Overview

overview

10

Static

static

10

2026-07-20...op.exe

windows10-2004-x64

10

2026-07-20...op.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/07/2026, 12:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-20_f537469e674d4b4ff2ebc4e7ac711ad0_dark-comet_darkgate_elex_gcleaner_glassworm_remcos_stop.exe
  • Size 6.6MB
  • Sample260720-pw91csav7n
  • SHA256 e7649d5a9ef6b4d7afd1a2f070e9e8b203bd76e18178c24c77afab113509afcf
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarebackdoordefense_evasiondiscoveryxredpersistencephishingspywarestealertrojan

Malware Config

Extracted

Family

  • xred

C2

  • xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 2 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 2 IoCs
  • A potential corporate email address has been identified in the URL: [email protected]
    phishing
  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Drops desktop.ini file(s) 3 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in Windows directory 3 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies Internet Explorer settings 1 TTPs 22 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 19 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 20 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-20_f537469e674d4b4ff2ebc4e7ac711ad0_dark-comet_darkgate_elex_gcleaner_glassworm_remcos_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-20_f537469e674d4b4ff2ebc4e7ac711ad0_dark-comet_darkgate_elex_gcleaner_glassworm_remcos_stop.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2488
    • C:\Users\Admin\AppData\Local\Temp\._cache_2026-07-20_f537469e674d4b4ff2ebc4e7ac711ad0_dark-comet_darkgate_elex_gcleaner_glassworm_remcos_stop.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_2026-07-20_f537469e674d4b4ff2ebc4e7ac711ad0_dark-comet_darkgate_elex_gcleaner_glassworm_remcos_stop.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Installs/modifies Browser Helper Object
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3968
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2072
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1196
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
          4⤵
          • Drops desktop.ini file(s)
          • Checks processor information in registry
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3180
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1952 -prefsLen 27097 -prefMapHandle 1956 -prefMapSize 270279 -ipcHandle 2040 -initialChannelId {394db49c-2b3a-46ad-a620-3762a002d059} -parentPid 3180 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3180" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
            5⤵
              PID:3252
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2420 -prefsLen 27133 -prefMapHandle 2424 -prefMapSize 270279 -ipcHandle 2432 -initialChannelId {884a659d-81c5-444d-a39e-ae3dfb84c663} -parentPid 3180 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3180" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
              5⤵
                PID:2480
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3852 -prefsLen 25164 -prefMapHandle 3856 -prefMapSize 270279 -jsInitHandle 3860 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3868 -initialChannelId {25a164a4-e3a5-4f60-9ce2-43a43ec337de} -parentPid 3180 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3180" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
                5⤵
                • Checks processor information in registry
                PID:4236
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4052 -prefsLen 27274 -prefMapHandle 4056 -prefMapSize 270279 -ipcHandle 4108 -initialChannelId {d17a6399-08a2-40d2-a47a-0dbc51c44981} -parentPid 3180 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3180" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
                5⤵
                  PID:4252
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2900 -prefsLen 34773 -prefMapHandle 4520 -prefMapSize 270279 -jsInitHandle 4528 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4536 -initialChannelId {94454e90-c099-4f0d-a03a-7f19340d38f7} -parentPid 3180 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3180" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                  5⤵
                  • Checks processor information in registry
                  PID:2108
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3036 -prefsLen 35010 -prefMapHandle 3108 -prefMapSize 270279 -ipcHandle 3256 -initialChannelId {9c77d136-f2e3-452a-8194-f590b239b250} -parentPid 3180 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3180" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
                  5⤵
                  • Checks processor information in registry
                  PID:1520
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5528 -prefsLen 35062 -prefMapHandle 5532 -prefMapSize 270279 -jsInitHandle 5536 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5252 -initialChannelId {2a74b874-0e4a-4d81-b8d4-28427f0fc2fe} -parentPid 3180 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3180" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
                  5⤵
                  • Checks processor information in registry
                  PID:6088
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5768 -prefsLen 32952 -prefMapHandle 1284 -prefMapSize 270279 -jsInitHandle 2708 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5860 -initialChannelId {289bbc86-c5bd-4b53-8720-3797bd9f6b88} -parentPid 3180 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3180" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                  5⤵
                  • Checks processor information in registry
                  PID:6068
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5876 -prefsLen 32952 -prefMapHandle 5880 -prefMapSize 270279 -jsInitHandle 5884 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5900 -initialChannelId {ac8a5f50-8063-4e52-a3db-eb699e9ce117} -parentPid 3180 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3180" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                  5⤵
                  • Checks processor information in registry
                  PID:2744
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2708 -prefsLen 32952 -prefMapHandle 1284 -prefMapSize 270279 -jsInitHandle 5768 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6136 -initialChannelId {b86bfb59-9fa5-4917-b39e-536944557b35} -parentPid 3180 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3180" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
                  5⤵
                  • Checks processor information in registry
                  PID:4828
            • C:\Windows\SysWOW64\regsvr32.exe
              "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:4736
            • C:\Windows\SysWOW64\regsvr32.exe
              "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:4116
            • C:\Windows\SysWOW64\regsvr32.exe
              "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:1444
            • C:\Windows\SysWOW64\regsvr32.exe
              "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:4104
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.internetdownloadmanager.com/welcome.html?v=642b38
              3⤵
              • Drops file in Windows directory
              • Enumerates system info in registry
              • Modifies data under HKEY_USERS
              • Modifies registry class
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:4224
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffcfb33c188,0x7ffcfb33c194,0x7ffcfb33c1a0
                4⤵
                  PID:5112
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1852,i,4958086920193467519,2304156671057680110,262144 --field-trial-handle=2512,i,12104761591478190865,18321302079686684778,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:2
                  4⤵
                    PID:4328
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2124,i,17186931983430946113,3365732077539650755,524288 --field-trial-handle=2512,i,12104761591478190865,18321302079686684778,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:11
