bdaejec | b28935f7f595b2b84997109368a57641b9a7766191986cf070758574736c3c5f

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 22:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Size 5.8MB
Sample260905-17lbxstdpa
SHA256 b28935f7f595b2b84997109368a57641b9a7766191986cf070758574736c3c5f
MD5 a95a0e4c2829b612bedc2ba39e230e9c
SHA1 d1b82721b1d0f265bd59121e88c7e862cab4057a
SHA512 79f9e37fc9630d44bc44d74c148b20304c476336c951e4922c5e9b6f963b208d4e7b72a90701d74a5fd6a86578bd83f7b61893a7894811e91e12362ae0d5872f
SSDEEP 98304:W3MjdiFDQKdn95BbP4KCcR8qLf3gbz2FSmaI7dlm:ZiDQKd9bzQbz2FSmaI7dl
TLSH
T172569E52BF4D817AC95A2131472DAF2A502EFCA4773451D3B2743E7EEC763C12839A1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware aspackv2 backdoor defense_evasion discovery execution bdaejec persistence spyware stealer trojan

Malware Config

Extracted

Family

bdaejec

ddos.dnsnb8.net

Signatures

Family: Bdaejec
Bdaejec is a backdoor written in C++.
backdoor bdaejec

Detects Bdaejec Backdoor. 2 IoCs

Bdaejec is backdoor written in C++.

resource	yara_rule
behavioral1/memory/4988-5-0x00000000001F0000-0x00000000001F9000-memory.dmp	family_bdaejec_backdoor
behavioral1/memory/4988-29-0x00000000001F0000-0x00000000001F9000-memory.dmp	family_bdaejec_backdoor

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 2 IoCs

resource	yara_rule
behavioral1/memory/4328-4-0x0000000000BB0000-0x0000000001191000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/4328-28-0x0000000000BB0000-0x0000000001191000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 2 IoCs

resource	yara_rule
behavioral1/memory/4328-4-0x0000000000BB0000-0x0000000001191000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral1/memory/4328-28-0x0000000000BB0000-0x0000000001191000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables packed with ASPack 3 IoCs

resource	yara_rule
behavioral1/files/0x000500000002345a-3.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/4988-5-0x00000000001F0000-0x00000000001F9000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/4988-29-0x00000000001F0000-0x00000000001F9000-memory.dmp	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x000500000002345a-3.dat	aspack_v212_v242

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	firefox.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	firefox.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	JFOhoo.exe

Executes dropped EXE 13 IoCs

pid	Process
4988	JFOhoo.exe
3456	firefox.exe
3700	firefox.exe
3996	firefox.exe
4380	firefox.exe
3180	firefox.exe
1864	firefox.exe
1944	firefox.exe
1292	firefox.exe
336	firefox.exe
3608	firefox.exe
3308	firefox.exe
2800	firefox.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IDMan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe /onboot"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	firefox.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	JFOhoo.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	JFOhoo.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	JFOhoo.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	JFOhoo.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	JFOhoo.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	JFOhoo.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe	JFOhoo.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	JFOhoo.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	JFOhoo.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe	JFOhoo.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	JFOhoo.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	JFOhoo.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	JFOhoo.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	JFOhoo.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	JFOhoo.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	JFOhoo.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	JFOhoo.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe	JFOhoo.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe	JFOhoo.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	JFOhoo.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	JFOhoo.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.exe	JFOhoo.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	JFOhoo.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	JFOhoo.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	JFOhoo.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3780	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JFOhoo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\Colors	firefox.exe

