Overview

overview

10

Static

static

10

2026-09-12...op.exe

windows10-2004-x64

10

2026-09-12...op.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    12/09/2026, 16:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
  • Size 6.0MB
  • Sample260912-tvb46aee28
  • SHA256 235fab12b509c0fb7e4e9b215ae6d205b2a0e1a08419f1c8cd20ade528ed2482
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarebackdoordefense_evasiondiscoveryfloxifpersistenceprivilege_escalationspywarestealertrojanupx

Malware Config

Signatures

  • Family: Floxif, Floodfix

    Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

    backdoortrojanfloxif
  • Detects Floxif payload 1 IoCs
    backdoor
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 4 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 4 IoCs
  • UPX dump on OEP (original entry point) 12 IoCs
  • Event Triggered Execution: AppInit DLLs 1 TTPs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Drops desktop.ini file(s) 3 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 5 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 21 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 22 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 1 IoCs
  • Modifies registry class 18 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-12_dbea41d61168570c6e7b9681e50c145f_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Enumerates connected drives
    • Installs/modifies Browser Helper Object
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3208
    • C:\Windows\system32\regsvr32.exe
      C:\Windows\Sysnative\regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
      2⤵
        PID:3032
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3108
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
          3⤵
          • Drops desktop.ini file(s)
          • Checks processor information in registry
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2552
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1956 -prefsLen 27097 -prefMapHandle 1960 -prefMapSize 270279 -ipcHandle 2044 -initialChannelId {15a30dc7-c42d-4b9d-a567-da5c192cd624} -parentPid 2552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2552" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
            4⤵
              PID:948
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2420 -prefsLen 27133 -prefMapHandle 2424 -prefMapSize 270279 -ipcHandle 2432 -initialChannelId {835b83f0-e1bc-428a-97de-769e5d205bde} -parentPid 2552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2552" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
              4⤵
                PID:4828
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3988 -prefsLen 25213 -prefMapHandle 3992 -prefMapSize 270279 -jsInitHandle 3996 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4004 -initialChannelId {a48fb7b2-52fb-4cf6-8dd6-7074333fee77} -parentPid 2552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2552" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
                4⤵
                • Checks processor information in registry
                PID:2712
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4168 -prefsLen 27323 -prefMapHandle 4172 -prefMapSize 270279 -ipcHandle 4256 -initialChannelId {7748356e-fe1f-4f0d-96a5-458ee216a76b} -parentPid 2552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2552" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
                4⤵
                  PID:5780
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2932 -prefsLen 34822 -prefMapHandle 2720 -prefMapSize 270279 -jsInitHandle 2924 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3188 -initialChannelId {d10a4c41-7a91-4eed-82b0-cc6713cc781e} -parentPid 2552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2552" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                  4⤵
                  • Checks processor information in registry
                  PID:6016
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5084 -prefsLen 35010 -prefMapHandle 5088 -prefMapSize 270279 -ipcHandle 5104 -initialChannelId {de26a046-1746-452d-ab29-fcba688fdfba} -parentPid 2552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2552" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
                  4⤵
                  • Checks processor information in registry
                  PID:5032
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4764 -prefsLen 35062 -prefMapHandle 1616 -prefMapSize 270279 -jsInitHandle 1620 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1396 -initialChannelId {ae294fcd-91af-45e8-87fb-90396457881a} -parentPid 2552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2552" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
                  4⤵
                  • Checks processor information in registry
                  PID:5324
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3400 -prefsLen 32952 -prefMapHandle 3008 -prefMapSize 270279 -jsInitHandle 2816 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1628 -initialChannelId {43fbd685-c1ea-457d-baa4-d812f83ee3e8} -parentPid 2552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2552" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                  4⤵
                  • Checks processor information in registry
                  PID:2352
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5768 -prefsLen 32952 -prefMapHandle 5772 -prefMapSize 270279 -jsInitHandle 5776 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5784 -initialChannelId {6f1c2e2e-59f0-44d0-b6e2-29fbeb9ca4f7} -parentPid 2552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2552" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                  4⤵
                  • Checks processor information in registry
                  PID:3316
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5976 -prefsLen 32952 -prefMapHandle 5980 -prefMapSize 270279 -jsInitHandle 5984 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5992 -initialChannelId {82993c99-3c6a-4488-a3d6-e5e1af560fba} -parentPid 2552 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2552" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
                  4⤵
                  • Checks processor information in registry
                  PID:5052
            • C:\Windows\SysWOW64\regsvr32.exe
              "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
              2⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:3572
            • C:\Windows\SysWOW64\regsvr32.exe
              "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"
              2⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:1076
            • C:\Windows\SysWOW64\regsvr32.exe
              "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"
              2⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:1996
            • C:\Windows\SysWOW64\regsvr32.exe
              "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"
              2⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:5400
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.internetdownloadmanager.com/welcome.html?v=643b10
              2⤵
              • Drops file in Windows directory
