638ed98d12b47ff01e4d483
SHA512 d7d1d0da9418afbc18b4ed1d9aa525b6b1a92f2168a0dde05c086bd1c4bf4403ca574fa4acec88dea6210a583ee5091946b2a442203cd0191d516a4663dc1cf0
SSDEEP 384:HwCe7iO024Y65dcs3hk2nhfdDE2Ba/rIVy8eIs+ss+6:QqZY65dv3hk2nhfS2sDIVy8i+P+6
TLSH
T150728DBBCF516C5D1927D985C9A94369DC09FDBBCBF690A608243449CBC4326B0FA08F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aba4ae37-e3a5-403b-a9f6-bd715a885d8c.zip

Path C:\Users\Admin\AppData\Local\Temp\aba4ae37-e3a5-403b-a9f6-bd715a885d8c.zip
Size 3.7MB
SHA256 9174664eae8a4dfc6b9a979d3806a8cfb2b1f190b4ff593cd6a9f0dac982de5a
MD5 b3292c00eec8e6afc680c31ed1b34098
SHA1 1101b4667096155117f4b2b49cd77a9435365a3e
SHA512 1499e1a4504683113095c4b61cb8724e10c535989f414a5dbe8fbd6dc0c4e4ce6da701d0008b293fda15dd223222758e968b881d86b04e199c17c6d974be4cbf
SSDEEP 49152:MMtss2HgPnuvfv67p+w0+w0vdChZlaeBDy6hEEy/W4JWwSlRHcS6/2W9a6OtiDI/:Xssh7rmgChHd7y/WSWwcckxoDIG76
TLSH
T1E706F135F25FD60BC9CF83BA850C2FC29C4C4FA680D4E56B6A6A95715CAF1E2DB44843
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\db\data.safe.tmp
Size 24KB
SHA256 c40e812c002dc08094387df6270f8a1b38274edfc7ef838cabe6bb72af757caf
MD5 59f82ae464ec047dbee9189fa8733aef
SHA1 f8cd5d38379922a734b5f61215c4580b9cec9388
SHA512 05beed0a5aaddff75c53bae1467231df028be67dee031aa1d0cbf79c9ab340fe5948b72b732522075b8786117c9c72d2e66132db6f6ea2302b66765d9e09a661
SSDEEP 384:3/66JozGzgC1jJUY3CkUZXwuhFbGcmhuUbFRaQ5ij0b9bnbWbS70boI:SELUmAhxGcmhueRaQ5ij0b9bnbWbK8B
TLSH
T10BB20E84EB1E953FD41812BADC954B002F78B88959192FA73B4C646C6C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 0853899ef63b811654112cc6ed288611cc445edf0ab20d4c48f8415d490f3e06
MD5 09c2a11c7289a3fbbb2061ef02d82c1d
SHA1 41da142dfbf15806084fba6c0c67dd78b2fe6d79
SHA512 87217a704e389613b32ecf1a0f1a9575829327c0f00d4bc38dd8ee6ac01a404095f8d23073b95280b49d786fb1f00e29fc1cf47472b23a2962c7a1195478868b
SSDEEP 384:+bo3ZVtyj86d66JozGzgC1jJUY3CkUZXwuhFbGcmhuUbFRaQ5ij0b9bnbWbS7:yAjELUmAhxGcmhueRaQ5ij0b9bnbWbK
TLSH
T1D2D2E044EB2E953FD41852BBDDA54B002F79B88958092FA73B4C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\db\data.safe.tmp
Size 35KB
SHA256 bd01357b2bc8beb4da5626383a3bc2c07a7e1e1cb22be226c209c560044560bb
MD5 b23df55d2c44816df2eff12b33549c55
SHA1 9cdc84d38592aa92226d1d4b1e951efa97995b0f
SHA512 169f4ffc8d27aac5f6f37f525ebfb69ce0575dbc35de26bfffbf6caea351822ee4163b25818b8e71b4656224952d18fb074fdf4b6bc25ca08779e8536682c5bf
SSDEEP 768:p+jE8YuVfac6uD0GcmhuOK9YWj525YbDbFbcbWbaHH:uYuVfavmPn
TLSH
T1D9F21044EB2E953FD42412BBDCA50B002F79F88959192FA73A5C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\db\data.safe.tmp
Size 35KB
SHA256 d43db9c84ddbc7a80a8e2e51b4929edc2c994434c8b004e3c524ed62a2bf1a87
MD5 cf4b8ee4eb24bca0d95ec26bc2c225fd
SHA1 3bf999f6558d7205234f0515839d9669d3dce9bd
SHA512 a49668d00b0868eee8f1025e8d89a345fb61704c00af323d64bccd37ab6351335e6a62fb9a4a8ab3005004db8a2347352e7e9073a15b2654ce123c1219c38e7b
SSDEEP 768:eE8YuVfac6uD0GcmhuOK9YWj525YbDbFbcbWbaHI+1:4YuVfavmP/
TLSH
T180F21044EB2E953FD42412BBDCA50B002F79F88959192FA73A5C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\db\data.safe.tmp
Size 35KB
SHA256 938b11d2a8b318f5f49aed26b8db217c89f8fca5b23aeb6f64ea456f243c7af5
MD5 f51dedfe1452306a37972fad80abf911
SHA1 5d71b4887d132a187aab18c7592e9383636aaf74
SHA512 0f1a1aa648b1c2f12ab47ed5ca02cb802e6b0b7db9fc94ad9660e3ed5c742e94d5faf783a92f06c2ae930b2770434c78dce5cec1982a082e8f0595b6ccbc45a9
SSDEEP 768:PYuVfac6uD0GcmhuOK9YWj525YbDbFbcbWbaHI+jE/:PYuVfavmPU
TLSH
T1A8F21044EB2E953FD42412BBDCA50B002F79F88959192FA73A5C64686C872DC3D9E07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\events\events
Size 1KB
SHA256 e4d6cf691453cf0a671ee8558a7195ff61804aaab0dc972469fc4f9ead67481c
MD5 08993b9cfd2dc3bc2c19af3e0126ac2d
SHA1 61cfd5200fa2d97028f47835f0d664db5ef5c72c
SHA512 362ba1eea5c94a7f34d315a9f0bb2cb3d074c5b1429cf2bfb9e4da401bf9a8384c57cf3eab7e5db2cea45439e5499d108a6801e613ddeadf04a1908a6b846442
TLSH
T17E213D5C39B94D6A59C7F39C7441118E53D64D07085B1C470D22FF8ECE92ED9326A5BC
MD5 SHA1 SHA512 TLSH

