Overview

overview

10

Static

static

10

2026-09-22...op.exe

windows10-2004-x64

10

2026-09-22...op.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/09/2026, 21:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
  • Size 6.0MB
  • Sample260922-zzyfvaff45
  • SHA256 6c2c1632ee3db496b333201f2eba1647245deb7aa0488938c84a2aabfb18e614
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarebackdoordefense_evasiondiscoveryfloxifpersistencespywarestealertrojanupx

Malware Config

Signatures

  • Family: Floxif, Floodfix

    Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

    backdoortrojanfloxif
  • Detects Floxif payload 1 IoCs
    backdoor
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 4 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 4 IoCs
  • UPX dump on OEP (original entry point) 7 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Drops desktop.ini file(s) 3 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 5 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 21 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 22 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 18 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-22_3b94bc716292cd3486771899a8d0722b_darkgate_elex_floxif_glassworm_remcos_stealc_stop.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Enumerates connected drives
    • Installs/modifies Browser Helper Object
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5436
    • C:\Windows\system32\regsvr32.exe
      C:\Windows\Sysnative\regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
      2⤵
        PID:4632
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2232
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
          3⤵
          • Drops desktop.ini file(s)
          • Checks processor information in registry
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3368
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1964 -prefsLen 27097 -prefMapHandle 1968 -prefMapSize 270279 -ipcHandle 2036 -initialChannelId {3a6bff3a-c925-4a71-88a2-0a5b5bb1c748} -parentPid 3368 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3368" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
            4⤵
              PID:3968
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2428 -prefsLen 27133 -prefMapHandle 2432 -prefMapSize 270279 -ipcHandle 2320 -initialChannelId {03c328a1-acb8-4e63-90ab-cd86ad91dfd6} -parentPid 3368 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3368" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
              4⤵
                PID:5164
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3880 -prefsLen 25164 -prefMapHandle 3884 -prefMapSize 270279 -jsInitHandle 3888 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3896 -initialChannelId {3e792a1a-aa2e-40b7-ae42-11dbebfaa938} -parentPid 3368 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3368" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
                4⤵
                • Checks processor information in registry
                PID:4748
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4072 -prefsLen 27274 -prefMapHandle 4076 -prefMapSize 270279 -ipcHandle 4136 -initialChannelId {87268552-0308-4045-92f1-678f678de435} -parentPid 3368 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3368" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
                4⤵
                  PID:4620
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2948 -prefsLen 34773 -prefMapHandle 2620 -prefMapSize 270279 -jsInitHandle 2824 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1476 -initialChannelId {6fe5abe6-439f-493b-861e-6f7904697e65} -parentPid 3368 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3368" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                  4⤵
                  • Checks processor information in registry
                  PID:620
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5112 -prefsLen 35010 -prefMapHandle 5124 -prefMapSize 270279 -ipcHandle 5132 -initialChannelId {1de56958-5b03-45a0-869c-111f4b2367f7} -parentPid 3368 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3368" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
                  4⤵
                  • Checks processor information in registry
                  PID:988
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5276 -prefsLen 35010 -prefMapHandle 5280 -prefMapSize 270279 -jsInitHandle 5284 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5288 -initialChannelId {90eb4224-856c-4358-ad08-e74a6c9c3b31} -parentPid 3368 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3368" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
                  4⤵
                  • Checks processor information in registry
                  PID:3372
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1624 -prefsLen 32952 -prefMapHandle 1628 -prefMapSize 270279 -jsInitHandle 5272 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5744 -initialChannelId {cee2ffca-3549-4bef-9f14-b0f8bda97118} -parentPid 3368 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3368" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                  4⤵
                  • Checks processor information in registry
                  PID:2312
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5880 -prefsLen 32952 -prefMapHandle 5884 -prefMapSize 270279 -jsInitHandle 5888 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5904 -initialChannelId {d6772ab4-84ec-4b48-920b-7c51401de42e} -parentPid 3368 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3368" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                  4⤵
                  • Checks processor information in registry
                  PID:4192
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6064 -prefsLen 32952 -prefMapHandle 6068 -prefMapSize 270279 -jsInitHandle 6072 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6080 -initialChannelId {7815d80b-d176-4af4-8516-9b453dcee740} -parentPid 3368 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3368" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
                  4⤵
                  • Checks processor information in registry
                  PID:5636
            • C:\Windows\SysWOW64\regsvr32.exe
              "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:5932
            • C:\Windows\SysWOW64\regsvr32.exe
              "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:1904
            • C:\Windows\SysWOW64\regsvr32.exe
              "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:2136
            • C:\Windows\SysWOW64\regsvr32.exe
              "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:3304
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.internetdownloadmanager.com/welcome.html?v=643b10
              2⤵
              • Drops file in Windows directory
              • Enumerates system info in registry
              • Modifies data under HKEY_USERS
              • Modifies registry class
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:3728
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffc8de4c188,0x7ffc8de4c194,0x7ffc8de4c1a0
                3⤵
                  PID:2492