              • Enumerates system info in registry
              • Modifies data under HKEY_USERS
              • Modifies registry class
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:3548
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x35c,0x7ff95d04c188,0x7ff95d04c194,0x7ff95d04c1a0
                3⤵
                  PID:5024
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,1132542655456512026,6742607595164361167,262144 --field-trial-handle=2324,i,4527213679779794543,7009668346767002630,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
                  3⤵
                    PID:5500
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,13046243124481836192,10112046024811220332,524288 --field-trial-handle=2324,i,4527213679779794543,7009668346767002630,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:11
                    3⤵
                    • System Time Discovery
                    PID:2712
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2380,i,12049762659295655198,9402719103883270970,524288 --field-trial-handle=2324,i,4527213679779794543,7009668346767002630,262144 --variations-seed-version --mojo-platform-channel-handle=3188 /prefetch:13
                    3⤵
                      PID:5840
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,9081062431565605146,3128191428424093508,2097152 --field-trial-handle=2324,i,4527213679779794543,7009668346767002630,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
                      3⤵
                        PID:4332
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3652,i,13464724701659858161,9940298682360625553,2097152 --field-trial-handle=2324,i,4527213679779794543,7009668346767002630,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:1
                        3⤵
                          PID:1916
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,542293064276190796,1148404235477340478,2097152 --field-trial-handle=2324,i,4527213679779794543,7009668346767002630,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:1
                          3⤵
                            PID:2156
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4332,i,89629148578100714,11497119642326394828,2097152 --field-trial-handle=2324,i,4527213679779794543,7009668346767002630,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:9
                            3⤵
                              PID:2348
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,7181411229906644510,12933261868255503974,524288 --field-trial-handle=2324,i,4527213679779794543,7009668346767002630,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
                              3⤵
                                PID:1936
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,4203200406144382032,15236112137216318075,524288 --field-trial-handle=2324,i,4527213679779794543,7009668346767002630,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:14
                                3⤵
                                  PID:1508
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,9434365812700478338,4688781232742930034,524288 --field-trial-handle=2324,i,4527213679779794543,7009668346767002630,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
                                  3⤵
                                    PID:1460
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,9614774526903222820,1984903097050193152,524288 --field-trial-handle=2324,i,4527213679779794543,7009668346767002630,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
                                    3⤵
                                      PID:5288
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,9614774526903222820,1984903097050193152,524288 --field-trial-handle=2324,i,4527213679779794543,7009668346767002630,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
                                      3⤵
                                        PID:804
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,16434550660151278074,12273248579437217318,524288 --field-trial-handle=2324,i,4527213679779794543,7009668346767002630,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
                                        3⤵
                                          PID:4864
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,14281373029839169138,17423926492225367117,524288 --field-trial-handle=2324,i,4527213679779794543,7009668346767002630,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:14
                                          3⤵
                                            PID:5020
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,8469101801434783346,8049186165041049149,524288 --field-trial-handle=2324,i,4527213679779794543,7009668346767002630,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
                                            3⤵
                                              PID:804
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,5276632738415461831,5845382374264502998,524288 --field-trial-handle=2324,i,4527213679779794543,7009668346767002630,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:14
                                              3⤵
                                                PID:2484
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,3053726586734010170,3008762566573144934,524288 --field-trial-handle=2324,i,4527213679779794543,7009668346767002630,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:14
                                                3⤵
                                                  PID:4632
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3468,i,14250127992688632618,16434969932866641917,524288 --field-trial-handle=2324,i,4527213679779794543,7009668346767002630,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:14
                                                  3⤵
                                                    PID:4652
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,8526487002270543789,4996040299046847299,524288 --field-trial-handle=2324,i,4527213679779794543,7009668346767002630,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:14
                                                    3⤵
                                                      PID:5924
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,10597463936979945232,9178417697195491418,524288 --field-trial-handle=2324,i,4527213679779794543,7009668346767002630,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:14
                                                      3⤵
                                                        PID:5664
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,8058280984856479846,8308276747023907652,524288 --field-trial-handle=2324,i,4527213679779794543,7009668346767002630,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:14
                                                        3⤵
                                                          PID:696
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                      1⤵
                                                        PID:3176
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                        1⤵
                                                          PID:1340

