Overview

overview

10

Static

static

10

2026-08-24...op.exe

windows10-2004-x64

10

2026-08-24...op.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    25/08/2026, 14:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-24_4844b4e7165e73309ac126b9dce3f948_darkgate_elex_glassworm_hijackloader_remcos_stop.exe
  • Size 5.8MB
  • Sample260825-re5qeshd97
  • SHA256 7d18df13a8968b27ea037e5638612810f6d05400ed7897a3f53bb60cfc25f1a9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaregoogledefense_evasiondiscoveryneshtapersistencephishingspywarestealertrojan

Malware Config

Signatures

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
  • Executes dropped EXE 32 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Drops desktop.ini file(s) 3 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Checks system information in the registry 2 TTPs 2 IoCs

    System information is often read in order to detect sandboxing environments.

  • Detected potential entity reuse from brand GOOGLE. 1 IoCs
    phishinggoogle
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 21 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 22 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-24_4844b4e7165e73309ac126b9dce3f948_darkgate_elex_glassworm_hijackloader_remcos_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-24_4844b4e7165e73309ac126b9dce3f948_darkgate_elex_glassworm_hijackloader_remcos_stop.exe"
    1⤵
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:480
    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-24_4844b4e7165e73309ac126b9dce3f948_darkgate_elex_glassworm_hijackloader_remcos_stop.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-24_4844b4e7165e73309ac126b9dce3f948_darkgate_elex_glassworm_hijackloader_remcos_stop.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Installs/modifies Browser Helper Object
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4456
      • C:\Windows\svchost.com
        "C:\Windows\svchost.com" "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\3582-490\IDMShellExt64.dll"
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1588
        • C:\Windows\SysWOW64\regsvr32.exe
          C:\Windows\System32\regsvr32.exe /s C:\Users\Admin\AppData\Local\Temp\3582-490\IDMShellExt64.dll
          4⤵
          • System Location Discovery: System Language Discovery
          PID:6036
      • C:\Windows\svchost.com
        "C:\Windows\svchost.com" "C:\PROGRA~1\MOZILL~1\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2268
        • C:\PROGRA~1\MOZILL~1\firefox.exe
          C:\PROGRA~1\MOZILL~1\firefox.exe https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:5044
          • C:\PROGRA~1\MOZILL~1\firefox.exe
            C:\PROGRA~1\MOZILL~1\firefox.exe https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
            5⤵
            • Drops desktop.ini file(s)
            • Detected potential entity reuse from brand GOOGLE.
            • Checks processor information in registry
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3440
            • C:\PROGRA~1\MOZILL~1\firefox.exe
              "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1948 -prefsLen 27097 -prefMapHandle 1952 -prefMapSize 270279 -ipcHandle 2024 -initialChannelId {d61bd2d7-97b8-4c0b-a1cc-4c22ff495fa5} -parentPid 3440 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3440" -appDir "C:\PROGRA~1\MOZILL~1\browser" - 1 gpu
              6⤵
                PID:1196
              • C:\PROGRA~1\MOZILL~1\firefox.exe
                "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2420 -prefsLen 27133 -prefMapHandle 2424 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {ddb474b5-8e4a-4150-9552-bacee89b463d} -parentPid 3440 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3440" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 2 socket
                6⤵
                  PID:1172
                • C:\PROGRA~1\MOZILL~1\firefox.exe
                  "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -isForBrowser -prefsHandle 3760 -prefsLen 25213 -prefMapHandle 3764 -prefMapSize 270279 -jsInitHandle 3768 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3772 -initialChannelId {68ec81f5-5213-4dca-bee6-3d177c6daf85} -parentPid 3440 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3440" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 3 tab
                  6⤵
                  • Checks processor information in registry
                  PID:5440
                • C:\PROGRA~1\MOZILL~1\firefox.exe
                  "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3932 -prefsLen 27323 -prefMapHandle 3936 -prefMapSize 270279 -ipcHandle 4020 -initialChannelId {b6db9640-731d-4d01-b2a6-791921589e07} -parentPid 3440 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3440" -appDir "C:\PROGRA~1\MOZILL~1\browser" - 4 rdd
                  6⤵
                    PID:5388
                  • C:\PROGRA~1\MOZILL~1\firefox.exe
                    "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -isForBrowser -prefsHandle 3224 -prefsLen 34822 -prefMapHandle 908 -prefMapSize 270279 -jsInitHandle 1056 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2488 -initialChannelId {aafe3dc7-0f2f-4c9b-9454-89d168357f11} -parentPid 3440 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3440" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 5 tab
                    6⤵
                    • Checks processor information in registry
                    PID:1800
                  • C:\PROGRA~1\MOZILL~1\firefox.exe
                    "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2832 -prefsLen 35010 -prefMapHandle 2836 -prefMapSize 270279 -ipcHandle 1612 -initialChannelId {68a67a9c-083e-4e7b-8224-7e4f83a1e895} -parentPid 3440 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3440" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 6 utility
                    6⤵
                    • Checks processor information in registry
                    PID:3144
                  • C:\PROGRA~1\MOZILL~1\firefox.exe
                    "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -isForBrowser -prefsHandle 5272 -prefsLen 35092 -prefMapHandle 5276 -prefMapSize 270279 -jsInitHandle 5280 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5288 -initialChannelId {1c45faea-a8f3-4209-b6ca-60cd51ea5d40} -parentPid 3440 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3440" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 7 tab
                    6⤵
                    • Checks processor information in registry
                    PID:4260
                  • C:\PROGRA~1\MOZILL~1\firefox.exe
                    "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -isForBrowser -prefsHandle 5840 -prefsLen 32952 -prefMapHandle 5604 -prefMapSize 270279 -jsInitHandle 5720 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5848 -initialChannelId {6bd3e266-077b-43ac-8245-0b3fee2c62f4} -parentPid 3440 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3440" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 8 tab
                    6⤵
                    • Checks processor information in registry
                    PID:3724
                  • C:\PROGRA~1\MOZILL~1\firefox.exe
                    "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -isForBrowser -prefsHandle 5756 -prefsLen 32952 -prefMapHandle 5632 -prefMapSize 270279 -jsInitHandle 5804 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5604 -initialChannelId {2f9071f5-d8b5-48a0-9b8d-8cdead2479d5} -parentPid 3440 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3440" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 9 tab
                    6⤵
                    • Checks processor information in registry
                    PID:2820
                  • C:\PROGRA~1\MOZILL~1\firefox.exe
                    "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -isForBrowser -prefsHandle 6032 -prefsLen 32952 -prefMapHandle 6036 -prefMapSize 270279 -jsInitHandle 6040 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6048 -initialChannelId {e26c2f0c-1909-40bc-9146-678d42afc81b} -parentPid 3440 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3440" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 10 tab
                    6⤵
                    • Checks processor information in registry
                    PID:5292
            • C:\Windows\svchost.com
              "C:\Windows\svchost.com" "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\3582-490\IDMShellExt64.dll"
              3⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2936
              • C:\Windows\SysWOW64\regsvr32.exe
                C:\Windows\System32\regsvr32.exe /s C:\Users\Admin\AppData\Local\Temp\3582-490\IDMShellExt64.dll
                4⤵
                • System Location Discovery: System Language Discovery
                PID:2400
            • C:\Windows\svchost.com
              "C:\Windows\svchost.com" "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\3582-490\IDMIECC64.dll"
              3⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3484
              • C:\Windows\SysWOW64\regsvr32.exe
                C:\Windows\System32\regsvr32.exe /s C:\Users\Admin\AppData\Local\Temp\3582-490\IDMIECC64.dll
                4⤵
                • System Location Discovery: System Language Discovery
                PID:3344
            • C:\Windows\svchost.com
              "C:\Windows\svchost.com" "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\3582-490\IDMGetAll64.dll"
              3⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2700
              • C:\Windows\SysWOW64\regsvr32.exe
                C:\Windows\System32\regsvr32.exe /s C:\Users\Admin\AppData\Local\Temp\3582-490\IDMGetAll64.dll
                4⤵
                • System Location Discovery: System Language Discovery
                PID:3820
            • C:\Windows\svchost.com
              "C:\Windows\svchost.com" "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\3582-490\downlWithIDM64.dll"
              3⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:560
              • C:\Windows\SysWOW64\regsvr32.exe
                C:\Windows\System32\regsvr32.exe /s C:\Users\Admin\AppData\Local\Temp\3582-490\downlWithIDM64.dll
                4⤵
