Overview

overview

10

Static

static

10

2026-07-18...op.exe

windows10-2004-x64

10

2026-07-18...op.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    18/07/2026, 19:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-18_b26e799e6966f4f0cd96485f65bf251f_darkgate_elex_floxif_glassworm_remcos_stop.exe
  • Size 5.8MB
  • Sample260718-x3vs1say5m
  • SHA256 895785688b5c80113a773f81e8de5ad352bcde9ce822028c93bf3c53c8f0d2e9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarebackdoordefense_evasiondiscoveryfloxifpersistencephishingspywarestealertrojanupx

Malware Config

Signatures

  • Family: Floxif, Floodfix

    Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

    backdoortrojanfloxif
  • Detects Floxif payload 1 IoCs
    backdoor
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 3 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 3 IoCs
  • UPX dump on OEP (original entry point) 8 IoCs
  • A potential corporate email address has been identified in the URL: [email protected]
    phishing
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Drops desktop.ini file(s) 3 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 5 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 21 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 22 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 18 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-18_b26e799e6966f4f0cd96485f65bf251f_darkgate_elex_floxif_glassworm_remcos_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-18_b26e799e6966f4f0cd96485f65bf251f_darkgate_elex_floxif_glassworm_remcos_stop.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Enumerates connected drives
    • Installs/modifies Browser Helper Object
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3008
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4820
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1540
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
        3⤵
        • Drops desktop.ini file(s)
        • Checks processor information in registry
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4656
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1952 -prefsLen 27097 -prefMapHandle 1956 -prefMapSize 270279 -ipcHandle 2040 -initialChannelId {35e314bb-b100-4b97-8d37-c7166be2ba1b} -parentPid 4656 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4656" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
          4⤵
            PID:4116
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2440 -prefsLen 27133 -prefMapHandle 2444 -prefMapSize 270279 -ipcHandle 2452 -initialChannelId {4c57124f-1b05-4794-82b9-41702ee29b4f} -parentPid 4656 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4656" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
            4⤵
              PID:2024
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3868 -prefsLen 25164 -prefMapHandle 3872 -prefMapSize 270279 -jsInitHandle 3876 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3884 -initialChannelId {9509791e-93e9-4787-82fc-8290ba394324} -parentPid 4656 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4656" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
              4⤵
              • Checks processor information in registry
              PID:3968
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4028 -prefsLen 27274 -prefMapHandle 4032 -prefMapSize 270279 -ipcHandle 4040 -initialChannelId {4ad4c224-a81b-413d-8da0-c079ce087f66} -parentPid 4656 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4656" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
              4⤵
                PID:1356
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3220 -prefsLen 34773 -prefMapHandle 3252 -prefMapSize 270279 -jsInitHandle 3248 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3260 -initialChannelId {e54b5ed5-1431-491e-8edf-836d1a705e20} -parentPid 4656 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4656" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                4⤵
                • Checks processor information in registry
                PID:3448
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5112 -prefsLen 34903 -prefMapHandle 5116 -prefMapSize 270279 -ipcHandle 3144 -initialChannelId {f76706b7-6dfd-42c7-97b5-1a3ce2da2423} -parentPid 4656 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4656" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
                4⤵
                • Checks processor information in registry
                PID:6028
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5284 -prefsLen 32793 -prefMapHandle 5288 -prefMapSize 270279 -jsInitHandle 5292 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5304 -initialChannelId {514b1b7f-8f79-40bc-9b76-4c4ebf42ec68} -parentPid 4656 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4656" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
                4⤵
                • Checks processor information in registry
                PID:5336
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5364 -prefsLen 32845 -prefMapHandle 5352 -prefMapSize 270279 -jsInitHandle 5452 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5528 -initialChannelId {7090ccc2-7cc4-4f98-8112-a566760af846} -parentPid 4656 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4656" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                4⤵
                • Checks processor information in registry
                PID:1612
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5720 -prefsLen 32845 -prefMapHandle 5724 -prefMapSize 270279 -jsInitHandle 5728 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5736 -initialChannelId {c1c4f2bb-1727-4d9f-8983-4b54cf1d4e36} -parentPid 4656 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4656" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                4⤵
                • Checks processor information in registry
                PID:2640
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2840 -prefsLen 32845 -prefMapHandle 3408 -prefMapSize 270279 -jsInitHandle 3224 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5968 -initialChannelId {3d9209e1-2b53-4570-8345-9df3a96f6109} -parentPid 4656 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4656" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
                4⤵
                • Checks processor information in registry
                PID:3384
          • C:\Windows\SysWOW64\regsvr32.exe
            "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
            2⤵
            • System Location Discovery: System Language Discovery
            PID:1872
          • C:\Windows\SysWOW64\regsvr32.exe
            "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"
            2⤵
            • System Location Discovery: System Language Discovery
            PID:5572
          • C:\Windows\SysWOW64\regsvr32.exe
            "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"
            2⤵
            • System Location Discovery: System Language Discovery
            PID:3712
          • C:\Windows\SysWOW64\regsvr32.exe
            "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"
            2⤵
            • System Location Discovery: System Language Discovery
            PID:3372