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,1238370662779773943,10876110582897396873,262144 --field-trial-handle=2312,i,14381340606271198570,15857389885130190904,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
                  3⤵
                    PID:3076
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,7709824459554498728,17151478161901297767,524288 --field-trial-handle=2312,i,14381340606271198570,15857389885130190904,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:11
                    3⤵
                    • System Time Discovery
                    PID:5376
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,3542201567217406961,16198584483847306180,524288 --field-trial-handle=2312,i,14381340606271198570,15857389885130190904,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:13
                    3⤵
                      PID:4084
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,11311455591001161534,8362614778393126308,2097152 --field-trial-handle=2312,i,14381340606271198570,15857389885130190904,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
                      3⤵
                        PID:1356
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,747222085249174861,1437137919080541777,2097152 --field-trial-handle=2312,i,14381340606271198570,15857389885130190904,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
                        3⤵
                          PID:1352
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,11174501938875486356,13588284768594568850,2097152 --field-trial-handle=2312,i,14381340606271198570,15857389885130190904,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:1
                          3⤵
                            PID:5104
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,12948876492795533312,2161816243191270178,2097152 --field-trial-handle=2312,i,14381340606271198570,15857389885130190904,262144 --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:9
                            3⤵
                              PID:3108
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,6833056544394886252,11887157439656294779,524288 --field-trial-handle=2312,i,14381340606271198570,15857389885130190904,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:14
                              3⤵
                                PID:2896
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3740,i,16393954325512174437,6845095856028519489,524288 --field-trial-handle=2312,i,14381340606271198570,15857389885130190904,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:14
                                3⤵
                                  PID:5452
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,17543501666994890464,14250140519908305844,524288 --field-trial-handle=2312,i,14381340606271198570,15857389885130190904,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
                                  3⤵
                                    PID:4272
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,8432244977757333020,13049589072609259478,524288 --field-trial-handle=2312,i,14381340606271198570,15857389885130190904,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
                                    3⤵
                                      PID:6180
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,8432244977757333020,13049589072609259478,524288 --field-trial-handle=2312,i,14381340606271198570,15857389885130190904,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
                                      3⤵
                                        PID:6204
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,9104233612878600240,4382554612747035563,524288 --field-trial-handle=2312,i,14381340606271198570,15857389885130190904,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
                                        3⤵
                                          PID:6444
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,16285893316114056273,1761665968481678713,524288 --field-trial-handle=2312,i,14381340606271198570,15857389885130190904,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
                                          3⤵
                                            PID:6600
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4276,i,455601873390780383,16958843057550382034,524288 --field-trial-handle=2312,i,14381340606271198570,15857389885130190904,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:14
                                            3⤵
                                              PID:6204
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3796,i,899785613486167436,18408602357296595659,524288 --field-trial-handle=2312,i,14381340606271198570,15857389885130190904,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
                                              3⤵
                                                PID:7104
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,8494327017117225044,8660209251016588182,524288 --field-trial-handle=2312,i,14381340606271198570,15857389885130190904,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
                                                3⤵
                                                  PID:7120
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,15876172184985586417,11399998514457735579,524288 --field-trial-handle=2312,i,14381340606271198570,15857389885130190904,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:14
                                                  3⤵
                                                    PID:6760
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4628,i,3856109723244156152,5792595224724342637,524288 --field-trial-handle=2312,i,14381340606271198570,15857389885130190904,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
                                                    3⤵
                                                      PID:7048
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,12294423128361209207,16440556430816115663,524288 --field-trial-handle=2312,i,14381340606271198570,15857389885130190904,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
                                                      3⤵
                                                        PID:1444
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,16078641474855860200,18382956404874062736,524288 --field-trial-handle=2312,i,14381340606271198570,15857389885130190904,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:14
                                                        3⤵
                                                          PID:4124
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                      1⤵
                                                        PID:3464
                                                      • C:\Windows\system32\svchost.exe
                                                        C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                        1⤵
                                                          PID:6644
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                          1⤵
                                                            PID:6868