Modifies Internet Explorer settings 1 TTPs 22 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEExt.htm"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM\contexts = "243"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\Low Rights	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Download with IDM	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\AppID = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ROTFlags = "1"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMan.CIDMLinkTransmitter\CLSID\ = "{AC746233-E9D3-49CD-862F-068F7B7CCCA4}"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\RunAs = "Interactive User"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Therad = "1"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\ = "IDMan.CIDMLinkTransmitter"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\WOW6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}\Model = "247"	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4328	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
4328	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	4328	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
Token: SeDebugPrivilege	3700	firefox.exe
Token: SeDebugPrivilege	3700	firefox.exe
Token: SeDebugPrivilege	3700	firefox.exe
Token: SeDebugPrivilege	3700	firefox.exe
Token: SeDebugPrivilege	3700	firefox.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
3700	firefox.exe
3700	firefox.exe
3700	firefox.exe
3700	firefox.exe
3700	firefox.exe
3700	firefox.exe
3700	firefox.exe
4328	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4328	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4328	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
4328	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
4328	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
3700	firefox.exe
4328	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
4328	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
4328	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
4328	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
4328	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
4328	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
4328	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
4328	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 4328 wrote to memory of 4988	4328	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe	84
PID 4328 wrote to memory of 2636	4328	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe	85
PID 4328 wrote to memory of 3456	4328	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe	87
PID 3456 wrote to memory of 3700	3456	firefox.exe	88
PID 3456 wrote to memory of 3700	3456	firefox.exe	88
PID 3700 wrote to memory of 3996	3700	firefox.exe	89
PID 3700 wrote to memory of 3996	3700	firefox.exe	89
PID 3700 wrote to memory of 3996	3700	firefox.exe	89
PID 3700 wrote to memory of 4380	3700	firefox.exe	90
PID 3700 wrote to memory of 4380	3700	firefox.exe	90
PID 3700 wrote to memory of 4380	3700	firefox.exe	90
PID 3700 wrote to memory of 4380	3700	firefox.exe	90
PID 3700 wrote to memory of 3180	3700	firefox.exe	91
PID 3700 wrote to memory of 3180	3700	firefox.exe	91
PID 3700 wrote to memory of 3180	3700	firefox.exe	91
PID 3700 wrote to memory of 3180	3700	firefox.exe	91
PID 3700 wrote to memory of 1864	3700	firefox.exe	92
PID 3700 wrote to memory of 1864	3700	firefox.exe	92
PID 3700 wrote to memory of 1864	3700	firefox.exe	92
PID 3700 wrote to memory of 1944	3700	firefox.exe	93
PID 3700 wrote to memory of 1944	3700	firefox.exe	93
PID 3700 wrote to memory of 1944	3700	firefox.exe	93
PID 3700 wrote to memory of 1944	3700	firefox.exe	93
PID 3700 wrote to memory of 1292	3700	firefox.exe	94
PID 3700 wrote to memory of 1292	3700	firefox.exe	94
PID 3700 wrote to memory of 1292	3700	firefox.exe	94
PID 3700 wrote to memory of 1292	3700	firefox.exe	94
PID 3700 wrote to memory of 336	3700	firefox.exe	95
PID 3700 wrote to memory of 336	3700	firefox.exe	95
PID 3700 wrote to memory of 336	3700	firefox.exe	95
PID 3700 wrote to memory of 336	3700	firefox.exe	95
PID 3700 wrote to memory of 3608	3700	firefox.exe	96
PID 3700 wrote to memory of 3608	3700	firefox.exe	96
PID 3700 wrote to memory of 3608	3700	firefox.exe	96
PID 3700 wrote to memory of 3608	3700	firefox.exe	96
PID 3700 wrote to memory of 3308	3700	firefox.exe	97
PID 3700 wrote to memory of 3308	3700	firefox.exe	97
PID 3700 wrote to memory of 3308	3700	firefox.exe	97
PID 3700 wrote to memory of 3308	3700	firefox.exe	97
PID 3700 wrote to memory of 2800	3700	firefox.exe	98
PID 3700 wrote to memory of 2800	3700	firefox.exe	98
PID 3700 wrote to memory of 2800	3700	firefox.exe	98
PID 3700 wrote to memory of 2800	3700	firefox.exe	98
PID 4328 wrote to memory of 1332	4328	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe	101
PID 4328 wrote to memory of 4016	4328	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe	103
PID 4328 wrote to memory of 2608	4328	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe	104
PID 4328 wrote to memory of 2444	4328	2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe	105
PID 4988 wrote to memory of 3780	4988	JFOhoo.exe	113