Submit Download

0ceed0a0-b7d2-42a7-9460-7f5df70490ae

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\0ceed0a0-b7d2-42a7-9460-7f5df70490ae
Size 235B
SHA256 88a0eeab034c62d516fab8d195354e035e224d7e0a6e7e84be5cd17eb6f72e9c
MD5 c51b302aaebf635ea5956e1efc4e9c68
SHA1 361414cbc6114a868733f3871b1e47f7290095fb
SHA512 b4edbd4fcb79fd290e788cad5dbcc9b377b558faac5393a110b572e092da899bc385c17c76c461c9cedc53d061817244e6125f42f03be6bc84a5454443fe6385
TLSH
T1B2D097C02498271C08200F0BB0A028E630888D3314746820DA6284B8CDB8AC4416281B
MD5 SHA1 SHA512 TLSH

Submit Download

199a6775-5528-460a-8a13-d86396efe178

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\199a6775-5528-460a-8a13-d86396efe178
Size 235B
SHA256 ac7f749fbc272d3e9831a2611c73255e50bf2421e96764bf37cef8b143be1b82
MD5 11ca29c604f8a07caf91efba695639c8
SHA1 1a4f995e4db6baaf478d34cfa26f59ff38cffcc3
SHA512 2f8b5e27947087bc1030110548e3959c1324ac6422dc650ac2c08b87df2226d86cf207dd31c320b3be8f2dc0c7a3e644138ebc696e9387ba403fdb8871597595
TLSH
T113D0978024E8675CA8000F07F0B069E770848C3760E8A810866041B88AFCECA4213C0F
MD5 SHA1 SHA512 TLSH

Submit Download

3decad53-34c9-4098-9b72-b6aa63adfdfe

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\3decad53-34c9-4098-9b72-b6aa63adfdfe
Size 2KB
SHA256 a58621ae2de1e3290dbc08b3cf22e0293f01d0d5fd37f888fb148cb759809a58
MD5 c40bdb2f0d2484bc2dd28aaf0789ae1c
SHA1 984af96d1817ba0b7caa29b7a188243e0da2cc6b
SHA512 1b8e93217cf4af5a9a39757655296bf25417a3039da834fd0a64889bbee99ad86b6c7ac37555bd207f8da454be0d3ea5f6aff65f9a729f89b87e2540485beb7c
TLSH
T14341135C76B85CB68DDAF69DD491234E5B608F0300C62C836E61DE0C8CD565A736E53B
MD5 SHA1 SHA512 TLSH