                                                          Network

                                                                MITRE ATT&CK Enterprise v16

                                                                Reconnaissance

                                                                Resource Development

                                                                Initial Access

                                                                Execution

                                                                Persistence

                                                                Boot or Logon Autostart Execution

                                                                1
                                                                T1547

                                                                Registry Run Keys / Startup Folder

                                                                1
                                                                T1547.001

                                                                Browser Extensions

                                                                1
                                                                T1176

                                                                Privilege Escalation

                                                                Boot or Logon Autostart Execution

                                                                1
                                                                T1547

                                                                Registry Run Keys / Startup Folder

                                                                1
                                                                T1547.001

                                                                Defense Evasion

                                                                Modify Registry

                                                                3
                                                                T1112

                                                                Credential Access

                                                                Credentials from Password Stores

                                                                1
                                                                T1555

                                                                Credentials from Web Browsers

                                                                1
                                                                T1555.003

                                                                Unsecured Credentials

                                                                1
                                                                T1552

                                                                Credentials In Files

                                                                1
                                                                T1552.001

                                                                Discovery

                                                                Browser Information Discovery

                                                                1
                                                                T1217

                                                                Peripheral Device Discovery

                                                                1
                                                                T1120

                                                                Query Registry

                                                                4
                                                                T1012

                                                                System Information Discovery

                                                                5
                                                                T1082

                                                                System Location Discovery

                                                                1
                                                                T1614

                                                                System Language Discovery

                                                                1
                                                                T1614.001

                                                                System Time Discovery

                                                                1
                                                                T1124

                                                                Lateral Movement

                                                                Collection

                                                                Data from Local System

                                                                1
                                                                T1005

                                                                Command and Control

                                                                Exfiltration

                                                                Impact

                                                                Replay Monitor

                                                                Loading Replay Monitor...

