Overview

overview

10

Static

static

10

2026-09-24...op.exe

windows10-2004-x64

10

2026-09-24...op.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    24/09/2026, 03:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-24_ac17bcaac507c97928e980fa1dc3a4ab_darkgate_elex_glassworm_neshta_ransomhub_remcos_stealc_stop.exe
  • Size 6.0MB
  • Sample260924-dpc69scf96
  • SHA256 220a3e3086526f63f24de160f9e8dc868e945c2d9d0b2224e258a2ca0204af4d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarediscoveryneshtapersistencespywarestealer

Malware Config

Signatures

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Detect Neshta payload 64 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 3 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 20 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 22 IoCs
    adwarespyware
  • Modifies registry class 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_ac17bcaac507c97928e980fa1dc3a4ab_darkgate_elex_glassworm_neshta_ransomhub_remcos_stealc_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_ac17bcaac507c97928e980fa1dc3a4ab_darkgate_elex_glassworm_neshta_ransomhub_remcos_stealc_stop.exe"
    1⤵
    • Checks computer location settings
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3156
    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-09-24_ac17bcaac507c97928e980fa1dc3a4ab_darkgate_elex_glassworm_neshta_ransomhub_remcos_stealc_stop.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-09-24_ac17bcaac507c97928e980fa1dc3a4ab_darkgate_elex_glassworm_neshta_ransomhub_remcos_stealc_stop.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Installs/modifies Browser Helper Object
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1724
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\3582-490\IDMShellExt64.dll"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1704
      • C:\Windows\svchost.com
        "C:\Windows\svchost.com" "C:\PROGRA~1\MOZILL~1\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:680
        • C:\PROGRA~1\MOZILL~1\firefox.exe
          C:\PROGRA~1\MOZILL~1\firefox.exe https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:5096
          • C:\PROGRA~1\MOZILL~1\firefox.exe
            C:\PROGRA~1\MOZILL~1\firefox.exe https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
            5⤵
            • Drops desktop.ini file(s)
            • Checks processor information in registry
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3160
            • C:\PROGRA~1\MOZILL~1\firefox.exe
              "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1980 -prefsLen 27099 -prefMapHandle 1984 -prefMapSize 270279 -ipcHandle 2072 -initialChannelId {fd531d68-c66a-41ec-a5f9-1395bc8baeda} -parentPid 3160 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3160" -appDir "C:\PROGRA~1\MOZILL~1\browser" - 1 gpu
              6⤵
                PID:4484
              • C:\PROGRA~1\MOZILL~1\firefox.exe
                "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2468 -prefsLen 27135 -prefMapHandle 2472 -prefMapSize 270279 -ipcHandle 2488 -initialChannelId {b12475da-0f4c-4134-9b6e-2f018a41dd65} -parentPid 3160 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3160" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 2 socket
                6⤵
                  PID:2408
                • C:\PROGRA~1\MOZILL~1\firefox.exe
                  "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -isForBrowser -prefsHandle 3776 -prefsLen 25213 -prefMapHandle 3780 -prefMapSize 270279 -jsInitHandle 3784 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3788 -initialChannelId {7bcab643-2155-4d7d-94b7-9afff0ee458a} -parentPid 3160 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3160" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 3 tab
                  6⤵
                  • Checks processor information in registry
                  PID:2780
                • C:\PROGRA~1\MOZILL~1\firefox.exe
                  "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3984 -prefsLen 27325 -prefMapHandle 3988 -prefMapSize 270279 -ipcHandle 3996 -initialChannelId {34fe02bb-4a87-44e1-be92-dba4ec89de40} -parentPid 3160 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3160" -appDir "C:\PROGRA~1\MOZILL~1\browser" - 4 rdd
                  6⤵
                    PID:3532
                  • C:\PROGRA~1\MOZILL~1\firefox.exe
                    "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -isForBrowser -prefsHandle 884 -prefsLen 34824 -prefMapHandle 1172 -prefMapSize 270279 -jsInitHandle 2880 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3056 -initialChannelId {be9d11dc-a00a-471c-a9d5-70449f36035f} -parentPid 3160 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3160" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 5 tab
                    6⤵
                    • Checks processor information in registry
                    PID:1432
                  • C:\PROGRA~1\MOZILL~1\firefox.exe
                    "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -isForBrowser -prefsHandle 4860 -prefsLen 35012 -prefMapHandle 4876 -prefMapSize 270279 -jsInitHandle 4888 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4896 -initialChannelId {1493814d-9361-4982-8c06-8d6995af3934} -parentPid 3160 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3160" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 6 tab
                    6⤵
                    • Checks processor information in registry
                    PID:5512
                  • C:\PROGRA~1\MOZILL~1\firefox.exe
                    "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5096 -prefsLen 35012 -prefMapHandle 5100 -prefMapSize 270279 -ipcHandle 5108 -initialChannelId {36c634fa-010c-446d-a7cd-0ee90839a605} -parentPid 3160 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3160" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 7 utility
                    6⤵
                    • Checks processor information in registry
                    PID:5568
                  • C:\PROGRA~1\MOZILL~1\firefox.exe
                    "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -isForBrowser -prefsHandle 2840 -prefsLen 32952 -prefMapHandle 1624 -prefMapSize 270279 -jsInitHandle 1632 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5396 -initialChannelId {cd1107a8-b48a-4e93-9159-f34259239ad9} -parentPid 3160 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3160" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 8 tab
                    6⤵
                    • Checks processor information in registry
                    PID:6124
                  • C:\PROGRA~1\MOZILL~1\firefox.exe
                    "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -isForBrowser -prefsHandle 1648 -prefsLen 32952 -prefMapHandle 1644 -prefMapSize 270279 -jsInitHandle 5404 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5428 -initialChannelId {4a0062ef-d4c6-4cdb-9755-b07ef67508d8} -parentPid 3160 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3160" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 9 tab
                    6⤵
                    • Checks processor information in registry
                    PID:3948
                  • C:\PROGRA~1\MOZILL~1\firefox.exe
                    "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -isForBrowser -prefsHandle 5732 -prefsLen 32952 -prefMapHandle 5736 -prefMapSize 270279 -jsInitHandle 5740 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5748 -initialChannelId {8b5d63ba-62c6-427d-b851-34baa906a3d5} -parentPid 3160 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3160" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 10 tab
                    6⤵
                    • Checks processor information in registry
                    PID:1752
            • C:\Windows\svchost.com
              "C:\Windows\svchost.com" "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\3582-490\IDMShellExt64.dll"
              3⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5368
              • C:\Windows\SysWOW64\regsvr32.exe
                C:\Windows\System32\regsvr32.exe /s C:\Users\Admin\AppData\Local\Temp\3582-490\IDMShellExt64.dll
                4⤵
                • System Location Discovery: System Language Discovery
                PID:5464
            • C:\Windows\svchost.com
              "C:\Windows\svchost.com" "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\3582-490\IDMIECC64.dll"
              3⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3368
              • C:\Windows\SysWOW64\regsvr32.exe
                C:\Windows\System32\regsvr32.exe /s C:\Users\Admin\AppData\Local\Temp\3582-490\IDMIECC64.dll
                4⤵
                • System Location Discovery: System Language Discovery
                PID:5528
            • C:\Windows\svchost.com
              "C:\Windows\svchost.com" "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\3582-490\IDMGetAll64.dll"
              3⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5592
              • C:\Windows\SysWOW64\regsvr32.exe
                C:\Windows\System32\regsvr32.exe /s C:\Users\Admin\AppData\Local\Temp\3582-490\IDMGetAll64.dll
                4⤵
                • System Location Discovery: System Language Discovery
                PID:5600
            • C:\Windows\svchost.com
              "C:\Windows\svchost.com" "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\3582-490\downlWithIDM64.dll"
              3⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5708
              • C:\Windows\SysWOW64\regsvr32.exe
                C:\Windows\System32\regsvr32.exe /s C:\Users\Admin\AppData\Local\Temp\3582-490\downlWithIDM64.dll
                4⤵
                • System Location Discovery: System Language Discovery
                PID:5900