                • System Location Discovery: System Language Discovery
                PID:4852
            • C:\Windows\svchost.com
              "C:\Windows\svchost.com" "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" https://www.internetdownloadmanager.com/welcome.html?v=642b25
              3⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5072
              • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe https://www.internetdownloadmanager.com/welcome.html?v=642b25
                4⤵
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • Checks system information in the registry
                • Drops file in Windows directory
                • Enumerates system info in registry
                • Modifies data under HKEY_USERS
                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:3988
                • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                  C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --monitor-self-argument=/prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 --annotation=exe=C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2c0,0x31c,0x7ffa0449c188,0x7ffa0449c194,0x7ffa0449c1a0
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:4564
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 --annotation=exe=C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x1e0,0x1e4,0x1e8,0x190,0x1ec,0x7ff6b3a46910,0x7ff6b3a4691c,0x7ff6b3a46928
                    6⤵
                    • Executes dropped EXE
                    PID:4664
                • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                  "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,8844838754575438240,13753522646372019426,524288 --field-trial-handle=1940,i,12000529377026856128,13205719285886638239,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:11
                  5⤵
                  • Executes dropped EXE
                  • System Time Discovery
                  PID:2408
                • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                  "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2256,i,2517271428460222779,9065193713250477351,524288 --field-trial-handle=1940,i,12000529377026856128,13205719285886638239,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:13
                  5⤵
                  • Executes dropped EXE
                  PID:3464
                • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                  "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,8664294800710485975,12438480429154658602,262144 --field-trial-handle=1940,i,12000529377026856128,13205719285886638239,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:2
                  5⤵
                  • Executes dropped EXE
                  PID:5244
                • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                  "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,2785160816471222719,10485782845345815552,2097152 --field-trial-handle=1940,i,12000529377026856128,13205719285886638239,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
                  5⤵
                  • Executes dropped EXE
                  PID:2060
                • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                  "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3552,i,10925042611542981172,5956622186253197685,2097152 --field-trial-handle=1940,i,12000529377026856128,13205719285886638239,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
                  5⤵
                  • Executes dropped EXE
                  PID:5888
                • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                  "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,10150829146415412722,2976428766670528717,2097152 --field-trial-handle=1940,i,12000529377026856128,13205719285886638239,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:1
                  5⤵
                  • Executes dropped EXE
                  PID:4980
                • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                  "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,13294817683700991244,12455548982404054292,2097152 --field-trial-handle=1940,i,12000529377026856128,13205719285886638239,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:9
                  5⤵
                  • Executes dropped EXE
                  PID:2732
                • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                  "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,12712289820700526375,16967259689522809900,524288 --field-trial-handle=1940,i,12000529377026856128,13205719285886638239,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
                  5⤵
                  • Executes dropped EXE
                  PID:2748
                • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                  "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,12939611242441007636,17821240472179663511,524288 --field-trial-handle=1940,i,12000529377026856128,13205719285886638239,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
                  5⤵
                  • Executes dropped EXE
                  PID:6476
                • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                  "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,16318838521140164065,9315132247668754280,524288 --field-trial-handle=1940,i,12000529377026856128,13205719285886638239,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
                  5⤵
                  • Executes dropped EXE
                  PID:6484
                • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                  "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,6386147716084777458,16590613675807682106,524288 --field-trial-handle=1940,i,12000529377026856128,13205719285886638239,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:14
                  5⤵
                  • Executes dropped EXE
                  PID:6696
                • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                  "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3708,i,15006173537885771606,6097830783703270446,524288 --field-trial-handle=1940,i,12000529377026856128,13205719285886638239,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:14
                  5⤵
                  • Executes dropped EXE
                  PID:6284
                • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                  "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,13153140049994603218,17702544561336674019,524288 --field-trial-handle=1940,i,12000529377026856128,13205719285886638239,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:14
                  5⤵
                  • Executes dropped EXE
                  PID:6612
                • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                  "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,5976893842949239051,7485964198426530369,524288 --field-trial-handle=1940,i,12000529377026856128,13205719285886638239,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
                  5⤵
                  • Executes dropped EXE
                  PID:6656
                • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                  "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,16474934352416016767,15575052359313512705,524288 --field-trial-handle=1940,i,12000529377026856128,13205719285886638239,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:14
                  5⤵
                  • Executes dropped EXE
                  PID:6344
                • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                  "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3644,i,6397606810566070974,13385138920394590368,524288 --field-trial-handle=1940,i,12000529377026856128,13205719285886638239,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:14
                  5⤵
                  • Executes dropped EXE
                  PID:6392
                • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                  "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4732,i,5926350851653503564,15850181943753344632,524288 --field-trial-handle=1940,i,12000529377026856128,13205719285886638239,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:14
                  5⤵
                  • Executes dropped EXE
                  PID:6384
                • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                  "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,10663279952932608209,11405486939797903675,524288 --field-trial-handle=1940,i,12000529377026856128,13205719285886638239,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:14
                  5⤵
                  • Executes dropped EXE
                  PID:6932
                • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                  "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3784,i,7226614124044352113,13087576247509085613,524288 --field-trial-handle=1940,i,12000529377026856128,13205719285886638239,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
                  5⤵
                  • Executes dropped EXE
                  PID:6804
                • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                  "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,2369321909453241574,14634806430041077027,524288 --field-trial-handle=1940,i,12000529377026856128,13205719285886638239,262144 --variations-seed-version --mojo-platform-channel-handle=844 /prefetch:14
                  5⤵
                  • Executes dropped EXE
                  PID:6980
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4456 -s 2036
              3⤵
              • Program crash
              PID:6884
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4456 -ip 4456
          1⤵
            PID:6816
          • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
            "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --no-startup-window --win-session-start
            1⤵
            • Executes dropped EXE
            PID:6356
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k GPSvcGroup
            1⤵
              PID:6808