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.internetdownloadmanager.com/welcome.html?v=642b58
            2⤵
            • Drops file in Windows directory
            • Enumerates system info in registry
            • Modifies data under HKEY_USERS
            • Modifies registry class
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:4908
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffab1ddc188,0x7ffab1ddc194,0x7ffab1ddc1a0
              3⤵
                PID:4784
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,11165527345765981205,17111595051473238382,524288 --field-trial-handle=2056,i,1086807893823280097,7331367388408528325,262144 --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:11
                3⤵
                • System Time Discovery
                PID:1280
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1548,i,10277477635063170072,7267372430774908516,262144 --field-trial-handle=2056,i,1086807893823280097,7331367388408528325,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:2
                3⤵
                  PID:1076
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,16418964071359319636,9921262875284180228,524288 --field-trial-handle=2056,i,1086807893823280097,7331367388408528325,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:13
                  3⤵
                    PID:5280
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,17655603889498965241,12768607511248097183,2097152 --field-trial-handle=2056,i,1086807893823280097,7331367388408528325,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
                    3⤵
                      PID:4476
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,4658059507246890823,2486732560850297069,2097152 --field-trial-handle=2056,i,1086807893823280097,7331367388408528325,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
                      3⤵
                        PID:596
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,8712316921570917650,16973298686238335513,2097152 --field-trial-handle=2056,i,1086807893823280097,7331367388408528325,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:9
                        3⤵
                          PID:564
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,13797046619770006309,11187690761372398919,2097152 --field-trial-handle=2056,i,1086807893823280097,7331367388408528325,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:1
                          3⤵
                            PID:5288
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3764,i,11741880284628577727,8894269682307738278,524288 --field-trial-handle=2056,i,1086807893823280097,7331367388408528325,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:14
                            3⤵
                              PID:6236
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,640458010417019341,8618759338588582252,524288 --field-trial-handle=2056,i,1086807893823280097,7331367388408528325,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:14
                              3⤵
                                PID:7068
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3644,i,12905787060120383965,857658964079122902,524288 --field-trial-handle=2056,i,1086807893823280097,7331367388408528325,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
                                3⤵
                                  PID:7076
                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,10429777484393484844,14957842587246617023,524288 --field-trial-handle=2056,i,1086807893823280097,7331367388408528325,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
                                  3⤵
                                    PID:2896
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,10429777484393484844,14957842587246617023,524288 --field-trial-handle=2056,i,1086807893823280097,7331367388408528325,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
                                    3⤵
                                      PID:6116
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,10104004858180030033,15948008821145661259,524288 --field-trial-handle=2056,i,1086807893823280097,7331367388408528325,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
                                      3⤵
                                        PID:6496
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,9954972685708172315,15724689278112506191,524288 --field-trial-handle=2056,i,1086807893823280097,7331367388408528325,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:14
                                        3⤵
                                          PID:2896
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,1027858289300751500,17307966354982714618,524288 --field-trial-handle=2056,i,1086807893823280097,7331367388408528325,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
                                          3⤵
                                            PID:6160
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,6506058028954408800,11896738379981543341,524288 --field-trial-handle=2056,i,1086807893823280097,7331367388408528325,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
                                            3⤵
                                              PID:6196
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,2958670562267375988,12910820886015922555,524288 --field-trial-handle=2056,i,1086807893823280097,7331367388408528325,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:14
                                              3⤵
                                                PID:1436
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4264,i,3799374330039920917,7720464978518410121,524288 --field-trial-handle=2056,i,1086807893823280097,7331367388408528325,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:14
                                                3⤵
                                                  PID:4984
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3776,i,16055930889064924994,17587775936245255110,524288 --field-trial-handle=2056,i,1086807893823280097,7331367388408528325,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:14
                                                  3⤵
                                                    PID:6196
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6604,i,4417918059819503512,6001297150479598841,524288 --field-trial-handle=2056,i,1086807893823280097,7331367388408528325,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:14
                                                    3⤵
                                                      PID:6616
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,13104877271756043176,12935430922172025579,524288 --field-trial-handle=2056,i,1086807893823280097,7331367388408528325,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:14
                                                      3⤵
                                                        PID:4476
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                    1⤵
                                                      PID:6076
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                      1⤵
                                                        PID:4812