                                                                Downloads

                                                                symsrv.dll
                                                                • Path C:\Program Files\Common Files\System\symsrv.dll
                                                                • Size 67KB
                                                                • SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                symsrv.dll.000
                                                                • Path C:\Program Files\Common Files\System\symsrv.dll.000
                                                                • Size 114B
                                                                • SHA256 aefc503b1ed462d7b6280228a7b5b710792273b78934426f88325341ac5b5a92
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                settings.dat
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                • Size 280B
                                                                • SHA256 fc0a38b9bd67def6f8a6da7a4a5956bc201e5aac4ba6f906946e52f5b14e13c2
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                settings.dat
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                • Size 280B
                                                                • SHA256 0d0352bb5f4b47f3d1ca8042212dfbae37957031d48d7789bd6cd7b4b6cbbe31
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                the-real-index
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                • Size 3KB
                                                                • SHA256 676ab4ee2bb41a3befcce7a2dd9d2548f3050474381756951f84a88c81d9cee8
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                the-real-index~RFe5a2e16.TMP
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a2e16.TMP
                                                                • Size 3KB
                                                                • SHA256 42f241ecdf0e346c389753ffdefa1fbbfa563e2c777e658c282538e5a972e666
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                SiteList-Enterprise.json
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                • Size 2B
                                                                • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                Edge Profile.ico
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                • Size 70KB
                                                                • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Network Persistent State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                • Size 2KB
                                                                • SHA256 c9bbec0bcaa58310aeb6ecc19d61bf1ba0eb6864cf882e0f9867490486d1c3a4
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                SCT Auditing Pending Reports
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                • Size 2B
                                                                • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                Sdch Dictionaries
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                • Size 40B
                                                                • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                Preferences
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                • Size 11KB
                                                                • SHA256 8ea679fdb9328caed3c6ad29b6c61afb32a24b935aa885ac825fb47c37ab18e4
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Preferences
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                • Size 11KB
                                                                • SHA256 cbae8b9f25e74385959d1535d9d5eba05d5eec76ffbce0e5118b30e671f6ea8f
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Preferences
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                • Size 12KB
                                                                • SHA256 4d39515cce74eae9bcba240561c4f3c685098ff953f18ce31421283d19a1fcce
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Secure Preferences
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                • Size 29KB
                                                                • SHA256 c40d6fa964fc06057c0dccced305af6bcd8e9de4683e34c36f1b7b286bd4fb6f
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                22135f60-1c3c-41f2-8aa3-25c6d835601f.tmp
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\22135f60-1c3c-41f2-8aa3-25c6d835601f.tmp
                                                                • Size 22KB
                                                                • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Local State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                • Size 42KB
                                                                • SHA256 8d3c94f0f3d8e796ef5c6e4887a285584fd0c69ae8fb2ebbadd3aa704210f113
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Local State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                • Size 34KB
                                                                • SHA256 c7c483d5dbd95064c3b7f4c72d9cabb8016104fcdb8d79577c4e3896b3d57d53
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Local State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                • Size 37KB
                                                                • SHA256 3838d78798a869afebf683ff08d95a806608b12f0dabb98fa3316344c5fa2916
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Local State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                • Size 34KB
                                                                • SHA256 1364769367866c5d0795ed173d865651bb044cedd11887d39cdcc5694b54a706
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                metadata.json
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                • Size 132B
                                                                • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                metadata.json
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                • Size 252B
                                                                • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                f816a2e3-9ef3-472e-bf77-232a3dbeb142.tmp
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f816a2e3-9ef3-472e-bf77-232a3dbeb142.tmp
                                                                • Size 13B
                                                                • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
                                                                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o9575aad.default-release\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
                                                                • Size 16KB
                                                                • SHA256 0f13af5facad6107fd1c3d1e990ec61a63dff3254f7d24db2eee64577096a947
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                webext.sc.lz4
                                                                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o9575aad.default-release\startupCache\webext.sc.lz4
                                                                • Size 104KB
                                                                • SHA256 8f9a513345d23b89253b787c5e4c1e6d137629f6f8188f84356cd053cd50b600
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                dc24c0f5-4600-4e50-a194-f917e68ad0b0.zip
                                                                • Path C:\Users\Admin\AppData\Local\Temp\dc24c0f5-4600-4e50-a194-f917e68ad0b0.zip
                                                                • Size 3.8MB
                                                                • SHA256 4ef3d9d2698af4d397f45f1616b2d2388a3088df0e85582826e06c8b09d41206
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                content_new.js
                                                                • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3728_280171354\CRX_INSTALL\content_new.js
                                                                • Size 10KB
                                                                • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                tmpaddon
                                                                • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                                • Size 11KB
                                                                • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                tmpaddon
                                                                • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                                • Size 502KB
                                                                • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                compatibility.ini
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\compatibility.ini
                                                                • Size 198B
                                                                • SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                data.safe.tmp
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\db\data.safe.tmp
                                                                • Size 7KB
                                                                • SHA256 0a0524b01824cffeb2966c810acd7cbefb3c23418035340500561536f7305b4f
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                data.safe.tmp
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\db\data.safe.tmp
                                                                • Size 31KB