            Network

                  MITRE ATT&CK Enterprise v16

                  Reconnaissance

                  Resource Development

                  Initial Access

                  Execution

                  Persistence

                  Boot or Logon Autostart Execution

                  1
                  T1547

                  Registry Run Keys / Startup Folder

                  1
                  T1547.001

                  Browser Extensions

                  1
                  T1176

                  Event Triggered Execution

                  1
                  T1546

                  Change Default File Association

                  1
                  T1546.001

                  Privilege Escalation

                  Boot or Logon Autostart Execution

                  1
                  T1547

                  Registry Run Keys / Startup Folder

                  1
                  T1547.001

                  Event Triggered Execution

                  1
                  T1546

                  Change Default File Association

                  1
                  T1546.001

                  Defense Evasion

                  Modify Registry

                  5
                  T1112

                  Credential Access

                  Credentials from Password Stores

                  1
                  T1555

                  Credentials from Web Browsers

                  1
                  T1555.003

                  Unsecured Credentials

                  1
                  T1552

                  Credentials In Files

                  1
                  T1552.001

                  Discovery

                  Browser Information Discovery

                  1
                  T1217

                  Query Registry

                  5
                  T1012

                  System Information Discovery

                  5
                  T1082

                  System Location Discovery

                  1
                  T1614

                  System Language Discovery

                  1
                  T1614.001

                  System Time Discovery

                  1
                  T1124

                  Lateral Movement

                  Collection

                  Data from Local System

                  1
                  T1005

                  Command and Control

                  Exfiltration

                  Impact

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  ACROBR~1.EXE
                  • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE
                  • Size 328KB
                  • SHA256 a5f47d59b8d08fc85ee411ec2e1015fedda08fd4a6cae2bf7b3bb1a7db2ccb5e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ACROTE~1.EXE
                  • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
                  • Size 86KB
                  • SHA256 a46d1ffbe9114015050b2a778859c26248f8bab22d5d1a302b59373bc20c6b45
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ADOBEC~1.EXE
                  • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE
                  • Size 5.7MB
                  • SHA256 1ebe469c94c2c2a5acbc3927cef19dbe2f583ba3651a55623633891c4c05cc22
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ADelRCP.exe
                  • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe
                  • Size 175KB
                  • SHA256 1ad4c736829dbcb0fcc620fd897fe0941b9c01e14ccba5d18085b3ca0416ab66
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  RdrCEF.exe
                  • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe
                  • Size 9.4MB
                  • SHA256 3e815d583236b9cecd912fcc949a301d1e51b609cbb53a2285d08feea305edcd
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  AcroRd32.exe
                  • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
                  • Size 2.4MB
                  • SHA256 bd7696911d75a9a35dfd125b24cb95003f1e9598592df47fa23a2568986a4a9a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  WCCHRO~1.EXE
                  • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE
                  • Size 183KB
                  • SHA256 8ca27077312716f79f39309156c905719a908e8ded4bf88c2ba6fa821e574673
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Eula.exe
                  • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe
                  • Size 131KB
                  • SHA256 49091e1e41980b39d8de055fe6c6a1dc69398f17817960d64743e7efb740efc4
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  FULLTR~1.EXE
                  • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE
                  • Size 254KB
                  • SHA256 129a2bfe25ceabb871b65b645ef98f6799d7d273fc5ddfd33c1cb78f5b76fa3b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  LOGTRA~1.EXE
                  • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE
                  • Size 386KB
                  • SHA256 cae320401aa01a3cef836c191c2edbd7a96bfcce9efad1a21880626a64cc4dec
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  READER~1.EXE
                  • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE
                  • Size 92KB
                  • SHA256 7a8ee09f8a75b3e812f99a0b611c6720626c62c6985306a408694389a996c8e9
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  WOW_HE~1.EXE
                  • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE
                  • Size 147KB
                  • SHA256 686bec325444e43232fb20e96365bb1f1eb7c47a4e4ce246fc900d3a9784d436
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  arh.exe
                  • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe
                  • Size 125KB
                  • SHA256 9a7391267ab83b45a47d9fcf1e0f76002ed6640ed6a574ba51373410b94812f6
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  32BITM~1.EXE
                  • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE
                  • Size 142KB
                  • SHA256 a89d3e2109a8e35e263da363d3551258ea320a99bfb84a4b13ad563008eda8d9
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  64BITM~1.EXE
                  • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE
                  • Size 278KB