                                                      Network

                                                            MITRE ATT&CK Enterprise v16

                                                            Reconnaissance

                                                            Resource Development

                                                            Initial Access

                                                            Execution

                                                            Persistence

                                                            Boot or Logon Autostart Execution

                                                            1
                                                            T1547

                                                            Registry Run Keys / Startup Folder

                                                            1
                                                            T1547.001

                                                            Browser Extensions

                                                            1
                                                            T1176

                                                            Privilege Escalation

                                                            Boot or Logon Autostart Execution

                                                            1
                                                            T1547

                                                            Registry Run Keys / Startup Folder

                                                            1
                                                            T1547.001

                                                            Defense Evasion

                                                            Modify Registry

                                                            3
                                                            T1112

                                                            Credential Access

                                                            Credentials from Password Stores

                                                            1
                                                            T1555

                                                            Credentials from Web Browsers

                                                            1
                                                            T1555.003

                                                            Unsecured Credentials

                                                            1
                                                            T1552

                                                            Credentials In Files

                                                            1
                                                            T1552.001

                                                            Discovery

                                                            Browser Information Discovery

                                                            1
                                                            T1217

                                                            Peripheral Device Discovery

                                                            1
                                                            T1120

                                                            Query Registry

                                                            4
                                                            T1012

                                                            System Information Discovery

                                                            5
                                                            T1082

                                                            System Location Discovery

                                                            1
                                                            T1614

                                                            System Language Discovery

                                                            1
                                                            T1614.001

                                                            System Time Discovery

                                                            1
                                                            T1124

                                                            Lateral Movement

                                                            Collection

                                                            Data from Local System

                                                            1
                                                            T1005

                                                            Command and Control

                                                            Exfiltration

                                                            Impact

                                                            Replay Monitor

                                                            Loading Replay Monitor...