                                                        Network

                                                              MITRE ATT&CK Enterprise v16

                                                              Reconnaissance

                                                              Resource Development

                                                              Initial Access

                                                              Execution

                                                              Persistence

                                                              Boot or Logon Autostart Execution

                                                              1
                                                              T1547

                                                              Registry Run Keys / Startup Folder

                                                              1
                                                              T1547.001

                                                              Browser Extensions

                                                              1
                                                              T1176

                                                              Event Triggered Execution

                                                              1
                                                              T1546

                                                              AppInit DLLs

                                                              1
                                                              T1546.010

                                                              Privilege Escalation

                                                              Boot or Logon Autostart Execution

                                                              1
                                                              T1547

                                                              Registry Run Keys / Startup Folder

                                                              1
                                                              T1547.001

                                                              Event Triggered Execution

                                                              1
                                                              T1546

                                                              AppInit DLLs

                                                              1
                                                              T1546.010

                                                              Defense Evasion

                                                              Modify Registry

                                                              3
                                                              T1112

                                                              Credential Access

                                                              Credentials from Password Stores

                                                              1
                                                              T1555

                                                              Credentials from Web Browsers

                                                              1
                                                              T1555.003

                                                              Unsecured Credentials

                                                              1
                                                              T1552

                                                              Credentials In Files

                                                              1
                                                              T1552.001

                                                              Discovery

                                                              Browser Information Discovery

                                                              1
                                                              T1217

                                                              Peripheral Device Discovery

                                                              1
                                                              T1120

                                                              Query Registry

                                                              4
                                                              T1012

                                                              System Information Discovery

                                                              5
                                                              T1082

                                                              System Location Discovery

                                                              1
                                                              T1614

                                                              System Language Discovery

                                                              1
                                                              T1614.001

                                                              System Time Discovery

                                                              1
                                                              T1124

                                                              Lateral Movement

                                                              Collection

                                                              Data from Local System

                                                              1
                                                              T1005

                                                              Command and Control

                                                              Exfiltration

                                                              Impact

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads

                                                              symsrv.dll
                                                              • Path C:\Program Files\Common Files\System\symsrv.dll
                                                              • Size 67KB
                                                              • SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              symsrv.dll.000
                                                              • Path C:\Program Files\Common Files\System\symsrv.dll.000
                                                              • Size 114B
                                                              • SHA256 aefc503b1ed462d7b6280228a7b5b710792273b78934426f88325341ac5b5a92
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              settings.dat
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                              • Size 280B
                                                              • SHA256 91a032a4ffcdd10503afdeb5220904a7e7cea899c3a55606bb3e90180ed9472e
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              settings.dat
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                              • Size 280B
                                                              • SHA256 59619e39464102fa53912dd9a15237954c5125d546c48a72b8bdb58ad9eb9753
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              BookmarkMergedSurfaceOrdering
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                              • Size 6B
                                                              • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              the-real-index
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                              • Size 2KB
                                                              • SHA256 8e6e3494bf27022093f9ecd3d29ce3a6ad5cef3f94e00f4abc1692c24f968a6d
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              the-real-index~RFe59e872.TMP
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59e872.TMP
                                                              • Size 2KB
                                                              • SHA256 564d30660f05d814889c3cbeb2b5ccfcd113c5f22257bbd538940b739b1aba72
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              SiteList-Enterprise.json
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                              • Size 2B
                                                              • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              Edge Profile.ico
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                              • Size 70KB
                                                              • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Network Persistent State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                              • Size 2KB
                                                              • SHA256 0d8c9e6c04a07f5c0431a42ddec481715073da355d2cfab9c301dd5624a02a2f
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              SCT Auditing Pending Reports
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                              • Size 2B
                                                              • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              cbc708e1-61c9-428a-a102-fabea0b28f99.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\cbc708e1-61c9-428a-a102-fabea0b28f99.tmp
                                                              • Size 40B
                                                              • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              Preferences
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                              • Size 11KB
                                                              • SHA256 8c092b851c3f99bbfac4b45130f0cf490a00af88266998f9f326f83869c99e19
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Preferences
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                              • Size 11KB
                                                              • SHA256 6eb117dc2b5f02eaf67317d384c367193c7eb08baf39d61ebe3643e3f267e020
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Secure Preferences
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                              • Size 29KB
                                                              • SHA256 e26dac31cc4bd43e7c874399fd5c484c0d03c5c493f1649f2c874d662f978f9f
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              sync_diagnostic.log
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                              • Size 6KB