                  • SHA256 b8c5b99365f5ac318973b151fe3fe2a4ad12546371df69e1b7d749f7a4ce356f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ADOBEA~1.EXE
                  • Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE
                  • Size 454KB
                  • SHA256 f94ddaf929fb16d952b79c02e78439a10dd2faa78f7f66b7d52de2675e513103
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  AdobeARM.exe
                  • Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe
                  • Size 1.2MB
                  • SHA256 57329b38314923c17e9dd9e153e894708389dd597fcb1438d5291c7627238653
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  jaureg.exe
                  • Path C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe
                  • Size 555KB
                  • SHA256 38b06ee250af6554e6740a1bb7acfb77b99ccdb8081880e01c386afa98668766
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  VSTOIN~1.EXE
                  • Path C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE
                  • Size 121KB
                  • SHA256 53e47df12f0ce2005f4a2a773d194c9431b325b64c205dfa4cfba45c973b65f3
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  java.exe
                  • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe
                  • Size 325KB
                  • SHA256 80de06ea5d221e21f765a96750f821aaaf8eee23bfd9d8cde265a8da11041c66
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  javaw.exe
                  • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe
                  • Size 325KB
                  • SHA256 d2f956514bc885fed054dec3ad4c0e89e59a6a38390fa8432abd15eb201468b4
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  javaws.exe
                  • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe
                  • Size 505KB
                  • SHA256 97508a81b805937e1ca57711a51d2e8d715a2748e2f9d27d39dfecc28f3fb9e5
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  DISABL~1.EXE
                  • Path C:\PROGRA~2\Google\Update\DISABL~1.EXE
                  • Size 5.7MB
                  • SHA256 21719f3b636ac9d9a8b5ae3f1b15faf10a5110d2d75e0e4ca8e681160642e6ee
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MI9C33~1.EXE
                  • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MI9C33~1.EXE
                  • Size 138KB
                  • SHA256 a9d77f731e8692cfcd3477124c255e72895dd6e68770a9f19dda1de068ee60ff
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MIA062~1.EXE
                  • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MIA062~1.EXE
                  • Size 1.6MB
                  • SHA256 3bf8f8bc787886b5ae151e8f0b8d858dee96583e29f617c9266f8b9c4ec5efbb
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MICROS~1.EXE
                  • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MICROS~1.EXE
                  • Size 223KB
                  • SHA256 be1758299f11d1a94c5a61ede217d1cc6cb40f88345323e5034d056aef5a004c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MICROS~2.EXE
                  • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MICROS~2.EXE
                  • Size 242KB
                  • SHA256 47b1f496b82fd1812298b136d72b2806e906f12c72380f93b4effc037fc852c3
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MICROS~3.EXE
                  • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MICROS~3.EXE
                  • Size 138KB
                  • SHA256 7b78a87c3cc0d56f21ac09a12ad0c4b55109228b02e42e8c481dede1d3861c78
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MICROS~4.EXE
                  • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MICROS~4.EXE
                  • Size 256KB
                  • SHA256 9fb6defe4f640ad5b2d6e2be5d49e601b2ef04828997f0ff3fb83d8bd0e3ad34
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MID1AD~1.EXE
                  • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MID1AD~1.EXE
                  • Size 302KB
                  • SHA256 1c832a11ce5b6c02fbb5e6cbc04eac46f6de311989f8133eed7c50e2f48a8fb5
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MICROS~1.EXE
                  • Path C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MICROS~1.EXE
                  • Size 242KB
                  • SHA256 ef919063bb68d3d618e8ec5f8b5805f9a1c8da6a9535e4a25f399228c67b0aa3
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MICROS~4.EXE
                  • Path C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MICROS~4.EXE
                  • Size 223KB
                  • SHA256 7dedc8e32c846c52c1f7c6fd0d326791ef52e33707a3580cc7d70d470c6ebbcc
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ie_to_edge_stub.exe
                  • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\BHO\ie_to_edge_stub.exe
                  • Size 553KB
                  • SHA256 ec0a475d423140079ccf795ac5c8671a1b4211d317f781afb85c17fa3f600225
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  setup.exe
                  • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\INSTAL~1\setup.exe
                  • Size 6.8MB
                  • SHA256 ab7e749dace77246f7f2c2af0a138dc9104ef3c3833a293ab12853999b1ab65f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cookie_exporter.exe
                  • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\cookie_exporter.exe
                  • Size 157KB
                  • SHA256 ea8e043a8af5e2dfb2091844f70f5e1c7aae710a0645ea108a1db015b55e8df6
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  elevation_service.exe
                  • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\elevation_service.exe
                  • Size 1.7MB
                  • SHA256 a2523cc831659b237bcc32ca42b64fff36095f62b163c166f4b7e59100984a93
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  identity_helper.exe
                  • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\identity_helper.exe
                  • Size 1.2MB
                  • SHA256 2f094ffd3985ee30b9ca280dcfff8f5c7e61db139fc3d2371e78be738450a666
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  msedge.exe
                  • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedge.exe
                  • Size 3.9MB
                  • SHA256 9989311b0021ad7409263874b3db39f03d30ca9bfe5cac4a7f807b8557387ccf
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  msedge_proxy.exe