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-03_a95a0e4c2829b612bedc2ba39e230e9c_darkgate_elex_glassworm_remcos_smoke-loader_stop_wapomi.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4328
- C:\Users\Admin\AppData\Local\Temp\JFOhoo.exe
  C:\Users\Admin\AppData\Local\Temp\JFOhoo.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4988
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\555800d7.bat" "
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3780
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2636
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3456
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Drops desktop.ini file(s)
    - Checks processor information in registry
    - Modifies Control Panel
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3700
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2020 -prefsLen 27099 -prefMapHandle 2024 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {4228a3e7-6d29-40ce-afae-368a9748a605} -parentPid 3700 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3700" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
      4⤵
      Executes dropped EXE
      PID:3996
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2500 -prefsLen 27135 -prefMapHandle 2504 -prefMapSize 270279 -ipcHandle 2512 -initialChannelId {9cec35b5-3db8-4cd3-9003-d632b73e48a8} -parentPid 3700 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3700" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
      4⤵
      Executes dropped EXE
      PID:4380
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3832 -prefsLen 25164 -prefMapHandle 3836 -prefMapSize 270279 -jsInitHandle 3840 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3848 -initialChannelId {5ba79ca1-1097-4eb1-bc3c-692befd1d19c} -parentPid 3700 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3700" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
      4⤵
      Executes dropped EXE
      Checks processor information in registry
      PID:3180
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4028 -prefsLen 27276 -prefMapHandle 4032 -prefMapSize 270279 -ipcHandle 3840 -initialChannelId {b46d166d-7353-425f-9837-0d817cbbf39e} -parentPid 3700 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3700" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
      4⤵
      Executes dropped EXE
      PID:1864
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4312 -prefsLen 34775 -prefMapHandle 4316 -prefMapSize 270279 -jsInitHandle 4320 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1684 -initialChannelId {f58a46aa-4997-4f60-bb33-ed448ed9a5e4} -parentPid 3700 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3700" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
      4⤵
      Executes dropped EXE
      Checks processor information in registry
      PID:1944
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4880 -prefsLen 35012 -prefMapHandle 4876 -prefMapSize 270279 -ipcHandle 4996 -initialChannelId {02087ea3-dc15-4140-86f0-98c10e0810ec} -parentPid 3700 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3700" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
      4⤵
      Executes dropped EXE
      Checks processor information in registry
      PID:1292
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5172 -prefsLen 32952 -prefMapHandle 5176 -prefMapSize 270279 -jsInitHandle 5180 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5188 -initialChannelId {7f89f671-135d-496f-8aa4-9c9bc4522f50} -parentPid 3700 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3700" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Checks processor information in registry
      PID:336
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5204 -prefsLen 32952 -prefMapHandle 5208 -prefMapSize 270279 -jsInitHandle 5212 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5220 -initialChannelId {8c61de69-36a4-4580-8630-f1f50394979f} -parentPid 3700 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3700" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Executes dropped EXE
      Checks processor information in registry
      PID:3608
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5572 -prefsLen 32952 -prefMapHandle 5576 -prefMapSize 270279 -jsInitHandle 5580 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5372 -initialChannelId {0ba6a552-94fc-4348-b8e9-0c07bc91d395} -parentPid 3700 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3700" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
      4⤵
      Executes dropped EXE
      Checks processor information in registry
      PID:3308
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3880 -prefsLen 32952 -prefMapHandle 3176 -prefMapSize 270279 -jsInitHandle 3912 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5848 -initialChannelId {d6c3d616-8861-44c1-8aa2-7ee944a49411} -parentPid 3700 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3700" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
      4⤵
      Executes dropped EXE
      Checks processor information in registry
      PID:2800
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1332
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4016
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2608
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

firefox.exe

Path C:\Program Files\Mozilla Firefox\firefox.exe
Size 667KB
SHA256 81a0316cd0efdad79c3f268a0e25a6e7133e9ad6ebf970fe0db36cd4e87ff849
MD5 af7223cf9bf7a64090d631c628eba868
SHA1 7a3f7927c2539bea7a877e1a966304302a093139
SHA512 f33a766daaaf593c22cd3dca277d4a62203280195496e2015ac1e5b7aaade0eb9af67b7f9596c206e04be2aea856b86f70d113ffb9aadeb15517e943daed410c
SSDEEP 12288:sOC854ZTW7EOggJXnJoU7s8oNXhaTWEJX36LW9zwHJem7OzwHJe0Ihf7Ez:sOvG1kQ8oNxaqIn4SwpemIwpelzEz
TLSH
T115E49E03F38516F8E48AD5B49A42D233E5723C840B51A1DB1BE93F2A3E71AD15B7876C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

k2[1].rar

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZVQID18K\k2[1].rar
Size 1B
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