                                                              • SHA256 ebbd0187a4fbb02d3e83eddea4d7c34e58197341ebbfb14fba7c24244e47ddfb
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              1468b0de-52e4-48d3-8642-ff57f587621c.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1468b0de-52e4-48d3-8642-ff57f587621c.tmp
                                                              • Size 22KB
                                                              • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 43KB
                                                              • SHA256 f444b6624d52440ff8dacfe7eb7c4c7571149d60cd283b003a565c919943f988
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 34KB
                                                              • SHA256 c8feb0b07360e0dafc59e28a705eb4ea34cfe67950e6de832e7e5b8e1298f1fa
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 38KB
                                                              • SHA256 d91d79528793baf4ba2bf82d27b195583b9d0e808dff620a5825368079ec8773
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 40KB
                                                              • SHA256 6f69951c474add9f821e4bd53a32c47298fa247f3df860f43f3725bb72569887
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              metadata.json
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                              • Size 132B
                                                              • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              metadata.json
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                              • Size 252B
                                                              • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              393286f4-9e5c-4c76-9472-88a521fa433f.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\393286f4-9e5c-4c76-9472-88a521fa433f.tmp
                                                              • Size 13B
                                                              • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              webext.sc.lz4
                                                              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\startupCache\webext.sc.lz4
                                                              • Size 105KB
                                                              • SHA256 ac95199a2cac33b15bd166ae2ce2bfbb2fcd547b7a84b71a8f1b5ceac169e598
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              content_new.js
                                                              • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3548_2134540468\CRX_INSTALL\content_new.js
                                                              • Size 10KB
                                                              • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              tmpaddon
                                                              • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                              • Size 11KB
                                                              • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              tmpaddon
                                                              • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                              • Size 502KB
                                                              • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              compatibility.ini
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\compatibility.ini
                                                              • Size 198B
                                                              • SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              data.safe.tmp
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\datareporting\glean\db\data.safe.tmp
                                                              • Size 7KB
                                                              • SHA256 c3350c1022b3b5f653a46f253bc113ce9f82fcde67f1727b72d13185ab65ec00
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              events
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\datareporting\glean\events\events
                                                              • Size 1KB
                                                              • SHA256 ac24b9a119c384a314c2830cad5de9e83af2155b2cde5e88985dc9ed8e88e7cc
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              00853dc4-e753-4de1-9c78-7f1d723ee656
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\datareporting\glean\pending_pings\00853dc4-e753-4de1-9c78-7f1d723ee656
                                                              • Size 883B
                                                              • SHA256 d6fe80adc51fb993525a6da4968f56d6c2503bb6294868ea8e67d822f5646eac
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              05ae1548-2658-47d6-9abf-a3c723051b45
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\datareporting\glean\pending_pings\05ae1548-2658-47d6-9abf-a3c723051b45
                                                              • Size 2KB
                                                              • SHA256 2d6f3416dff092c45f123888f0f742247efec1a9db9248cf47139cd6741de5a6
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              0ae0efc6-7b36-47df-9010-ea99efcd5903
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\datareporting\glean\pending_pings\0ae0efc6-7b36-47df-9010-ea99efcd5903
                                                              • Size 886B
                                                              • SHA256 3ea45da347ee94b6a2005213fe6b28e999395bfbfb2585a32a48196eea85feec
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              1c24a341-6bf6-4dd5-9098-81eb74a59545
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\datareporting\glean\pending_pings\1c24a341-6bf6-4dd5-9098-81eb74a59545
                                                              • Size 235B
                                                              • SHA256 c0b4d85facaa1db212c04b0b65cd01d684b6873b40b73d7d69b64884511b296f
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              8080a584-d8b9-48e9-919f-7fe61594c9c7
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\datareporting\glean\pending_pings\8080a584-d8b9-48e9-919f-7fe61594c9c7
                                                              • Size 235B
                                                              • SHA256 99751fc62b65b1d11942f047878fda172fa83d374b7e96fa738b92ef44b96752
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              dacb63fa-844a-44b1-922f-63e11081b082
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\datareporting\glean\pending_pings\dacb63fa-844a-44b1-922f-63e11081b082
                                                              • Size 16KB
                                                              • SHA256 501c283cfdda3be977489106c6d997d95a3979d2fae61d7a177d0241f9b5bd6a
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              extensions.json
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\extensions.json
                                                              • Size 16KB
                                                              • SHA256 ea430b32f557694e13b2ebb060ef67c22cc49d658605b5fe79d00f6760a3c9bb
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              gmpopenh264.dll
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                                                              • Size 1.1MB
                                                              • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              gmpopenh264.info
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                                                              • Size 116B
                                                              • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              manifest.json
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
                                                              • Size 1002B
                                                              • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              widevinecdm.dll
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
                                                              • Size 21.6MB
                                                              • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              prefs-1.js
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\prefs-1.js
                                                              • Size 8KB
                                                              • SHA256 6e7880a996649aa01b3f31e92986e57e1b6881ca8d4c02face318b4094de4866
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              prefs-1.js
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\prefs-1.js
                                                              • Size 7KB
                                                              • SHA256 e50fd883d5c69d006853514d252222ba31e6e8446811a44af435499ce0216767
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              prefs.js
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\prefs.js
                                                              • Size 6KB
                                                              • SHA256 e414acf4eecc3ba65c7858193b6a3c771c29be3cf38aae40e3cd0dcc4eefcb7b
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              prefs.js
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\prefs.js
                                                              • Size 6KB
                                                              • SHA256 916c5d96b1d3684be88b1a14c988078382c1248d4c000e3cd303479f7d970b13
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              recovery.baklz4
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\sessionstore-backups\recovery.baklz4
                                                              • Size 4KB
                                                              • SHA256 b8b167f0406e2fc93ac08f5e0d4430bc4697f9721e14b4ccb0dd3c2d1ec1bee6
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              recovery.jsonlz4
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ev7lkj4k.default-release\sessionstore-backups\recovery.jsonlz4
                                                              • Size 4KB
                                                              • SHA256 4f2060dbcd5aa22a478a0d2316b4ac7b0f3fdd93418d2eb2b2cec5d2e3335949
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              memory/1076-404-0x0000000010000000-0x0000000010030000-memory.dmp
                                                              Download