                    4⤵
                    • System Time Discovery
                    PID:5684
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2368,i,14554215734568466209,9673651282418838396,524288 --field-trial-handle=2512,i,12104761591478190865,18321302079686684778,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:13
                    4⤵
                      PID:1820
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,15070602851782482467,1978420829014737262,2097152 --field-trial-handle=2512,i,12104761591478190865,18321302079686684778,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
                      4⤵
                        PID:2944
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,8294605494268930947,5544929720231428461,2097152 --field-trial-handle=2512,i,12104761591478190865,18321302079686684778,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
                        4⤵
                          PID:5032
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,223149328768073814,343445042763595056,2097152 --field-trial-handle=2512,i,12104761591478190865,18321302079686684778,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:9
                          4⤵
                            PID:4672
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4300,i,4695948302518736083,6098636005745242444,2097152 --field-trial-handle=2512,i,12104761591478190865,18321302079686684778,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:1
                            4⤵
                              PID:6032
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3868,i,10242072481876614866,5302009669260106720,524288 --field-trial-handle=2512,i,12104761591478190865,18321302079686684778,262144 --variations-seed-version --mojo-platform-channel-handle=3880 /prefetch:14
                              4⤵
                                PID:4480
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3808,i,16428323856658292521,1840283457276087623,524288 --field-trial-handle=2512,i,12104761591478190865,18321302079686684778,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:14
                                4⤵
                                  PID:6436
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,5711207473857783041,1785746956286530181,524288 --field-trial-handle=2512,i,12104761591478190865,18321302079686684778,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:14
                                  4⤵
                                    PID:6444
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,9221683262217973123,3125706405389246133,524288 --field-trial-handle=2512,i,12104761591478190865,18321302079686684778,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:14
                                    4⤵
                                      PID:6536
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,9221683262217973123,3125706405389246133,524288 --field-trial-handle=2512,i,12104761591478190865,18321302079686684778,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:14
                                      4⤵
                                        PID:6568
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,6470387745196375435,3997913713733931689,524288 --field-trial-handle=2512,i,12104761591478190865,18321302079686684778,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
                                        4⤵
                                          PID:6160
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,14232731032263235347,5021184919745209594,524288 --field-trial-handle=2512,i,12104761591478190865,18321302079686684778,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:14
                                          4⤵
                                            PID:6200
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1284,i,2248519815474482870,14629710159530069586,524288 --field-trial-handle=2512,i,12104761591478190865,18321302079686684778,262144 --variations-seed-version --mojo-platform-channel-handle=1384 /prefetch:14
                                            4⤵
                                              PID:1864
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1288,i,7905700137984262948,3088900548720367418,524288 --field-trial-handle=2512,i,12104761591478190865,18321302079686684778,262144 --variations-seed-version --mojo-platform-channel-handle=1400 /prefetch:14
                                              4⤵
                                                PID:6928
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1292,i,2814736873905392655,1588537924396326651,524288 --field-trial-handle=2512,i,12104761591478190865,18321302079686684778,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:14
                                                4⤵
                                                  PID:6272
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1264,i,404961133265201307,9289441136769666038,524288 --field-trial-handle=2512,i,12104761591478190865,18321302079686684778,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:14
                                                  4⤵
                                                    PID:4352
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,17900228405995487390,13315189151514715161,524288 --field-trial-handle=2512,i,12104761591478190865,18321302079686684778,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
                                                    4⤵
                                                      PID:6988
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,17999963399145268588,11511452444580535002,524288 --field-trial-handle=2512,i,12104761591478190865,18321302079686684778,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:14
                                                      4⤵
                                                        PID:6268
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 1460
                                                      3⤵
                                                      • Program crash
                                                      PID:7048
                                                  • C:\ProgramData\Synaptics\Synaptics.exe
                                                    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                    2⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    • Modifies registry class
                                                    PID:3156
                                                • C:\ProgramData\Synaptics\Synaptics.exe
                                                  C:\ProgramData\Synaptics\Synaptics.exe
                                                  1⤵
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  PID:4620
                                                • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                  "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                  1⤵
                                                  • Checks processor information in registry
                                                  • Enumerates system info in registry
                                                  • Suspicious behavior: AddClipboardFormatListener
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:1780
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                  1⤵
                                                    PID:5824
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                    1⤵
                                                      PID:6984
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 3968 -ip 3968
                                                      1⤵
                                                        PID:6992
                                                      • C:\Windows\system32\svchost.exe
                                                        C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                        1⤵
                                                          PID:6348