Submit Download

5E43012191E7B1F510ACD5BF039D8BF1B9A277B2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pltyyssw.default-release\cache2\entries\5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
Size 16KB
SHA256 3592312e77a777712da4c82b823934e2233fa74060da75ec9840e59780279e8b
MD5 455b19d62aead9b935c7e1cea22deaba
SHA1 5e1a45e5c1faaa45be7e2044ba51acbafdbd1890
SHA512 6300cc780c94ca7796d6e4f67d3e48499469cfdac72f452040e9933db23cfe4e04cb203bc69c0ce4c527b62db942b39051eb4569f637893553484c03613aab31
SSDEEP 384:HkCjiO024YfDL84KKDL849B7SOEAd9KVRaAcP+AWRMAq:EzZYfDL8lKDL8CB7S/AmVAf+hRMn
TLSH
T144728E7D5F003CBC1597C0E8C4F9929A8D18B7A7CFE6806D21583D0DCA98AA9B0F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2FD73803.exe

Path C:\Users\Admin\AppData\Local\Temp\2FD73803.exe
Size 1B
SHA256 08f271887ce94707da822d5263bae19d5519cb3614e0daedc4c7ce5dab7473f1
MD5 69691c7bdcc3ce6d5d8a1361f22d04ac
SHA1 c63ae6dd4fc9f9dda66970e827d13f7c73fe841c
SHA512 253405e03b91441a6dd354a9b72e040068b1bfe10e83eb1a64a086c05525d8ccae2bf09130c624af50d55c3522a4fbb7c18cfc8dd843e5f4801d9ad2b5164b12
MD5 SHA1 SHA512

Submit Download

555800d7.bat

Path C:\Users\Admin\AppData\Local\Temp\555800d7.bat
Size 187B
SHA256 23bca32ac9f964d6a3f9419f1b81dadc84104d9b99dd657153122d48d37f646f
MD5 dcc3c601ef646b82c6332909096c3e33
SHA1 73f94e1614bc6fca46425eb786769f6b4760508e
SHA512 6a4d33c0f352be40aede6fb4e2b0146b0c8534fd1c5f770923fa921c53896afbf6e152eb33a912966faee62ebf9823dab7679df8c36af9e08b48b4b7ee4090a9
TLSH
T121C012028197CA991454613F06F5724CC06558583B5D2B115B20C46E61A680EB7C3341
MD5 SHA1 SHA512 TLSH