                  • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedge_proxy.exe
                  • Size 1.2MB
                  • SHA256 0b27c00c8d718a381efe87f8179564272a9e4ce155dfaf2341ec18a2bff1e670
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  msedge_pwa_launcher.exe
                  • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedge_pwa_launcher.exe
                  • Size 1.6MB
                  • SHA256 7fe3941a604717229077665bff0d25afc61240ce4ff126267b735d8b924bed0a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  msedgewebview2.exe
                  • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedgewebview2.exe
                  • Size 3.5MB
                  • SHA256 9d0f4a497db7604d3c9d3a2182d458f6091f6f567e957b72d4b0336d6a7c87e1
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  notification_helper.exe
                  • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\notification_helper.exe
                  • Size 1.4MB
                  • SHA256 4815845704f20b742fed62a8c0d6f08537bcd5900ffd6d63b459234b0e066143
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  pwahelper.exe
                  • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\pwahelper.exe
                  • Size 1.2MB
                  • SHA256 b8df4cea8ace0c0b15aa85aac22217a3721343f3ed26814b92ef816fb5305765
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ie_to_edge_stub.exe
                  • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\BHO\ie_to_edge_stub.exe
                  • Size 562KB
                  • SHA256 5ca66d0a92c97e353cbf7fc47246f2292fb9ec2966a4abf7a03ea4a8c8b406c5
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  setup.exe
                  • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\INSTAL~1\setup.exe
                  • Size 7.1MB
                  • SHA256 bcea62bcf7ac1a58399565cb993ff0d74e60b117760c809a6f82d1c4f50e2d41
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cookie_exporter.exe
                  • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\cookie_exporter.exe
                  • Size 155KB
                  • SHA256 7fc13ee7e85761659331398585b2d5bf08ecaa65077e162f748b2b97dd0b9152
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  elevated_tracing_service.exe
                  • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevated_tracing_service.exe
                  • Size 3.8MB
                  • SHA256 ffbd64f72a712f25934fae982a24bcf3f2be0ade3e54c4f606f0783722bb7d2f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  elevation_service.exe
                  • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevation_service.exe
                  • Size 2.2MB
                  • SHA256 71fa2d5fb7c3da809fc0e66b5c8e989bad16b443d24487cf4508cde7e2d8397d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  identity_helper.exe
                  • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\identity_helper.exe
                  • Size 1.4MB
                  • SHA256 2feba86fd7ed5264c069f66397b7f08d8f245233c0c7a8be563e6f9846f0723f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  msedge_pwa_launcher.exe
                  • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge_pwa_launcher.exe
                  • Size 1.8MB
                  • SHA256 dd17f95d51fc498b681629bf544553d67dbec4840265af2adcbec04d9ae70bdc
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  msedgewebview2.exe
                  • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedgewebview2.exe
                  • Size 3.4MB
                  • SHA256 8d98bbaa8691268632b5276bbb6a77437d28d0701c5ff083a306deebc3447a82
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  notification_click_helper.exe
                  • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\notification_click_helper.exe
                  • Size 1.6MB
                  • SHA256 dfca94b2e75cd8f292a3ee853ca77083dfdd196e7dbc2f52f80f59e77716d87b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MSEDGE~1.EXE
                  • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE
                  • Size 1.5MB
                  • SHA256 d6a52fc33703813fe2e2a549aa212fa07900d6677aece66832ae294b1f04f51a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  PWAHEL~1.EXE
                  • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE
                  • Size 1.4MB
                  • SHA256 6d3f80c24e7f9f0b5d8ecaa6f54c4f047578b8deef5f5dd71748074c3bd68ea0
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  msedge.exe
                  • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                  • Size 4.0MB
                  • SHA256 a0bf37dcf76b6bcb0e1b4a13cb525ea70d88a2a8eac4f9b1c75f79c04b7e3b09
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  msedge.exe
                  • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                  • Size 3.9MB
                  • SHA256 6d8e5d6a4d1c147b90b5a394a5054840e19dfa3eae3ea706ffb367477cecb929
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  settings.dat
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                  • Size 280B
                  • SHA256 719f844e62c5a3916fba05dc2f32d02dadec54c424efb41ba161d1fca59227ae
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  settings.dat
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                  • Size 280B
                  • SHA256 67b546fed422708faf33930b82ff4826bc323bc64f67af30b02bb9e565fa27ee
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  the-real-index
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                  • Size 2KB
                  • SHA256 bcbc2902368cfcb651be01a004cc8efb44082e79d75d0f3ff9d512b5cc93cf13
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  the-real-index~RFe5ab344.TMP
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5ab344.TMP
                  • Size 2KB
                  • SHA256 9cb621676c9d7093fca7ff78c29f168426b6150304185144eeaf1008662a79df
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  SiteList-Enterprise.json
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                  • Size 2B
                  • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                  • MD5 SHA1 SHA512
                  Submit Download