                                                            Downloads

                                                            symsrv.dll
                                                            • Path C:\Program Files\Common Files\System\symsrv.dll
                                                            • Size 67KB
                                                            • SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            symsrv.dll.000
                                                            • Path C:\Program Files\Common Files\System\symsrv.dll.000
                                                            • Size 114B
                                                            • SHA256 aefc503b1ed462d7b6280228a7b5b710792273b78934426f88325341ac5b5a92
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            settings.dat
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                            • Size 280B
                                                            • SHA256 29f70f739647817f7f5478533968094fe3d4a46f458df7447ae4697d1b670699
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            the-real-index
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                            • Size 3KB
                                                            • SHA256 6a3ba751c3811a5ec3d65344256a72d7242fcf81ec624612d94c6495bee31642
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            the-real-index~RFe5a20a9.TMP
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a20a9.TMP
                                                            • Size 3KB
                                                            • SHA256 19434d8bc94f2a0f030561f78453cffb5b439bc3a977d60827e190e10057df4a
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            SiteList-Enterprise.json
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                            • Size 2B
                                                            • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            Edge Profile.ico
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                            • Size 70KB
                                                            • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Network Persistent State
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                            • Size 2KB
                                                            • SHA256 66da166745f55ede58204108d7bfd2cee229c5b9fa22ccc2787a152b0df7ec46
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            SCT Auditing Pending Reports
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                            • Size 2B
                                                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            Sdch Dictionaries
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                            • Size 40B
                                                            • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            Preferences
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                            • Size 11KB
                                                            • SHA256 0705e7138bbd682de6e34cc0308b0ebd7bed09f06ed1c74b99216c2bef63150e
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Preferences
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                            • Size 11KB
                                                            • SHA256 477ac647513a3fb962fdfcc925fe7514e44312b1feef17eba8d5e7042cf1b657
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Preferences
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                            • Size 12KB
                                                            • SHA256 7ee1404808f715ad7fcfb1e2dc5e425c6df6c932a5578b4dbe2fdacde30f8db2
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Secure Preferences
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                            • Size 29KB
                                                            • SHA256 ed24121c773ddb2be3ee69694785652a7dae9335df0837efee238bb92a9126ff
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            OperationConfig
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                            • Size 22KB
                                                            • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            OperationConfig~RFe5ab20b.TMP
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5ab20b.TMP
                                                            • Size 3KB
                                                            • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            Local State
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                            • Size 38KB
                                                            • SHA256 0f3e40b744a048615bafa65ff77ec29949491f35783b1a123112820e75d96092
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Local State
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                            • Size 43KB
                                                            • SHA256 1726cc468b489f8a00d72b3ea1adc9ec6f8638147b94d6184281bf65ea3d17f7
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Local State
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                            • Size 35KB
                                                            • SHA256 65a2c49c9887fc90706816ad53288889dac8282ada3da35298da02cbe9914b45
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Local State
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                            • Size 35KB
                                                            • SHA256 4457b95fc3a160ff6200ae85f4b3df2f20defedc0613ed09b95f520182dea4cf
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            Local State
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                            • Size 41KB
                                                            • SHA256 c9b6e0ef95853d013ece8de269e7094703e71890576d4edba5947c3def6a8874
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            metadata.json
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                            • Size 132B
                                                            • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            metadata.json
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                            • Size 252B
                                                            • SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            metadata.json
                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                            • Size 13B
                                                            • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
                                                            • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
                                                            • Size 15KB
                                                            • SHA256 c263c388be8677e2d73f39a6512669bdcefbd4d839de07c23aeae938272f5dc7
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            9512A4488B00CC053350DAC32D417B4A35C11513
                                                            • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
                                                            • Size 15KB
                                                            • SHA256 1838268977d66954aef22fbe873c1cc35cbd90d3c7dd6088c2135c991ae79ca5
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            webext.sc.lz4
                                                            • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jh02jw2g.default-release\startupCache\webext.sc.lz4
                                                            • Size 104KB
                                                            • SHA256 1b46e594baeb385607d0688bf52afb3123c32d612c2cf7fe89a79f4cccf34a22
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            content_new.js
                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4908_1352322866\CRX_INSTALL\content_new.js
                                                            • Size 10KB
                                                            • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            tmpaddon
                                                            • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                            • Size 11KB
                                                            • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            tmpaddon
                                                            • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                            • Size 502KB
                                                            • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            compatibility.ini
                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\compatibility.ini
                                                            • Size 198B
                                                            • SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            data.safe.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
                                                            • Size 6KB
                                                            • SHA256 a91abc7b8eef154b38f8bb1662d8856dd18963b017e76fb99c7093c887771161
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            data.safe.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
                                                            • Size 32KB
                                                            • SHA256 1935fc402d4499375a043b6daff190e283a03fb8ea1d0eea0ab109204aa6c42c
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            data.safe.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
                                                            • Size 32KB
                                                            • SHA256 259eefb77c636bbac5191c07430a381b92919b50e737bd2fbfab4193a362c438
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            data.safe.tmp
                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\db\data.safe.tmp
                                                            • Size 32KB
                                                            • SHA256 7d11c14db8d512aeadd281e516f93c20177d10cd52245d59185ca5350e44ae0a
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            events
                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\events\events
                                                            • Size 1KB
                                                            • SHA256 747f706b9e119ea29323afcfe5144e3acc6a32ae4e296bdbc6d69611e5a68427
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            03ebd9e6-babd-4268-8e7a-b6ef3c5dd8b2
                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\03ebd9e6-babd-4268-8e7a-b6ef3c5dd8b2
                                                            • Size 886B
                                                            • SHA256 8c7da5ee36875bf58ce0f04d02f49f2d61d2862a55624daae71ff22443bfd48e
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            0525d35b-ded2-4c07-b548-22bcf1b08497
                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\0525d35b-ded2-4c07-b548-22bcf1b08497
                                                            • Size 2KB
                                                            • SHA256 dd9d3c1a4eb7df0f9b04c9dbfba526cadd86c7609b9e712d5be42e29baf158b1
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            0b289d52-4045-4f9e-a5e1-de7c78c940aa
                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\0b289d52-4045-4f9e-a5e1-de7c78c940aa
                                                            • Size 235B
                                                            • SHA256 0ae82d85a23861dcce293cc11bdf50433844d625ff62a6fc047bd248be107dca
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            c49430c6-c969-4a72-ba56-bc162acf4554
                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\c49430c6-c969-4a72-ba56-bc162acf4554
                                                            • Size 16KB
                                                            • SHA256 7f4eb572707bd114cdfdfbea2e9bcda9e013fc53a38e3f824c46ad83e4b08231
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            dce112cf-ce3a-4b8f-820a-304ca87af770
                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\dce112cf-ce3a-4b8f-820a-304ca87af770
                                                            • Size 235B
                                                            • SHA256 34e298fe23520a0983331530ed6f4d20523648ba0cfa0a99cab82f10adab37a7
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            fbc9df66-a211-4798-8487-0b644b060a1a
                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\datareporting\glean\pending_pings\fbc9df66-a211-4798-8487-0b644b060a1a
                                                            • Size 883B
                                                            • SHA256 22e57fb377412c9f459b44178bf6003b62511a22a1982e21397f311251146128
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            extensions.json
                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\extensions.json
                                                            • Size 16KB
                                                            • SHA256 93280f9aef3803c0b1bf5d809e695a88dc93df9e8730ca1fa6907e416ec5b35d
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            gmpopenh264.dll
                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                                                            • Size 1.1MB
                                                            • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            gmpopenh264.info
                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                                                            • Size 116B
                                                            • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            manifest.json
                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
                                                            • Size 1002B
                                                            • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
                                                            • MD5 SHA1 SHA512 TLSH
                                                            Submit Download