Submit Download

JFOhoo.exe

Path C:\Users\Admin\AppData\Local\Temp\JFOhoo.exe
Size 15KB
SHA256 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
MD5 56b2c3810dba2e939a8bb9fa36d3cf96
SHA1 99ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA512 27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
SSDEEP 384:7XZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:1QGPL4vzZq2o9W7GsxBbPr
TLSH
T10B62BFB34EC098FFC4CD353340823687CB7B4670DABA617F826288372895E19AC55595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 5e6850ec5b0ce17a3f478b3812404b6bb3cb3e6e7f784b96541be3e707e99774
MD5 e7226f18c5a56c17db80b3b17b50e5b1
SHA1 8ae417d72c4f16c4b6246081fde3f2236af8beb0
SHA512 001992302ad440e7eb04a6629e778d9a4b3353eb4784aaf464ead25ded8d293d29aa5d7a3f885c5567ff9ca18251b3f23a2d2e96538d124db937d2ab4bb5da2b
SSDEEP 96:1PSdF95/7bkW60rcEVtyUR6Lx2WZvF32FTFtFNP/dd66JozGzgClKtmc0d/UK:ZOv5zbowbVtyjlxM1d66JozGzgCl6mcM
TLSH
T158C1EC68E738863BC444423BCCA61F401F357996988E7F2932DC640D2D576DE768D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 e6564fc5ffa38f85c26e0f1cae57b7a2f90c45724583bc27fee9753439e74f27
MD5 144d105cbbf50423fcdebe08ad605760
SHA1 d0afc41b807ce464ae9795ec01b1519b666ac3ee
SHA512 35f8c0b1e084896f8be84ab986fb5e32aca918fa5dad905a1b8caff939e4e71ef86e57b675f18c411f133c2c027df306debe0e66ccea396e8fee0adb13d7caa0
SSDEEP 192:hOv5zboPiZVtyjicX1d66JozGzgCl6mc0dz:+boaZVtyj9d66JozGzgC1jd
TLSH
T117E1EC68E728863BC404437BCDA21F400F39399AD84E7F29369D641C2D576EE768E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 007211db6422bcd01fa9c951d4bde3bc233335f2cda831f0ba8f2cc5b9a0a601
MD5 403cf8ca56b277ee041147deb20beef7
SHA1 b79345e1b795bdd5de9d2b266fffd5b23172b6d5
SHA512 1f9a4c990cbfdaff4f8f5e6d809a8620d911b34d35d68b86c683567f64bafb5baa9651ec1cbff04e3188466b22acfdf4a9b6b683a80ceb225803457a1675e50c
SSDEEP 192:KOv5zboPaVtyjicX1d66JozGzgCl6mc0dz:pboCVtyj9d66JozGzgC1jd
TLSH
T1DEE1FD68E728863BC404037BCDA21F404F39399AD84E7F1936AD641C2D576EE768E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\db\data.safe.tmp
Size 3KB
SHA256 16f49776f417a0e816d89d8e1e1d4c623db99d7605fecfeb9aff8f46e4064ca2
MD5 707c35d1b5fd93676e7ee33f9271b332
SHA1 d0e3c7b81e28542152204d1b11f56d9e7f465f3e
SHA512 10d60cf3d5dc296791344aeff24755181bc40151c7ccdf5c5cd33df055e4c88a03cb1fe8bf18bfa53bc9c85d9033828dc0449e537ec30097bb25da4254cce141
TLSH
T12561B859F6298A3FE048413ADC926B401F347856E86F7F2A35ADA04D1E4B2DD36CD43E
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\events\events
Size 1KB
SHA256 277e9dd1ea80410a8467b72ebe852961de1dcb100f96d13feb342acdb28c3643
MD5 2f1a1215c5f7dc5ee6c7933470843592
SHA1 b11ef51ed38b3bfa5f56b0af181430a065974330
SHA512 6e5f4ac20d5c06cbc272e65a01af42aebcd5361c7714e183b03af0402ba8478399cf080ef85752038068b13c68f590bc99e5d1e3d7c39c2b3353e70b24eeead1
TLSH
T17A11579C39B84EAAAD86E29C748002CE53554E0719875D434D53FE8CCEC0ADB326A439
MD5 SHA1 SHA512 TLSH

Submit Download

7ac33b8f-4f4b-4a96-a81c-bce058a4d0d6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\7ac33b8f-4f4b-4a96-a81c-bce058a4d0d6
Size 886B
SHA256 59f5f216b6dc2a3970be5005d910104c8dfe60206c6747865413651bf5420709
MD5 3d7a8c42ee1506017da0807150f8d300
SHA1 01413b7dce307489649f6e1ee9516a45b0388ead
SHA512 4e18b7cd1ff2ed06ddc208b62ea7d9a544fafe19fc562fb5aca361a4b5b2a1682025515d20deff9a78aadfe2c90ae0e9d9042fd2ef04620e22dc6e4e265cc332
TLSH
T18C1167914774B972CC24C35B88A177024FE47523C0C555143F9A9A1C0D7682E93A7207
MD5 SHA1 SHA512 TLSH