                                                        Network

                                                              MITRE ATT&CK Enterprise v16

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads

                                                              Synaptics.exe
                                                              • Path C:\ProgramData\Synaptics\Synaptics.exe
                                                              • Size 753KB
                                                              • SHA256 6703492ef2770c1cdff5dee8b3edb7149f371cb95d8608cd65567b981985b841
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              settings.dat
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                              • Size 280B
                                                              • SHA256 719f844e62c5a3916fba05dc2f32d02dadec54c424efb41ba161d1fca59227ae
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              settings.dat
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                              • Size 280B
                                                              • SHA256 67b546fed422708faf33930b82ff4826bc323bc64f67af30b02bb9e565fa27ee
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              1b129fe6-56c6-4dcc-86ed-b729877bb215.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1b129fe6-56c6-4dcc-86ed-b729877bb215.tmp
                                                              • Size 12KB
                                                              • SHA256 4343b8d91f53d9a6462bb3da26fc2db6c16e894965530c709e5a9e4e4cd51f72
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              81d9c925-bb19-47cd-9189-52fde20cb8a1.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\81d9c925-bb19-47cd-9189-52fde20cb8a1.tmp
                                                              • Size 12KB
                                                              • SHA256 a237da0c4cadfc3a9010afbe4e650960adbea3feaee0f15b24073cb8624a65f4
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              the-real-index
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                              • Size 2KB
                                                              • SHA256 c92edddbae1dcfdd0e025e2ef9aa311456451fa62236578d134556781a8c45f9
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              the-real-index~RFe5a77d1.TMP
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a77d1.TMP
                                                              • Size 2KB
                                                              • SHA256 14afa4fb2fc1ee2fc00a33c9626787cde1910f5ec80247d267a5cdbaac77735f
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              SiteList-Enterprise.json
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                              • Size 2B
                                                              • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              Edge Profile.ico
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                              • Size 70KB
                                                              • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Network Persistent State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                              • Size 2KB
                                                              • SHA256 db6ee454b2b74df96e3d661f3d0621c920e4635ac2324705427ae0b8056ab6df
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              SCT Auditing Pending Reports
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                              • Size 2B
                                                              • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              Sdch Dictionaries
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                              • Size 40B
                                                              • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              Preferences
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                              • Size 11KB
                                                              • SHA256 ac09ad8356a0bac45b1c65732a1f8041597031f93279aae39a80c3580b976cf2
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Secure Preferences
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                              • Size 29KB
                                                              • SHA256 2f6e8830fc14e8ee0ebd08f904d31d4438f8e0957e93e9b08fa4c936a88e1ce7
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              296c63d6-a844-4834-88a5-7699a0f9721f.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\296c63d6-a844-4834-88a5-7699a0f9721f.tmp
                                                              • Size 22KB
                                                              • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 30KB
                                                              • SHA256 fa9563af4747d97ad48a23191e88e35a8dd8b6b31fcd51ad4b5d336689de591d
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 38KB
                                                              • SHA256 ec80f0f00461fdbe5d1d425d3bcfa9a94307e0b239874723c798b3b4a3b9b4ed
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 34KB
                                                              • SHA256 62f632bfe0a820f306e26c51e138218bddc0800867133ef243d2b25e6b9a625d
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 36KB
                                                              • SHA256 ef04df2706901625f5a4aa7e0b194281623bb93ddf21349f2e51ef01206be48f
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 30KB
                                                              • SHA256 e78485182a60ded7a7d33b7312f2b5e2930be3aeae0353045856bf1e59632872
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              metadata.json
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                              • Size 132B
                                                              • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              metadata.json
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                              • Size 252B
                                                              • SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              c10640b0-9973-4f12-bd40-d505ac468ae3.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c10640b0-9973-4f12-bd40-d505ac468ae3.tmp