                  Edge Profile.ico
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                  • Size 70KB
                  • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Network Persistent State
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                  • Size 2KB
                  • SHA256 c96e1d6b3aa3cd6a637cd0007fe8ba3bed0ab5ef6e9fde6fb6fe61cbe71cb0d1
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  SCT Auditing Pending Reports
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                  • Size 2B
                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                  • MD5 SHA1 SHA512
                  Submit Download

                  Sdch Dictionaries
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                  • Size 40B
                  • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                  • MD5 SHA1 SHA512
                  Submit Download

                  Preferences
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                  • Size 12KB
                  • SHA256 46b42ccf911ed3ac8fc0b513f5b69ac6b17b5f57d977d5854ddb4d9690d4b6ca
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Preferences
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                  • Size 12KB
                  • SHA256 a334b0632df42748158e6d30a07847c8d19f29c59381817160aede5912b3134c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Preferences
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                  • Size 12KB
                  • SHA256 d870020ca3a0d4ef7ca934519ac11e84d1f63fec4253bd31f640660d6cfd713a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Secure Preferences
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                  • Size 29KB
                  • SHA256 beebb87f5e76cd0dc3c35572a34cd68bd317498e2bc589e5f3e9473b095200aa
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  OperationConfig
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                  • Size 22KB
                  • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  OperationConfig~RFe5b442a.TMP
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5b442a.TMP
                  • Size 3KB
                  • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Local State
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                  • Size 28KB
                  • SHA256 8d105ccb9cabe347f317782c99bbd6786509e7046c501192e7177044cbff4cf5
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Local State
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                  • Size 36KB
                  • SHA256 ec30f08ce408330d420dbde04ea4932875dc919acf06bc277814627805d62015
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Local State
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                  • Size 36KB
                  • SHA256 280765e24493d4f626648ba843803d919768a1efea8b5929131d7eb2b5233269
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Local State
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                  • Size 28KB
                  • SHA256 d83a85f1e3ff84a25e78f6f8b9c981b2cab25eae09bf3da2bc613f9df7c29382
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Local State
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                  • Size 34KB
                  • SHA256 a5b40b0f4fac15b6fc2cd5548f9c27d271f626cb52f9d771dad8ea7d7e38c86a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Local State
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                  • Size 36KB
                  • SHA256 783d465a717192435cf2b8c19685277cc5d2ead2a4f9b57a4371fffea6fec17e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Local State
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                  • Size 35KB
                  • SHA256 0a61376f55d49d0f9fa2ae205b6c0bd1aa398030f46cb30c21b83bd2f2491ac6
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  metadata.json
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                  • Size 132B
                  • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
                  • Size 154KB
                  • SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  metadata.json
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                  • Size 132B
                  • SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  metadata.json
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                  • Size 13B
                  • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                  • MD5 SHA1 SHA512
                  Submit Download

                  86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
                  • Size 16KB
                  • SHA256 aa088dd73dbe3802f270ec00c1a87bc1396a397eedbfd19d7e6b7d0b4860a364
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  webext.sc.lz4
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\00wjakap.default-release\startupCache\webext.sc.lz4
                  • Size 104KB
                  • SHA256 23ccd2b7584514c09e9220779d55f4f059cdfeb93d7e0793c79d9b65ad8daec7
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  17d132e3-afc2-4501-a713-99f4b0e6b556.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\17d132e3-afc2-4501-a713-99f4b0e6b556.tmp
                  • Size 1B
                  • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                  • MD5 SHA1 SHA512
                  Submit Download