Submit Download

a6d60467-2b12-410b-87f5-43d2d6dc2d3a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\a6d60467-2b12-410b-87f5-43d2d6dc2d3a
Size 235B
SHA256 e760910f7f12bec4d8e42c9ae182c775c1d9f4689b0912ffeb51caa5e1304642
MD5 245e5c04c9e887edce43d1e2a8cd1260
SHA1 f1a38f40ebebace0d5f08af21577096878aabd06
SHA512 ea4be362a246147f0b43ecbcaab990207d246741135c2aac469a5b134ac0457a55068db54c66a9eec8dc2fcf4f5099456d33707ec0434bb4d4d38f8b7476567a
TLSH
T13BD0979024D8A36D68200F12B2E0A8CA30888C331478A820D6B28178DDBCECE416281A
MD5 SHA1 SHA512 TLSH

Submit Download

afb7d4ad-9f3c-4b28-b1dd-637ab51b7c1f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\afb7d4ad-9f3c-4b28-b1dd-637ab51b7c1f
Size 15KB
SHA256 7726f5dfa212b870fd1084d83f39712018ecdcc16adebc59fb24290864e0685b
MD5 026daace58143ed95d98590c9cff122d
SHA1 aa0c3739bc7772072c8867912ed6d34f750903b8
SHA512 240e01a83d419ae994799547b06b065dc267bd9ff00f12b6a27d2960f2337bcd710109388f2891a82ce67798654e882b8a6f666521ddc536c4ee4e42eecb6bc5
SSDEEP 192:S4lu0CaGyo2BNM213LjUA4U5UF8Wrql+AyUYLiwFgDMsVX/d1YtcPczhRcS0KUkN:SffP2ISj2UOcwtc0FRcS0KUEQCx
TLSH
T10A72D9166860467AC251E3A894F87FC3E6F628CF4C019FCD9BE4BE085DDE06E112794B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c5acd528-a0e3-4246-b876-afaba6a3e23b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\c5acd528-a0e3-4246-b876-afaba6a3e23b
Size 235B
SHA256 813fc6bbd874483b693975ff230442820a0a6e52062c92a058076b2dc220ae09
MD5 8e83b119b6a96bee8f28c23a934c6905
SHA1 1203bb9d74b4adbf3a89455152d4402ea7340067
SHA512 edff10920b76f8310284668c23ee759e4c039f3bd78fdc30111e4e81d308a1ca0fa803e16662b4c55f2ed6fc6e65acd697c4572336e55b6d2e4b524652635bc1
TLSH
T10FD09785B898277C4A080F87F0A228C630484C3720A56810CE608678DAFA9C4029290B
MD5 SHA1 SHA512 TLSH

Submit Download

e4396ac9-9634-4116-bb00-3f77bac39e70

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\e4396ac9-9634-4116-bb00-3f77bac39e70
Size 2KB
SHA256 c5e327c3e30a563faf18474adf1aa391a95ee0a91d2fe6bdbdf48cc134093c4e
MD5 6befad09816e94e6dd5cc53d14ea8c1b
SHA1 fac61ef6cb495b1c7e46a6599e2a85a0e93bfcc8
SHA512 0652a56f0379af7603600bc706eb068e7cb6229e02ccb879b6a23959be8dfe9e53bf3719049f4069ee0498674969823745a79352fb41fd38b7e433b17468cf3a
TLSH
T1E141541C75B85C7788EAE28ED482234D57648E0300C22CC32E55DE4CCCDAAAA237A53A
MD5 SHA1 SHA512 TLSH