Submit Download

b84b97e6-85b8-4cad-8874-83de31e0838d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\b84b97e6-85b8-4cad-8874-83de31e0838d
Size 871B
SHA256 6c633a0c1c2732751e27390e7763844596fc68c2c454ad9949c088ef54ca303b
MD5 973e3225b12539c4ae56fc3c2d02b4bc
SHA1 94d53841016d470306619220c4ecbe4fc781ebe1
SHA512 f73c27e520d675643455590197fcce2965cddf80f974c847c4daedea485b1a35f1faf0798d924240e50263d4f0fb1297d0aae36bf7e0d764840a269cb9db070b
TLSH
T1F111E3558778B9B3CD68D34FCA613B425FE4A51384CE58143EA45D180D7B91A93AA20B
MD5 SHA1 SHA512 TLSH

Submit Download

dfa44c0c-f9a0-43a8-a104-1d5ff87c1161

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\dfa44c0c-f9a0-43a8-a104-1d5ff87c1161
Size 886B
SHA256 e8d8cf7e7729d218a476f1979553e9c0b07f220ab904689b45c8eaafbcf30fbe
MD5 5127836da7f4d8e1d45560c3ff887d7d
SHA1 a629d9715c18ddd57519e3096b991e05a64010f3
SHA512 5b54127f66efbd66131bd0a96de4fa3a9ff1bd2afc7b4f3d1b0c27880a6360c4c2deaf99a037a573d0201b50dd010ac2b216340dc3b2110e3b6eb5af4ae3a046
TLSH
T1721100548779B9B28868D24BD8E077425EE4A92380C999047F955A284DBA81F93EA30B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\extensions.json
Size 16KB
SHA256 9b0b81f87a7e4812dafdf2ecb02d828cdffcb2e17340503af734e4c4f8fbddef
MD5 cf10d714671262f5c63ad31ab30b6ca9
SHA1 5b61e0f3543f0dd9399829e1af456702fe947314
SHA512 5a43d074a6bb7a8bdf64c83c6a3f8ae73839d5f6015e85613272944fd2ccef8c527cfefcd6719c745c018afb05d6fd3b6dc85bc2a59f44a5c593beff10616fe6
SSDEEP 384:xzkI4vlUmldvc8dhWt94zT96osL4HdL4PHL4HxL4HEL4HVOtf4hq:mI4dRfFXQ4d614d4D4J4+41OB4A
TLSH
T17672421545049EB8298EA79BAA367E01C37D433B60845C38F4DD8FC842FB5B902FB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs-1.js
Size 12KB
SHA256 be2fa8f610c83524e574bd78e0d488ae63c984b937bac035967f88999aaee5f2
MD5 d63c4786a2c7713e755ef2597a306caa
SHA1 b7d4d5001bb6d6e303d7f13e9d827b65e618ee24
SHA512 4785bfca34853411a7f3f998913911680d874e3e971bf2d8fa6638bd3d07a8c3a3ba3b8152c2d9f96cb7618cae66fdff2a3841d007382d470801e6a471853391
SSDEEP 96:xHTf9TUOPqGqsWfIYDObzSeSSladv9j9nIpwoDRLK3B9OBw88ez3iO7Y72B8L4c5:Vf8RsWfIYDASS1LRWTOBw88euO7Y799
TLSH
T1D942ED3C51408F3F25B2367DAC2159B029A64237B6BFBCD305FCA892045DF6541EAAE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs-1.js
Size 7KB
SHA256 c8072b4d3fdcc36fab843f5ed50b1fcec37f7a59d821067b41e3c1095ca67330
MD5 c9dcede3f1c8d546a4211ee4c3322caa
SHA1 a7fbaad440de4db336a0abf3d85d9ec428f47438
SHA512 1bc97dde2b96ba5c93eb0f82040ed1bb9c48ad05e3911a893dca3abf3150f920f0523f0aa57ff808a09d1193af75b392cb5fa75473002d0e0610fe8f0124c0c6
SSDEEP 96:xH4f9TUOPqGqsWfIYDObzSeSSladv9j9nIWRLKtBw88R98L4cnTDEx:mf8RsWfIYDASS6RWtBw88mY
TLSH
T144F1FC789144CF6F74B6776CAC6489316AB2023B76BF68D610B99485010CF3442FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs-1.js
Size 6KB
SHA256 a9b87a8946707aec1940d849c03c6f4e7a0273f0bd0b1498086a7601fb0607f1
MD5 8ce465578e4888aa00f0629c1606b436