                  2026-08-24_4844b4e7165e73309ac126b9dce3f948_darkgate_elex_glassworm_hijackloader_remcos_stop.exe
                  • Path C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-24_4844b4e7165e73309ac126b9dce3f948_darkgate_elex_glassworm_hijackloader_remcos_stop.exe
                  • Size 5.8MB
                  • SHA256 33dfdc8e05387e487d3d6e01bc77d1b83423f2b70526bc0c561fc353c951221d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  content_new.js
                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3988_1335079523\CRX_INSTALL\content_new.js
                  • Size 10KB
                  • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  tmpaddon
                  • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                  • Size 11KB
                  • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  tmpaddon
                  • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                  • Size 502KB
                  • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  data.safe.tmp
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.tmp
                  • Size 32KB
                  • SHA256 84b7202b779f14d5195aa4fbb4bc943585485188ab52e285e4155e19a7909020
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  data.safe.tmp
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.tmp
                  • Size 7KB
                  • SHA256 ed8d1c602a2a1a1bfed01b63613b280e75470bcd530df20d7d0d196deb926cab
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  data.safe.tmp
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.tmp
                  • Size 32KB
                  • SHA256 e3793603d2e5d108f23ecb572517e98d2f17c84a886557b0e7056ab4bec8b4cd
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  data.safe.tmp
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\db\data.safe.tmp
                  • Size 6KB
                  • SHA256 804f1a7d71d0a66b1d1287544b8b6cbd37dcc835164c87ae9676548adf889b62
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  events
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\events\events
                  • Size 1KB
                  • SHA256 37d17755b14e67ac0eca8603fe1fcec6f666a91d0afb94c57b6eef258064a355
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  39291a00-2134-46a2-9c43-a707b8e95862
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\39291a00-2134-46a2-9c43-a707b8e95862
                  • Size 235B
                  • SHA256 acd7a25c162607a4ac2cce92017ade858555297e346051eda0d7e6286a6e2003
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  4b51a9a0-d319-4b04-90e6-95238fb704d1
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\4b51a9a0-d319-4b04-90e6-95238fb704d1
                  • Size 16KB
                  • SHA256 31f43e718464671ee5327a3423be42846973f1bb7c31c9dda93344b3ecf9bd1c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  5277bc82-9a15-4acd-b5ac-100437e2f020
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\5277bc82-9a15-4acd-b5ac-100437e2f020
                  • Size 886B
                  • SHA256 483fed0363ce676dc3f51fb69cedf018a4df145c1cdb9678e6ade65f731a75b5
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  860970cb-ff28-4ca6-b941-9bdee80984f8
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\860970cb-ff28-4ca6-b941-9bdee80984f8
                  • Size 883B
                  • SHA256 9181bb6f0d03b95401b6aba4be398fcd7d4d2d7ce03a96e417f0a0331f472094
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  9402821a-5196-48d8-865b-8ea4148436be
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\9402821a-5196-48d8-865b-8ea4148436be
                  • Size 235B
                  • SHA256 486706ff7c8269fdc6ba948a47d4eaeb470e1ccf4a9dc2bd61fb8e0ba6f6d2e8
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  cc882e43-0541-495a-bffd-6a1273a2fcbe
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\datareporting\glean\pending_pings\cc882e43-0541-495a-bffd-6a1273a2fcbe
                  • Size 2KB
                  • SHA256 68322ff8c32c1338fd8a174441dc1d3802625de4f4fa5132509e6aca21c72076
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  extensions.json
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\extensions.json
                  • Size 16KB
                  • SHA256 4e915b164c6faf5b0cd2cb0073d31c38244a49be259f570ff3befb5514923902
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  gmpopenh264.dll
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                  • Size 1.1MB
                  • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  gmpopenh264.info
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                  • Size 116B
                  • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  manifest.json
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
                  • Size 1002B
                  • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  widevinecdm.dll
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
                  • Size 21.6MB
                  • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  prefs-1.js
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\prefs-1.js
                  • Size 7KB
                  • SHA256 558e162a01b2b28219e7dbe2bd3efdb3ac2ac30b380fdce106ec9bf2e6bda49e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  prefs-1.js
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\prefs-1.js
                  • Size 6KB
                  • SHA256 40139c47a61dbd2a4bbb912f209396dbbaa74e1010d9c3e80c3a238ae56bf2b1
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  prefs.js
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\prefs.js
                  • Size 6KB
                  • SHA256 5fb7bf29e28ea59552ee1e760c72a0c3a5ca8130478dab6128b43679d54e3c21
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  prefs.js
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\prefs.js
                  • Size 7KB
                  • SHA256 97f345666a7007f943ff425712dc8dd3dbb57b021f8ea5a70eb9601de2db4bfe
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  recovery.baklz4
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\sessionstore-backups\recovery.baklz4
                  • Size 4KB
                  • SHA256 a7b87204cbe56c8b05edece048d0bc84d57c3594e01f9c8f91f4a9659bb11391
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  recovery.jsonlz4
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\sessionstore-backups\recovery.jsonlz4
                  • Size 4KB
                  • SHA256 7184cbb5c535618f1a218383a8eb82becdd135abcefcf9b70d848f443d29b199
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  3870112724rsegmnoittet-es.sqlite
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                  • Size 6.6MB
                  • SHA256 73b27ccdf06166f31c38853aeb8117c5e5fae8e674f83c2944731ece6432c939
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  3870112724rsegmnoittet-es.sqlite
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                  • Size 7.4MB
                  • SHA256 36020df92d70547fc1b4f435b86598e84c37594eaf01ff40582a593b5ae41b68
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  3870112724rsegmnoittet-es.sqlite
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                  • Size 5.0MB
                  • SHA256 70ca841d6b6dc4186a0e32319f302f51d18080824a69f6f4f9da558d6d4504ce
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  directx.sys
                  • Path C:\Windows\directx.sys
                  • Size 34B
                  • SHA256 b33200e2c157ba1d66f336dcc9cfb6afbeab553554f955aac5f9f522d69418f7
                  • MD5 SHA1 SHA512
                  Submit Download

                  directx.sys
                  • Path C:\Windows\directx.sys
                  • Size 34B
                  • SHA256 8083b6294f20a9b1ffe3de2760d729323ab692aeebc91e4dfaf907b03b6577af
                  • MD5 SHA1 SHA512
                  Submit Download

                  directx.sys
                  • Path C:\Windows\directx.sys
                  • Size 47B
                  • SHA256 1ca11ed09e232331ff2d75bce2948f38a3149c592bd059c18380b266d56a26ec
                  • MD5 SHA1 SHA512
                  Submit Download

                  svchost.com
                  • Path C:\Windows\svchost.com
                  • Size 40KB
                  • SHA256 73fb79499846eb7959319d34fa660e6115653482725dd234417101053e704813
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  memory/480-199-0x0000000000400000-0x000000000041B000-memory.dmp
                  Download

                  memory/480-780-0x0000000000400000-0x000000000041B000-memory.dmp
                  Download

                  memory/480-508-0x0000000000400000-0x000000000041B000-memory.dmp
                  Download

                  memory/480-734-0x0000000000400000-0x000000000041B000-memory.dmp
                  Download

                  memory/480-968-0x0000000000400000-0x000000000041B000-memory.dmp
                  Download

                  memory/480-656-0x0000000000400000-0x000000000041B000-memory.dmp
                  Download

                  memory/560-731-0x0000000000400000-0x000000000041B000-memory.dmp
                  Download

                  memory/1172-647-0x000001E8B74E0000-0x000001E8B84E0000-memory.dmp
                  Download

                  memory/1196-646-0x000001A2A9C90000-0x000001A2AAC90000-memory.dmp
                  Download

                  memory/1588-237-0x0000000000400000-0x000000000041B000-memory.dmp
                  Download

                  memory/1588-907-0x0000000000400000-0x000000000041B000-memory.dmp
                  Download

                  memory/1588-784-0x0000000000400000-0x000000000041B000-memory.dmp
                  Download

                  memory/1588-732-0x0000000000400000-0x000000000041B000-memory.dmp
                  Download

                  memory/1588-657-0x0000000000400000-0x000000000041B000-memory.dmp
                  Download

                  memory/1800-659-0x00000233B7590000-0x00000233B8590000-memory.dmp
                  Download

                  memory/2060-875-0x00007FFA26F70000-0x00007FFA26F71000-memory.dmp
                  Download

                  memory/2268-222-0x0000000000400000-0x000000000041B000-memory.dmp
                  Download

                  memory/2700-730-0x0000000000400000-0x000000000041B000-memory.dmp
                  Download

                  memory/2820-740-0x0000020819700000-0x000002081A700000-memory.dmp
                  Download

                  memory/2936-720-0x0000000000400000-0x000000000041B000-memory.dmp
                  Download

                  memory/3144-686-0x000001858C1D0000-0x000001858D1D0000-memory.dmp
                  Download

                  memory/3440-1735-0x0000020A70030000-0x0000020A70122000-memory.dmp
                  Download

                  memory/3440-722-0x0000020A70030000-0x0000020A70122000-memory.dmp
                  Download

                  memory/3440-644-0x0000020A704F0000-0x0000020A714F0000-memory.dmp
                  Download

                  memory/3440-1546-0x0000020A70030000-0x0000020A70122000-memory.dmp
                  Download

                  memory/3440-1025-0x0000020A70030000-0x0000020A70122000-memory.dmp
                  Download

                  memory/3440-643-0x0000020A70030000-0x0000020A70122000-memory.dmp
                  Download

                  memory/3440-1908-0x0000020A70030000-0x0000020A70122000-memory.dmp
                  Download

                  memory/3440-742-0x0000020A70030000-0x0000020A70122000-memory.dmp
                  Download

                  memory/3440-1763-0x0000020A70030000-0x0000020A70122000-memory.dmp
                  Download

                  memory/3440-217-0x0000020A01690000-0x0000020A016A0000-memory.dmp
                  Download

                  memory/3440-1610-0x0000020A70030000-0x0000020A70122000-memory.dmp
                  Download

                  memory/3440-1872-0x0000020A70030000-0x0000020A70122000-memory.dmp
                  Download

                  memory/3440-1843-0x0000020A70030000-0x0000020A70122000-memory.dmp
                  Download

                  memory/3440-216-0x0000020A01690000-0x0000020A016A0000-memory.dmp
                  Download

                  memory/3440-673-0x0000020A0B350000-0x0000020A0B360000-memory.dmp
                  Download

                  memory/3440-219-0x0000020A01690000-0x0000020A016A0000-memory.dmp
                  Download

                  memory/3440-1802-0x0000020A70030000-0x0000020A70122000-memory.dmp
                  Download

                  memory/3440-1777-0x0000020A70030000-0x0000020A70122000-memory.dmp
                  Download

                  memory/3484-721-0x0000000000400000-0x000000000041B000-memory.dmp
                  Download

                  memory/3724-739-0x0000028575A00000-0x0000028576A00000-memory.dmp
                  Download

                  memory/4260-688-0x000002BAC0B90000-0x000002BAC1B90000-memory.dmp
                  Download

                  memory/5072-828-0x0000000000400000-0x000000000041B000-memory.dmp
                  Download

                  memory/5244-863-0x00007FFA26F70000-0x00007FFA26F71000-memory.dmp
                  Download

                  memory/5244-1529-0x000001CF879C0000-0x000001CF87B83000-memory.dmp
                  Download

                  memory/5292-741-0x000001B1E9A00000-0x000001B1EAA00000-memory.dmp
                  Download

                  memory/5388-658-0x00000169A8250000-0x00000169A9250000-memory.dmp
                  Download

                  memory/5440-645-0x000001E047400000-0x000001E048400000-memory.dmp
                  Download

                  memory/5440-243-0x00007FFA26F70000-0x00007FFA26F71000-memory.dmp
                  Download

                  memory/6932-1832-0x00000221BFBD0000-0x00000221BFD93000-memory.dmp
                  Download