                                                              memory/1996-407-0x0000000010000000-0x0000000010030000-memory.dmp
                                                              Download

                                                              memory/3208-389-0x0000000010000000-0x0000000010030000-memory.dmp
                                                              Download

                                                              memory/3208-419-0x0000000000C80000-0x0000000001273000-memory.dmp
                                                              Download

                                                              memory/3208-3-0x0000000010000000-0x0000000010030000-memory.dmp
                                                              Download

                                                              memory/3208-719-0x0000000000C80000-0x0000000001273000-memory.dmp
                                                              Download

                                                              memory/3208-720-0x0000000010000000-0x0000000010030000-memory.dmp
                                                              Download

                                                              memory/3208-9-0x0000000000C81000-0x0000000000C82000-memory.dmp
                                                              Download

                                                              memory/3208-420-0x0000000010000000-0x0000000010030000-memory.dmp
                                                              Download

                                                              memory/3208-19-0x0000000010000000-0x0000000010030000-memory.dmp
                                                              Download

                                                              memory/3208-432-0x0000000000C80000-0x0000000001273000-memory.dmp
                                                              Download

                                                              memory/3208-20-0x0000000000C80000-0x0000000001273000-memory.dmp
                                                              Download

                                                              memory/3208-21-0x0000000010000000-0x0000000010030000-memory.dmp
                                                              Download

                                                              memory/3572-399-0x0000000010000000-0x0000000010030000-memory.dmp
                                                              Download

                                                              memory/3572-402-0x0000000010000000-0x0000000010030000-memory.dmp
                                                              Download

                                                              memory/5400-409-0x0000000010000000-0x0000000010030000-memory.dmp
                                                              Download