                                                                • SHA256 0a2d7f23d327697d2fe6909ba57d738bb225f04e568cfa84c436156e9fccd0a8
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                data.safe.tmp
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\db\data.safe.tmp
                                                                • Size 31KB
                                                                • SHA256 10b99e541f2c25d11c801596734d62923b651072fdb491f6937e230a525f31f5
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                data.safe.tmp
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\db\data.safe.tmp
                                                                • Size 31KB
                                                                • SHA256 8811926b51deb3be26aaa506ef0b5b487ec606e9411cc20b0874193df04524cc
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                events
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\events\events
                                                                • Size 1KB
                                                                • SHA256 1ea6847142ff84c521db27af5da48f31a51b2211f012fe105ab630e225fbad2a
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                070f4f63-ee59-48dc-af46-6945d52e8a53
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\pending_pings\070f4f63-ee59-48dc-af46-6945d52e8a53
                                                                • Size 16KB
                                                                • SHA256 10b8d0b8ef07a8816bd7c03224633221ef08e111abe8fe409f0fb499479aa35d
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                2e54ca7a-fb2e-446a-9ad4-f468c1c27633
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\pending_pings\2e54ca7a-fb2e-446a-9ad4-f468c1c27633
                                                                • Size 886B
                                                                • SHA256 405992023f160b261cd52aa37ea23b7c33a3a874c31ca3ff9003390815a3af34
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                3234925b-42e1-46ac-a3cc-52b43390e2ba
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\pending_pings\3234925b-42e1-46ac-a3cc-52b43390e2ba
                                                                • Size 235B
                                                                • SHA256 274b873f962fd71a0fe3864ca3813a4facde85ae7d1f3b509966003850d9c5fe
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                a2e0bad0-ec29-4b99-9c9c-a984f82d7b34
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\pending_pings\a2e0bad0-ec29-4b99-9c9c-a984f82d7b34
                                                                • Size 2KB
                                                                • SHA256 12780cd9bc6139bddf63c017a7f5dab2cb57d638010bd573ac5674e67eee7c5e
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                e1855c52-2cb8-4e36-8cb6-2f82caa83071
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\pending_pings\e1855c52-2cb8-4e36-8cb6-2f82caa83071
                                                                • Size 883B
                                                                • SHA256 c0286ef6513222fee390626c83f2acdf7396711e79247d7ba4b6e8b3ba7df1e8
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                fb4eeefd-dd80-4854-af93-e17a59504cec
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\datareporting\glean\pending_pings\fb4eeefd-dd80-4854-af93-e17a59504cec
                                                                • Size 235B
                                                                • SHA256 72ec94b482d4d02921b5209c635e237bf5a0224230133a053633d18b74799c8d
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                extensions.json
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\extensions.json
                                                                • Size 16KB
                                                                • SHA256 9613d17f5ebf5fd9b4aa958f8f5aba1cb9504cfa5197e2bec7c14baeb85212f5
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                gmpopenh264.dll
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                                                                • Size 1.1MB
                                                                • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                gmpopenh264.info
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                                                                • Size 116B
                                                                • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                manifest.json
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
                                                                • Size 1002B
                                                                • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                widevinecdm.dll
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
                                                                • Size 21.6MB
                                                                • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                prefs-1.js
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\prefs-1.js
                                                                • Size 6KB
                                                                • SHA256 3b7050a0a93c051e51d6e16c6186f639c44fb70d8311103888643e3d88a0a3a2
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                prefs-1.js
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\prefs-1.js
                                                                • Size 8KB
                                                                • SHA256 d4481763f28fd43f162f8d425663f8c243da6011d29f0013f5a937cf9fb81231
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                prefs-1.js
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\prefs-1.js
                                                                • Size 12KB
                                                                • SHA256 74e25c4a5199272170e8cdf4b72dc27eeff68e196e4e1ec6c2c6c446f345a3fd
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                prefs.js
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\prefs.js
                                                                • Size 6KB
                                                                • SHA256 0a6d7a06e53e564f5a35b771f77388b0aca07ad1daba5563dc423bdb44fc1542
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                prefs.js
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\prefs.js
                                                                • Size 6KB
                                                                • SHA256 18cb3250186aae826bed7be616b091fce89a3a7e495b8452c50f42e169c19966
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                recovery.baklz4
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\sessionstore-backups\recovery.baklz4
                                                                • Size 4KB
                                                                • SHA256 52d62d269c04cb9c52ae5878a63c8e22594e488a49086be23164b3d4045aef84
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                recovery.jsonlz4
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\sessionstore-backups\recovery.jsonlz4
                                                                • Size 4KB
                                                                • SHA256 afc2efbc23cca07dfdb0a4d9fc33d25a3fdfbed1b2e3e3471cfb5434e969025c
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                3870112724rsegmnoittet-es.sqlite
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o9575aad.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                • Size 7.4MB
                                                                • SHA256 4105582f55883bfc857887fde351a912a4a9ea86982f44a63f8792982b86d28a
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                memory/5436-758-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                Download

                                                                memory/5436-409-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                Download

                                                                memory/5436-408-0x0000000000060000-0x0000000000653000-memory.dmp
                                                                Download

                                                                memory/5436-3-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                Download

                                                                memory/5436-757-0x0000000000060000-0x0000000000653000-memory.dmp
                                                                Download

                                                                memory/5436-391-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                Download

                                                                memory/5436-472-0x0000000000060000-0x0000000000653000-memory.dmp
                                                                Download

                                                                memory/5436-21-0x0000000000060000-0x0000000000653000-memory.dmp
                                                                Download

                                                                memory/5436-22-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                Download

                                                                memory/5436-14-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                Download

                                                                memory/5436-9-0x0000000000061000-0x0000000000062000-memory.dmp
                                                                Download