Submit Download

f45cf913-a8e2-4b74-aaf0-4618e3b16a6e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\datareporting\glean\pending_pings\f45cf913-a8e2-4b74-aaf0-4618e3b16a6e
Size 883B
SHA256 146e4a5dab6e4fb0c7a8e6270ce65c359a76483b3c63218c6b86db4a6b128bca
MD5 3047cb9dca523e811b3c8e771c4669ae
SHA1 047a164695d698effc5cfd3aba9106c8e2030ce8
SHA512 8637b267672812d239b2849d2386e0d1de368559f9d04ab1f4c809d71b97a8c2695f4dbd5d4aece5e4230bf915896ffb0208e9495190fd5c5297a2ae5ce2ff70
TLSH
T17011E3519778BAF3CC78C24BC9617B425FE47A63C0C694143FA55A080C7B92E97AB70B
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\extensions.json
Size 16KB
SHA256 3aebc6116c84899bf31ca6dc2a5bdd884b230ad2e86b8a4e58574e46a87cd59e
MD5 802ad119afabacf5f6ea232ebeb7fc61
SHA1 4afade30863be4abbc95ccf24538f6bbfec75fbe
SHA512 a77e1f43a1adccc527966c3dd165b904a5ce57dcae035431bb5a03a180c88b41d2e6c6d3cfc0b65325726da1245d2f80539f1f95a389bd6486481758097185cc
SSDEEP 384:xzkI4vlUmldvc8dhWt94zT96osL4HdL4PHL4HxL4HEL4HQe4hx:mI4dRfFXQ4d614d4D4J4+4n4v
TLSH
T1E672421545049EB8298E979BAA367E01C37D433B60845C78F4DD8FC842FB5B902FB66B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs-1.js
Size 6KB
SHA256 b509238c4b6f8ef2c26cf239622aee7ee879bbe94912f3a59b0e192005707d9a
MD5 259304616a72932fbadb0d4f05db12f2
SHA1 4f394fa5fe2bf28210e4254be7dad60a472546fb
SHA512 593f19d44ac1d32ae2ac5a28b723a070d21e0d18c284c73cb25a659e66ffeb4ba1b82e281dc20ebc7d239a68ef063c46a91d91f1aab681d0edafeeafcdb9b599
SSDEEP 96:xH4fUTUOPqGqsWf2mt1zS4SSladv9jknIHeABw88n8L4cnTDEx:mf5RsWf2mt5SSeeABw88qY
TLSH
T1FBE1307895188F6F74B677ACAC6888316AB2413B7BBF68D710B954C4010CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs-1.js
Size 8KB
SHA256 fbe2cf9181e929d81e2d3e3497b6236d2e53770d5fc6ee006f9550508a7e6776
MD5 6a8bbbc4d4754437efdfd886428c8101
SHA1 f18bbc31d20f26599668c8b9dae186b4a6b807df
SHA512 6d6acbddc5bebd9d64c45fa6426d85e4d837b1e8d7fbb19ec8718937bb2c3b7333b9f986d8ecee0023e76c29aca105985f750444d16eccb5d4251d1febaeb6e8
SSDEEP 96:xH4fpHYTNtGTUOPqGqsWfS8mtObzS4SSladv9jknIWRiGqKrBw88RDQh8L4cnTD7:mfpHYTNt/RsWfS8mtiSSrR/rBw88JQ8v
TLSH
T1F502107C6104CB6F75B6776CAC248C715AB2023B7BBFA8D610B95485014CF3542F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs.js
Size 6KB
SHA256 806c13ed26f77c6a1e047fb0a46347fe9f866f6728955056897436c2bed682d8
MD5 4fb2d2eab9b023ee2beef346008c24e4
SHA1 cbbb6d9a083e0c9908e70f70ec32364febebb446
SHA512 c34108b8f79a9611edada79559a9d72dc3421c099710c0778cc0eddebd65531713f3bac6c4f1a6acd9bf413c94c433129c1f225a58644a174fc617af751ed951
SSDEEP 96:xH4fUTUOPqGqsWf24P1zS/eOSSladv9j5nIHeABw88n8L4cnTDEx:mf5RsWf24P0SSreABw88qY
TLSH
T113E1207895188F6F74B677ACAC6888316AB2413B7BBF68D710B954C4011CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\prefs.js
Size 7KB
SHA256 207726a326efd3d593d54d82b20d63ad8cd246488b63a0f83146e03bc2e2dee6
MD5 bc8b4d1eb6e519085d86e7c604fcaa26