                                                              • Size 13B
                                                              • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
                                                              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
                                                              • Size 15KB
                                                              • SHA256 7c79ba5cf7f718385f52b91e070f00cd5b275cd8b9a25a94f0121fea60e4412e
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              9512A4488B00CC053350DAC32D417B4A35C11513
                                                              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
                                                              • Size 15KB
                                                              • SHA256 573e167c78ef825d33f42184361b85ca3d24fda09c8d52d43212357ac36addf7
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              webext.sc.lz4
                                                              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\startupCache\webext.sc.lz4
                                                              • Size 104KB
                                                              • SHA256 32fca8c02df7c655584b33e90b89fd04385f988fe7980e438028fbe5a17bb877
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              ._cache_2026-07-20_f537469e674d4b4ff2ebc4e7ac711ad0_dark-comet_darkgate_elex_gcleaner_glassworm_remcos_stop.exe
                                                              • Path C:\Users\Admin\AppData\Local\Temp\._cache_2026-07-20_f537469e674d4b4ff2ebc4e7ac711ad0_dark-comet_darkgate_elex_gcleaner_glassworm_remcos_stop.exe
                                                              • Size 5.8MB
                                                              • SHA256 92d8ee1f5e363daf1cfa4cfb92b0b33cda03adf9d50154d0bf0ed6c0892e030f
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              3JNcnTvv.xlsm
                                                              • Path C:\Users\Admin\AppData\Local\Temp\3JNcnTvv.xlsm
                                                              • Size 17KB
                                                              • SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              D1F95E00
                                                              • Path C:\Users\Admin\AppData\Local\Temp\D1F95E00
                                                              • Size 23KB
                                                              • SHA256 2853c6646ff22abd5e2045fcec77075399c67fe9ef21094d837e50e59b3ace79
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              c0bc7850-a57d-49df-8607-daf3b15bf5c2.zip
                                                              • Path C:\Users\Admin\AppData\Local\Temp\c0bc7850-a57d-49df-8607-daf3b15bf5c2.zip
                                                              • Size 3.7MB
                                                              • SHA256 bc95998470d618938a0fe50570dbed499e4e6215b1edca8a6693192fe6632a81
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              content_new.js
                                                              • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4224_190357707\CRX_INSTALL\content_new.js
                                                              • Size 10KB
                                                              • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              tmpaddon
                                                              • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                              • Size 502KB
                                                              • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              tmpaddon
                                                              • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                              • Size 11KB
                                                              • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              compatibility.ini
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\compatibility.ini
                                                              • Size 198B
                                                              • SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              data.safe.tmp
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.tmp
                                                              • Size 7KB
                                                              • SHA256 eaa0254b5353ea8a9851ad53039a1813f9ee700c4263d8ad291f9cbbe87a5cf5
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              data.safe.tmp
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.tmp
                                                              • Size 30KB
                                                              • SHA256 4f112cb0bbd6de8bd3c93c2e88c7537743ade9a3451b6cfbb2a99cf92e7c9fd0
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              data.safe.tmp
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.tmp
                                                              • Size 30KB
                                                              • SHA256 f80af9b9e7183ff5db08822a0036bea0ed478e242dbb40f7a5dc1892d0f085a9
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              data.safe.tmp
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.tmp
                                                              • Size 6KB
                                                              • SHA256 57559fa84729f1ce4913efc574d76274d5cc1dd7e504ccb710de07299bab5f1e
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              events
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\events\events
                                                              • Size 1KB
                                                              • SHA256 0a7a653a0fb3935260cbd4b6c9df71dd3a7f3f0c7602392051c8ba0cd4003dac
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              0aa3c136-69c8-45a6-aedb-193a5e909b1e
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\0aa3c136-69c8-45a6-aedb-193a5e909b1e
                                                              • Size 883B
                                                              • SHA256 f4620d1b67f885ebc349d1105dcbecc4f83e6050d480241d47ea55e90a23a25c
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              0c36f3fe-e492-4145-8f2d-9c49413e7704
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\0c36f3fe-e492-4145-8f2d-9c49413e7704
                                                              • Size 235B
                                                              • SHA256 53265013871c85f1065bbb940b7c03a2ab6ecc29a42d416058bd016a1e7e29f1
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              31481c0f-fa66-462f-ac80-0bcc6d24ead0
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\31481c0f-fa66-462f-ac80-0bcc6d24ead0
                                                              • Size 235B
                                                              • SHA256 6900b88d3a4746eff8bebfb77f0f3a7fea38b5b45251670679aff23849ac4a88
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              63e379cf-aebe-4715-8857-0b3be2755df2
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\63e379cf-aebe-4715-8857-0b3be2755df2
                                                              • Size 16KB
                                                              • SHA256 ff723b2b15ed26826bd74a13cdaf2466d06bcd35aa0aeec2e0e5afa98a15919d
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              ea40045c-6a29-4775-817b-de0fed7a2358
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\ea40045c-6a29-4775-817b-de0fed7a2358
                                                              • Size 2KB
                                                              • SHA256 70a3e6c40cde20abb57d7c2f4f84f07cd4b66d32894f9b75f2fad1fb8ddd7f12
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              f6b933a7-4186-4ba0-b462-7cda07ef3ea4
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\f6b933a7-4186-4ba0-b462-7cda07ef3ea4
                                                              • Size 886B
                                                              • SHA256 9076c3dd0147a511502a116a41525f7eb6d93d41e6c864f1adfd40c03eb59c6f
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              extensions.json
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\extensions.json
                                                              • Size 16KB
                                                              • SHA256 820e0fa2dd05eb27c3045ff7ea92fae4562633a0f0ada6a9c7c972b309cbea88
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              gmpopenh264.dll
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                                                              • Size 1.1MB
                                                              • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              gmpopenh264.info
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                                                              • Size 116B
                                                              • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              manifest.json
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
                                                              • Size 1002B
                                                              • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              widevinecdm.dll
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
                                                              • Size 21.6MB
                                                              • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              prefs-1.js
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\prefs-1.js
                                                              • Size 6KB
                                                              • SHA256 132e88735befabc58710e5fb4428afbedf0dbee17307b64d2920a1fa17086cf3
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              prefs-1.js
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\prefs-1.js
                                                              • Size 12KB
                                                              • SHA256 409b84d1b63e6a23e5b806fe44ec244c293aac992bf335618f3cf4f7d8afdc54
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              prefs-1.js
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\prefs-1.js
                                                              • Size 8KB
                                                              • SHA256 6c756ef5949a2546c1e9b857482a9b7a969a9cbb6d1b3efc37be130613613fce
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              prefs.js
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\prefs.js
                                                              • Size 6KB
                                                              • SHA256 7dc0defd6f3960557d290e4ccf2290084e4ff7279568c25be80104bb01d7fcd0
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              prefs.js
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\prefs.js
                                                              • Size 7KB
                                                              • SHA256 6a33ee3218cff7a96ddb0487c8276fe90eb9c2c56dcedc61075820d7f89dfb45
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              recovery.baklz4
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\sessionstore-backups\recovery.baklz4
                                                              • Size 4KB
                                                              • SHA256 10cf9c96d5a9b8bb7457d56eb0a0711a46a80a8ab960130cb5f408fb721945c0
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              recovery.jsonlz4
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\sessionstore-backups\recovery.jsonlz4
                                                              • Size 4KB
                                                              • SHA256 832bfc586e9c7e4d79b81ce673536206942d153e6ee622cac5f2fbb70105fd83
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              3870112724rsegmnoittet-es.sqlite
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                              • Size 7.3MB
                                                              • SHA256 ca650c6a49447088d53208daa4f7b58275c733f31ee87ac7a2a19bcabed2e28d
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              memory/1780-507-0x00007FFCEB1C0000-0x00007FFCEB1D0000-memory.dmp
                                                              Download

                                                              memory/1780-509-0x00007FFCEB1C0000-0x00007FFCEB1D0000-memory.dmp
                                                              Download

                                                              memory/1780-508-0x00007FFCEB1C0000-0x00007FFCEB1D0000-memory.dmp
                                                              Download

                                                              memory/1780-512-0x00007FFCE8660000-0x00007FFCE8670000-memory.dmp
                                                              Download

                                                              memory/1780-513-0x00007FFCE8660000-0x00007FFCE8670000-memory.dmp
                                                              Download

                                                              memory/1780-511-0x00007FFCEB1C0000-0x00007FFCEB1D0000-memory.dmp
                                                              Download

                                                              memory/1780-510-0x00007FFCEB1C0000-0x00007FFCEB1D0000-memory.dmp
                                                              Download

                                                              memory/2488-117-0x0000000000400000-0x0000000000A93000-memory.dmp
                                                              Download

                                                              memory/2488-1-0x00000000004A0000-0x00000000004A1000-memory.dmp
                                                              Download

                                                              memory/2488-0-0x0000000002850000-0x0000000002851000-memory.dmp
                                                              Download

                                                              memory/3156-122-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                              Download

                                                              memory/3156-5048-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                              Download

                                                              memory/3156-5062-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                              Download

                                                              memory/3156-589-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                              Download

                                                              memory/3156-549-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                              Download

                                                              memory/3156-493-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                              Download

                                                              memory/4620-120-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                              Download