SHA1 252ff8e565950a7d093c6d506884ad249b5a0e3f
SHA512 a2989745f06a861d417b72e4605f3088473c6892821f20b043898a54b85b295b8daa045a9b386cdb4783e241f65d9463ace03e0c417b6c8355c436e8054e7387
SSDEEP 96:xH4fUTUOPqGqsWf2YD1zSeSSladv9j9nIHeABw88n8L4cnTDEx:mf5RsWf2YDrSSzeABw88qY
TLSH
T18FE12F789518CF6F74B677ACAC6888316AB2413B7BBF68D710B95485010CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs.js
Size 6KB
SHA256 7021473f0924596c996f022c02af7a091dd38df9a20b0ca8862ec3ce826d4ab7
MD5 02a73aee436ab53e4fb185dfea141a82
SHA1 ee34a772a49b0ccfcf520f0972eb56b1f9916c76
SHA512 08c5882931eaefbc764d7fe04b61bf2114b5b16f44c014a06606e05427c281f8a646c2905a42f9b7e3d66d44c6f5b3709f6c0b2b9557cbdb4014c8facdb492ef
SSDEEP 96:xH4fUTUOPqGqsWf24P1zSuSSladv9jwnIHeABw88n8L4cnTDEx:mf5RsWf24P3SSieABw88qY
TLSH
T117E1407895588F6F74B677ACAC6888316AB2413B7BBF68D710B954C4010CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 d9590e473989005700a1a569692c8244114928ea83ba424a8cb6e2a7b85f8be3
MD5 6ad88f75e64972662efc1241300dc4f3
SHA1 edb6df3ad2fda4d2907a7c93b26e468bbb4b4f1f
SHA512 86c4e12cddb56ff66bc31715ab446a3897f4f9e5679c98034351bbf673441e35355212809b4c2784f88c9b646b66556cbd7382259c0419a4773ea3ed4460882f
SSDEEP 96:eIfX+xDd6QeW9jILA0NjoB8kMJttn0YJZQBy:PX5IOnNcB85JttnTZEy
TLSH
T180916C42331F29A7FD5B858BEE4948F141B4300A588198EC90CF3E2AB76BE4B749D175
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 5e48a74a0fb0b16ac310ee8e87c84ec21185a62a2561cf173fc2392c6619d60f
MD5 549154c826736a3d778a729f26c7ee50
SHA1 b62bb4b2622557d57f2fc8e8880c9c214c3e8dde
SHA512 d2373077b4d39c1f94e28fd099db171db3ceca957d7df31a8163c5204a4152c0cf1749477d56b80d8d8a05fc1b7ab2bd236cbe4deb19208429d03eff29c85568
SSDEEP 96:eIfX+xDdsQeW9jILA0NjoB8kMJttn0YJZQBA:PXnIOnNcB85JttnTZEA
TLSH
T165916C42331F29A7FD5B858BEE494CF241B4300A598158EC90CF3E2A772BE4B7999075
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.5MB
SHA256 b2c18603a7fcfee16366f1fbbe439f5b3d1806a09234d918d58f4d820d20cceb
MD5 64cc035f8d36d0f74c3b32bc8f51d41d
SHA1 0f49826a2cbdbeb102e6cb6ce8012cf856dbb64b
SHA512 a151e153ba43d46d94f059cf2467e691de2f4561eb10510fdcce1434de77214a42c14e57d3165a4c5ce542e4ee12a77aa59de0a6a5717bacab3cd8dafeb4d432
SSDEEP 49152:VDmghuVi5lU525aJIyFeaKvgmRBbFOYDg/Mf:lmQuVi5652+jeaKvgm8/s
TLSH
T1BA2639E860D1A257F3814073A64553EB21FFD00C6037DE084BA956E9A4B8CDF9E16B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 10.8MB
SHA256 09b7740895457ff8e6351f4f3262bbf19d7a80112727c0b910c0fa5705876d7a
MD5 22d538ab9c17671c7b6e0cf9c4ff64b1
SHA1 53db59a5e6389a4382522dc41a839dffe5e76972
SHA512 1f8e0b08079c4f2a8acb049418a8e8ed3d67aab45ab8d67329f83a42c0a4b1603ba4f092c23aa15556e3a2440a4f82d8b1dcb0b874a006c33777a1b43de4c132
SSDEEP 49152:FL9LyjaeUT6QC5zYYLGaJ5nrEbTeWmV0g22ns9FdUTmYZmXAvoJiFxp4aHQlRrIk:gBZEAgJiFxp48q1w9Qt
TLSH
T11DB66C9170D0D692EB0145F6F35F03DB31BFC18C20A5C98017B8AAB968665DBEE5F368
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads