Overview

overview

10

Static

static

10

2026-08-19...op.exe

windows10-2004-x64

10

2026-08-19...op.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    19/08/2026, 21:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-19_fcb3756c547ca674ff00991d819a4a51_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
  • Size 6.0MB
  • Sample260819-1jymcatglb
  • SHA256 09f7a4f27072c43e082810ed17b2527cecf423628e350bb987826c5be976b7cf
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarebackdoordefense_evasiondiscoveryfloxifpersistencephishingspywarestealertrojanupx

Malware Config

Signatures

  • Family: Floxif, Floodfix

    Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

    backdoortrojanfloxif
  • Detects Floxif payload 1 IoCs
    backdoor
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 4 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 4 IoCs
  • UPX dump on OEP (original entry point) 7 IoCs
  • A potential corporate email address has been identified in the URL: [email protected]
    phishing
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 21 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 22 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 18 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-19_fcb3756c547ca674ff00991d819a4a51_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-19_fcb3756c547ca674ff00991d819a4a51_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Enumerates connected drives
    • Installs/modifies Browser Helper Object
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4624
    • C:\Windows\system32\regsvr32.exe
      C:\Windows\Sysnative\regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
      2⤵
        PID:1512
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3800
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
          3⤵
          • Checks processor information in registry
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1748
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1948 -prefsLen 27097 -prefMapHandle 1952 -prefMapSize 270279 -ipcHandle 2024 -initialChannelId {154a4417-b4c2-40a5-a5e9-4af46d4a7947} -parentPid 1748 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1748" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
            4⤵
              PID:5488
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2424 -prefsLen 27133 -prefMapHandle 2428 -prefMapSize 270279 -ipcHandle 2436 -initialChannelId {d0e93962-e42a-44ed-8793-ba3c6d7cbc0f} -parentPid 1748 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1748" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
              4⤵
                PID:4664
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3724 -prefsLen 25213 -prefMapHandle 3728 -prefMapSize 270279 -jsInitHandle 3732 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3740 -initialChannelId {943de52a-5aa4-4c6d-9df7-1d9727c885f8} -parentPid 1748 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1748" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
                4⤵
                • Checks processor information in registry
                PID:2168
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3896 -prefsLen 27323 -prefMapHandle 3900 -prefMapSize 270279 -ipcHandle 3968 -initialChannelId {2ec0b12d-8572-4441-8ac3-3d88ac8499a6} -parentPid 1748 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1748" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
                4⤵
                  PID:4176
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4420 -prefsLen 34822 -prefMapHandle 4424 -prefMapSize 270279 -jsInitHandle 4428 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4436 -initialChannelId {3a554d06-0a71-4ef1-b095-cf85af1c8d5d} -parentPid 1748 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1748" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                  4⤵
                  • Checks processor information in registry
                  PID:1148
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2884 -prefsLen 35010 -prefMapHandle 5088 -prefMapSize 270279 -ipcHandle 5092 -initialChannelId {7e1597eb-e38d-4fcd-a182-485395742225} -parentPid 1748 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1748" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
                  4⤵
                  • Checks processor information in registry
                  PID:4320
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1200 -prefsLen 32952 -prefMapHandle 3332 -prefMapSize 270279 -jsInitHandle 924 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5512 -initialChannelId {781b7c1d-392f-4802-bedd-0ddacd87ee94} -parentPid 1748 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1748" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
                  4⤵
                  • Checks processor information in registry
                  PID:4656
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5032 -prefsLen 32952 -prefMapHandle 5468 -prefMapSize 270279 -jsInitHandle 2652 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5528 -initialChannelId {2bf9187f-b369-47ac-9e85-d7f4813ceb59} -parentPid 1748 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1748" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                  4⤵
                  • Checks processor information in registry
                  PID:2596
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5832 -prefsLen 32952 -prefMapHandle 5836 -prefMapSize 270279 -jsInitHandle 5840 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5848 -initialChannelId {ea487441-e8ea-4297-9030-a396b77a51d6} -parentPid 1748 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1748" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                  4⤵
                  • Checks processor information in registry
                  PID:3132
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3896 -prefsLen 32952 -prefMapHandle 4124 -prefMapSize 270279 -jsInitHandle 3772 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6020 -initialChannelId {d2a6990a-6b8f-4a36-951b-b31c6b6b48ab} -parentPid 1748 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1748" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
                  4⤵
                  • Checks processor information in registry
                  PID:5732
            • C:\Windows\SysWOW64\regsvr32.exe
              "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:6108
            • C:\Windows\SysWOW64\regsvr32.exe
              "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:1652
            • C:\Windows\SysWOW64\regsvr32.exe
              "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:3240
            • C:\Windows\SysWOW64\regsvr32.exe
              "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:1208
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.internetdownloadmanager.com/welcome.html?v=643b09
              2⤵
              • Drops file in Windows directory
              • Enumerates system info in registry
              • Modifies data under HKEY_USERS
              • Modifies registry class
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:1492
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2cc,0x2f4,0x2f8,0x2c8,0x358,0x7ffb0a34c188,0x7ffb0a34c194,0x7ffb0a34c1a0
                3⤵
                  PID:2128
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,16169873163866462633,10934212888181734487,524288 --field-trial-handle=2732,i,18152791391806823751,9431949284941211564,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:11
                  3⤵
                  • System Time Discovery
                  PID:6036
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2176,i,8741895713857358849,10439107296530995206,524288 --field-trial-handle=2732,i,18152791391806823751,9431949284941211564,262144 --variations-seed-version --mojo-platform-channel-handle=2828 /prefetch:13
                  3⤵
                    PID:1692
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,9842800462047811325,6118527628121863972,262144 --field-trial-handle=2732,i,18152791391806823751,9431949284941211564,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:2
                    3⤵
                      PID:2904
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3608,i,505331406005273830,3928367823745201842,2097152 --field-trial-handle=2732,i,18152791391806823751,9431949284941211564,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
                      3⤵
                        PID:4880
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3628,i,10873626958959681447,3327187299358710301,2097152 --field-trial-handle=2732,i,18152791391806823751,9431949284941211564,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
                        3⤵
                          PID:4204
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4332,i,14974757550257760717,10753243855351027800,2097152 --field-trial-handle=2732,i,18152791391806823751,9431949284941211564,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:1
                          3⤵
                            PID:4168
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4344,i,11874628862412500448,7851213893520851007,2097152 --field-trial-handle=2732,i,18152791391806823751,9431949284941211564,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:9
                            3⤵
                              PID:1548
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,17443231487729090311,1655013594031102680,524288 --field-trial-handle=2732,i,18152791391806823751,9431949284941211564,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
                              3⤵
                                PID:4940
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,12169519827444968412,345910511084431836,524288 --field-trial-handle=2732,i,18152791391806823751,9431949284941211564,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:14
                                3⤵
                                  PID:2364
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,13115496124425779457,12132143142846121081,524288 --field-trial-handle=2732,i,18152791391806823751,9431949284941211564,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:14
                                  3⤵
                                    PID:4704
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,6826224281961346944,16375882906810905490,524288 --field-trial-handle=2732,i,18152791391806823751,9431949284941211564,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:14
                                    3⤵
                                      PID:6412
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,6826224281961346944,16375882906810905490,524288 --field-trial-handle=2732,i,18152791391806823751,9431949284941211564,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:14
                                      3⤵
                                        PID:6424
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,7065938581396825257,9104322993086474976,524288 --field-trial-handle=2732,i,18152791391806823751,9431949284941211564,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
                                        3⤵
                                          PID:6952
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,3299614664650958990,14678967742517222194,524288 --field-trial-handle=2732,i,18152791391806823751,9431949284941211564,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:14
                                          3⤵
                                            PID:1104
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,14536330176416996972,15630202519861122766,524288 --field-trial-handle=2732,i,18152791391806823751,9431949284941211564,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
                                            3⤵
                                              PID:6712
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4580,i,1648147021445113073,2029198523261587617,524288 --field-trial-handle=2732,i,18152791391806823751,9431949284941211564,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:14
                                              3⤵
                                                PID:6708
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,15339709114229104179,11174799710568327987,524288 --field-trial-handle=2732,i,18152791391806823751,9431949284941211564,262144 --variations-seed-version --mojo-platform-channel-handle=752 /prefetch:14
                                                3⤵
                                                  PID:6696
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,9537245140122697958,8803508291573216359,524288 --field-trial-handle=2732,i,18152791391806823751,9431949284941211564,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:14
                                                  3⤵
                                                    PID:2484
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,16989398811435920016,12018775841738610123,524288 --field-trial-handle=2732,i,18152791391806823751,9431949284941211564,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:14
                                                    3⤵
                                                      PID:6488
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,3784471825234962364,3117114927946252125,524288 --field-trial-handle=2732,i,18152791391806823751,9431949284941211564,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
                                                      3⤵
                                                        PID:5952
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                    1⤵
                                                      PID:3324
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                      1⤵
                                                        PID:6752
                                                      • C:\Windows\system32\svchost.exe
                                                        C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                        1⤵
                                                          PID:1156

                                                        Network

                                                              MITRE ATT&CK Enterprise v16

                                                              Reconnaissance

                                                              Resource Development

                                                              Initial Access

                                                              Execution

                                                              Persistence

                                                              Boot or Logon Autostart Execution

                                                              1
                                                              T1547

                                                              Registry Run Keys / Startup Folder

                                                              1
                                                              T1547.001

                                                              Browser Extensions

                                                              1
                                                              T1176

                                                              Privilege Escalation

                                                              Boot or Logon Autostart Execution

                                                              1
                                                              T1547

                                                              Registry Run Keys / Startup Folder

                                                              1
                                                              T1547.001

                                                              Defense Evasion

                                                              Modify Registry

                                                              3
                                                              T1112

                                                              Credential Access

                                                              Credentials from Password Stores

                                                              1
                                                              T1555

                                                              Credentials from Web Browsers

                                                              1
                                                              T1555.003

                                                              Unsecured Credentials

                                                              1
                                                              T1552

                                                              Credentials In Files

                                                              1
                                                              T1552.001

                                                              Discovery

                                                              Browser Information Discovery

                                                              1
                                                              T1217

                                                              Peripheral Device Discovery

                                                              1
                                                              T1120

                                                              Query Registry

                                                              4
                                                              T1012

                                                              System Information Discovery

                                                              5
                                                              T1082

                                                              System Location Discovery

                                                              1
                                                              T1614

                                                              System Language Discovery

                                                              1
                                                              T1614.001

                                                              System Time Discovery

                                                              1
                                                              T1124

                                                              Lateral Movement

                                                              Collection

                                                              Data from Local System

                                                              1
                                                              T1005

                                                              Command and Control

                                                              Exfiltration

                                                              Impact

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads

                                                              symsrv.dll
                                                              • Path C:\Program Files\Common Files\System\symsrv.dll
                                                              • Size 67KB
                                                              • SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              symsrv.dll.000
                                                              • Path C:\Program Files\Common Files\System\symsrv.dll.000
                                                              • Size 114B
                                                              • SHA256 aefc503b1ed462d7b6280228a7b5b710792273b78934426f88325341ac5b5a92
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              settings.dat
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                              • Size 280B
                                                              • SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              settings.dat
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                              • Size 280B
                                                              • SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              the-real-index
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                              • Size 3KB
                                                              • SHA256 48969478e83089b090dbbf0b94c50439dda9f5c7e3ce52bb6cd575d389e84aca
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              the-real-index~RFe5a73f9.TMP
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a73f9.TMP
                                                              • Size 3KB
                                                              • SHA256 9e7215e8f8101ba61d86f7cc477eb6770d42e69d5edfa2b462681cf2015a3492
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              SiteList-Enterprise.json
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                              • Size 2B
                                                              • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              Edge Profile.ico
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                              • Size 70KB
                                                              • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Network Persistent State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                              • Size 2KB
                                                              • SHA256 109b9326dcc7397645d654055e3e2b967bfb12e46bbae91204cc43658663d4b2
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              Network Persistent State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                              • Size 1KB
                                                              • SHA256 c5d2f193989799c59c2f2e2e7f91704a8fc8fd77e1b17064e0c14d520eea1161
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              SCT Auditing Pending Reports
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                              • Size 2B
                                                              • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              Sdch Dictionaries
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                              • Size 40B
                                                              • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              Preferences
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                              • Size 12KB
                                                              • SHA256 083bc8fa3178471d432d3222b86a63a7413e8ff987b13ff579051dcfd14cd8dc
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Preferences
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                              • Size 12KB
                                                              • SHA256 e35a0ebbeca4ddf635677c2f34b2056ee44318c5d311d76f923fe26a06b0ab4d
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Preferences
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                              • Size 12KB
                                                              • SHA256 f9bcd1c8d7e3b964097748f921911861d79d7fe3132a12121ac250683a703488
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Secure Preferences
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                              • Size 29KB
                                                              • SHA256 61cc5a561703109eb55ff407993582e5e115045727f0d43bd4ccd1e202124e1e
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              eff69165-4845-44b5-8cad-43e28701f888.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\eff69165-4845-44b5-8cad-43e28701f888.tmp
                                                              • Size 22KB
                                                              • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 34KB
                                                              • SHA256 71f15e896d714dfef416a20df8b40336fc264108a08a462a6b908d73df161bd0
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 42KB
                                                              • SHA256 140b740b908fb7624b7e6737f70da7c293dd4e3ae75d5fb15227888b0267f33f
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 34KB
                                                              • SHA256 af7366a73ae2c07c9a8883ae49ee957e72fe52a7fb5458aac1d5bc330adaabb5
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 38KB
                                                              • SHA256 109136f9433eb56e8f65208682914105d1f3b2cecb92c283084440f4eb7cc546
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 38KB
                                                              • SHA256 ed396105096f26bfd593235eab6598553bbb458407e9f5b1a24f634f86eeeec6
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 39KB
                                                              • SHA256 29d924ea1542767816e701e1c6e3163f62687a1c9439d8a67bda124e25cb308b
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              metadata.json
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                              • Size 132B
                                                              • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              metadata.json
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                              • Size 252B
                                                              • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              metadata.json
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                              • Size 13B
                                                              • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
                                                              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
                                                              • Size 16KB
                                                              • SHA256 a2d64b16db635a110a0f6eb1d12774b4a2bbec2888a3a0e6f79927aa1d4e6ce2
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              webext.sc.lz4
                                                              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fiyrtffj.default-release\startupCache\webext.sc.lz4
                                                              • Size 105KB
                                                              • SHA256 92f2d69b146cd86299330fa8e678e440ce609d4b9bd7a184666e27936ec51d48
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              content_new.js
                                                              • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1492_1007195748\CRX_INSTALL\content_new.js
                                                              • Size 10KB
                                                              • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              tmpaddon
                                                              • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                              • Size 11KB
                                                              • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              tmpaddon
                                                              • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                              • Size 502KB
                                                              • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              compatibility.ini
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\compatibility.ini
                                                              • Size 198B
                                                              • SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              data.safe.tmp
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\db\data.safe.tmp
                                                              • Size 7KB
                                                              • SHA256 f3ad79c377d8024c31ed501d90c2afe37f047c17fa60b3b12ce5a29baa75457a
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              data.safe.tmp
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\db\data.safe.tmp
                                                              • Size 6KB
                                                              • SHA256 ca69d48acee5adf121b69e66afc13bc18d46edca3bbfdb9a2c694aa5c1df4631
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              events
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\events\events
                                                              • Size 1KB
                                                              • SHA256 0b38c71acf1de315c79e30fadbb067f992c8a15e919b8176a9c5cf713c0f9789
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              273488ea-7bd1-477b-b400-61df06a4e9ef
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\273488ea-7bd1-477b-b400-61df06a4e9ef
                                                              • Size 2KB
                                                              • SHA256 0c3ec84d89c023279d1ffcfe5893917663af410c8ce3d5c944490c2e39d6cb89
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              4678ba78-6a03-4000-8b07-860a29094ca7
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\4678ba78-6a03-4000-8b07-860a29094ca7
                                                              • Size 16KB
                                                              • SHA256 bf62b3e53736859c7dd4c8c7552dc97a5a99baa2f9dd95dbcb81a8f5ddfac173
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              4824a6f0-a2fe-42d5-9385-01c3f44770ec
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\4824a6f0-a2fe-42d5-9385-01c3f44770ec
                                                              • Size 235B
                                                              • SHA256 d35c62476212b5c1f3af77d9d88ced7b96fe3f12ffb99420f69d67b6f99b33f2
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              5ef5e63d-506e-408d-8c3a-0ae7bd1c6e69
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\5ef5e63d-506e-408d-8c3a-0ae7bd1c6e69
                                                              • Size 235B
                                                              • SHA256 1cf11580c30885585a9ca74ff556f8a902d763d1fdb63c181eb88d7352bec9bc
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              5f431ea0-f6f0-4748-829c-bc883e055f8c
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\5f431ea0-f6f0-4748-829c-bc883e055f8c
                                                              • Size 886B
                                                              • SHA256 5227e03892b30582e3928bc9f1135d658abe3264fe95d4a1c295fa4c54feda42
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              bcb5ca29-6633-4d9e-af6d-1b9fe25f7030
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\datareporting\glean\pending_pings\bcb5ca29-6633-4d9e-af6d-1b9fe25f7030
                                                              • Size 883B
                                                              • SHA256 f79c3a32092894abfefedb231911894c2560dcfb25e68da368b07f5a0557b527
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              extensions.json
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\extensions.json
                                                              • Size 16KB
                                                              • SHA256 46b1e59c75ae49357595e439bc71ae12ebf5734531154d4f8bb9645405d3ade0
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              gmpopenh264.dll
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                                                              • Size 1.1MB
                                                              • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              gmpopenh264.info
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                                                              • Size 116B
                                                              • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              manifest.json
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
                                                              • Size 1002B
                                                              • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              widevinecdm.dll
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
                                                              • Size 21.6MB
                                                              • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              prefs-1.js
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs-1.js
                                                              • Size 7KB
                                                              • SHA256 aab91c24037a8a5fd3b30c03c83b36fa95df175b745d5792b81573e0cb6cc638
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              prefs.js
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs.js
                                                              • Size 6KB
                                                              • SHA256 f6f0b1e54d21077f51b1dc8a0ce58373fd0221c695f26aada906feb4496a7b8c
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              prefs.js
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs.js
                                                              • Size 6KB
                                                              • SHA256 406bf9ef023efed232cd7495213f8f67b8999d192ef8da9050060473231947ed
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              prefs.js
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\prefs.js
                                                              • Size 6KB
                                                              • SHA256 25d8448432786936ff79c6e329a5c230697009fdf0fe804ee532fd7ad3aead9e
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              recovery.baklz4
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\sessionstore-backups\recovery.baklz4
                                                              • Size 4KB
                                                              • SHA256 01cd8fccd9e56e86988f158eea503cabfd21a2247e30bc634858196bc53df562
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              3870112724rsegmnoittet-es.sqlite
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                              • Size 5.0MB
                                                              • SHA256 1f397fc492b82b2faba0d8f40f1fdf374ff2f42924a8a639400490ac3c07c2fb
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              3870112724rsegmnoittet-es.sqlite
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fiyrtffj.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                              • Size 7.3MB
                                                              • SHA256 a07578a829d7baa3cdfd761e1f49a91d22f54b408d921784d9d7ce1c309fca20
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              memory/4624-437-0x0000000000EE0000-0x00000000014D3000-memory.dmp
                                                              Download

                                                              memory/4624-680-0x0000000000EE0000-0x00000000014D3000-memory.dmp
                                                              Download

                                                              memory/4624-411-0x0000000000EE0000-0x00000000014D3000-memory.dmp
                                                              Download

                                                              memory/4624-389-0x0000000010000000-0x0000000010030000-memory.dmp
                                                              Download

                                                              memory/4624-683-0x0000000010000000-0x0000000010030000-memory.dmp
                                                              Download

                                                              memory/4624-412-0x0000000010000000-0x0000000010030000-memory.dmp
                                                              Download

                                                              memory/4624-21-0x0000000000EE0000-0x00000000014D3000-memory.dmp
                                                              Download

                                                              memory/4624-22-0x0000000010000000-0x0000000010030000-memory.dmp
                                                              Download

                                                              memory/4624-17-0x0000000010000000-0x0000000010030000-memory.dmp
                                                              Download

                                                              memory/4624-9-0x0000000000EE1000-0x0000000000EE2000-memory.dmp
                                                              Download

                                                              memory/4624-3-0x0000000010000000-0x0000000010030000-memory.dmp
                                                              Download