                                                            widevinecdm.dll
                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
                                                            • Size 21.6MB
                                                            • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            prefs-1.js
                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
                                                            • Size 6KB
                                                            • SHA256 4982549006fea389c52d0f144608ca7f1e64ec8b47e01c4f31fb4e205053fb58
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            prefs-1.js
                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
                                                            • Size 6KB
                                                            • SHA256 6dc69232c0a88a27546d0a35bc24112017c1fa38c571a897cf33c01e7dc74a44
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            prefs-1.js
                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs-1.js
                                                            • Size 8KB
                                                            • SHA256 60f9cb9f995c0bf006c573add9e4c2c1227955a01fb398cb298527a74564da2e
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            prefs.js
                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\prefs.js
                                                            • Size 6KB
                                                            • SHA256 db3cec047535978ddc1893ad0fa5b652d6ef849c40e574aa17023ce890f8ffef
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            recovery.baklz4
                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.baklz4
                                                            • Size 4KB
                                                            • SHA256 eee8763082b2df41bb6d6189692cdc4268a51b2724d8de183821f0ca13d9d9a5
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            recovery.jsonlz4
                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\sessionstore-backups\recovery.jsonlz4
                                                            • Size 4KB
                                                            • SHA256 b68908312afdd6af93279abf25bff72613ebe0bcca6e46c2d66f0dd9521facf8
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            3870112724rsegmnoittet-es.sqlite
                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jh02jw2g.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                            • Size 7.2MB
                                                            • SHA256 3d51febc3183778781daf5fe1a2bed44ef0598357426181a5ffa4c920cd3ef65
                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                            Submit Download

                                                            memory/3008-561-0x0000000000750000-0x0000000000D1B000-memory.dmp
                                                            Download

                                                            memory/3008-562-0x0000000010000000-0x0000000010030000-memory.dmp
                                                            Download

                                                            memory/3008-11-0x0000000000750000-0x0000000000D1B000-memory.dmp
                                                            Download

                                                            memory/3008-12-0x0000000010000000-0x0000000010030000-memory.dmp
                                                            Download

                                                            memory/3008-316-0x0000000010000000-0x0000000010030000-memory.dmp
                                                            Download

                                                            memory/3008-10-0x0000000010000000-0x0000000010030000-memory.dmp
                                                            Download

                                                            memory/3008-9-0x0000000000751000-0x0000000000752000-memory.dmp
                                                            Download

                                                            memory/3008-424-0x0000000000750000-0x0000000000D1B000-memory.dmp
                                                            Download

                                                            memory/3008-3-0x0000000010000000-0x0000000010030000-memory.dmp
                                                            Download

                                                            memory/3008-425-0x0000000010000000-0x0000000010030000-memory.dmp
                                                            Download

                                                            memory/3008-370-0x0000000010000000-0x0000000010030000-memory.dmp
                                                            Download