SHA1 1ff02be6a9a652607df63ed446106079878eb007
SHA512 28329310689bb129340bad8cb9e8a73a903ba1ad191b2aa0ebcc0ed82e486311c0454146cd15659ef95bab63a0aad9df2fd0774c1101e9a6f3ab83fdc029739e
SSDEEP 96:xH4fpHYTNtGTUOPqGqsWf2mtObzS4SSladv9jknIHeABw88i8L4cnTDEx:mfpHYTNt/RsWf2mtiSSeeABw88VY
TLSH
T10EF11F7CA504CB7F74B677ACAC2488716AB2013B7BBFA8D610B95484015CF3542F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\sessionstore-backups\recovery.baklz4
Size 4KB
SHA256 fb0aabe056c4115dbe4226ceacad994680b09b1e6fc3a5e1a954828a678cc0e0
MD5 c6e98ca286a4d3072387c15334ccb05d
SHA1 7072b998c54f5abec73e610bad7ede11b9b89cec
SHA512 97a8bfda81e0a5e4ca040ed3a3955a5ba67cc30cf1510de26e7b3881fdd75c32b7ef48768d9130ddf915673714546e6425ba303e2c4f3359858b3fe154dfabe2
SSDEEP 96:e/fX+xwjwQeW9jILA0NjoB8kMJttn0YJZQBAO:OX6IOnNcB85JttnTZEAO
TLSH
T168916C42375B29A7FD6B858FEE498CF145A4300E598084E890CF3A2AB377B0B7959075
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 151cb3664f59dfb9e763c23fec455edf0ee087044a8092521c74f1db6cd22ea2
MD5 c47f78b4a1d8f164d3171570e6fcd742
SHA1 f81d82c63ccea164c88c2639ca8654b563e492a8
SHA512 bd7b242baf39ae42b71810f4dc83f403ffb246f52f0b223ba4fd8bca3e643672d2402ce9971815665637aa4ac6f5f6a618f3f5cba25fbae1f8a3aa3fc38d1d24
SSDEEP 96:e/fX+xwjHQeW9jILA0NjoB8kMJttn0YJZQBLY:OXhIOnNcB85JttnTZEM
TLSH
T148917D46375B39A7FD6B858FEE498CF145A4300E648084EC90CF3A2AB377B0B7959075
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 4.5MB
SHA256 8c92deefcedac7c11a5e448ca749c92711c2b52f4a7b4229920fbd4be6321711
MD5 3b016197105b0364b4525fbbd827d0fa
SHA1 4b3b4c20519b7cd9021c70da442f449bddda60dc
SHA512 83c2fa9285a9c7a61970939219117cbe87d22af9fe5224f22c35f1895c2c6b7ef811240cf1fba836d48f32196020be4baf2d556d8b86836a659482415ad77b4b
SSDEEP 49152:VDmghuVjA5lU525XIcNeaKvgmRBbFOYDg/If:lmQuV85652JVeaKvgm8/w
TLSH
T18B2629F820D1A257F3814073A64553EB21EFD00C6037DE484BA956E9A4B8CDF9E16B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pltyyssw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 5.5MB
SHA256 b879f3b0187d1ff07e218357c48e3df73834270e372b1ca21a26fa98be358df3
MD5 31f573d24b8367129351251d8a529473
SHA1 50348a0802295b5ea51752cbf4cb913018602181
SHA512 7f420e4cd4925a3fd27b08b944668a09be0559488e0a498b6cec0e2fbe21dbafe4fd57602e2c08577e63c234ab12d6142791423935f4752c5395ba630c9b13db
SSDEEP 24576:8gXj0I/sOsB7QJ+IXL8NyjnTd1RAdFazMoGFFeLHVFY+gP6Sds+RbXK4e8OALEQ:8gX7/sRB7CRLrjnm8RVFYVS+lfJF
TLSH
T11A4629F860D1A253F3824073B64553EB21FFD00D5037DA4847A85AE9A578CEB8E17B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4328-28-0x0000000000BB0000-0x0000000001191000-memory.dmp

Download

memory/4328-4-0x0000000000BB0000-0x0000000001191000-memory.dmp

Download

memory/4988-29-0x00000000001F0000-0x00000000001F9000-memory.dmp

Download

memory/4988-5-0x00000000001F0000-0x00000000001F9000-memory.dmp

Download