        Network

              MITRE ATT&CK Enterprise v16

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Persistence

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Browser Extensions

              1
              T1176

              Event Triggered Execution

              1
              T1546

              Change Default File Association

              1
              T1546.001

              Privilege Escalation

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Event Triggered Execution

              1
              T1546

              Change Default File Association

              1
              T1546.001

              Defense Evasion

              Modify Registry

              4
              T1112

              Credential Access

              Credentials from Password Stores

              1
              T1555

              Credentials from Web Browsers

              1
              T1555.003

              Unsecured Credentials

              1
              T1552

              Credentials In Files

              1
              T1552.001

              Discovery

              Query Registry

              3
              T1012

              System Information Discovery

              3
              T1082

              System Location Discovery

              1
              T1614

              System Language Discovery

              1
              T1614.001

              Lateral Movement

              Collection

              Data from Local System

              1
              T1005

              Command and Control

              Exfiltration

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              ACROBR~1.EXE
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE
              • Size 328KB
              • SHA256 888a1dd0033e5d758a4e731e3e55357de866e80d03b1b194375f714e1fd4351d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ACROTE~1.EXE
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
              • Size 86KB
              • SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ADOBEC~1.EXE
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE
              • Size 5.7MB
              • SHA256 1b5c715d71384f043843ea1785a6873a9f39d2daae112ccdeffcd88b10a3a403
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ADelRCP.exe
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe
              • Size 175KB
              • SHA256 3f00404dd591c2856e6f71bd78423ed47199902e0b85f228e6c4de72c59ddffe
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              RdrCEF.exe
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe
              • Size 9.4MB
              • SHA256 31da9632f5d25806b77b617d48da52a14afc574bbe1653120f97705284ea566c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AcroRd32.exe
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
              • Size 2.4MB
              • SHA256 8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              WCCHRO~1.EXE
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE
              • Size 183KB
              • SHA256 ecd5e94da88c653e4c34b6ab325e0aca8824247b290336f75c410caa16381bc5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Eula.exe
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe
              • Size 131KB
              • SHA256 5c3ef3ec7594c040146e908014791dd15201ba58b4d70032770bb661b6a0e394
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              FULLTR~1.EXE
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE
              • Size 254KB
              • SHA256 16d65f2463658a72dba205dcaa18bc3d0bab4453e726233d68bc176e69db0950
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              LOGTRA~1.EXE
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE
              • Size 386KB
              • SHA256 473eb551101caeaf2d18f811342e21de323c8dd19ed21011997716871defe997
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              READER~1.EXE
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE
              • Size 92KB
              • SHA256 2f947e3ca624ce7373080b4a3934e21644fb070a53feeaae442b15b849c2954f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              WOW_HE~1.EXE
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE
              • Size 147KB
              • SHA256 750824b5f75c91a6c2eeb8c5e60ae28d7a81e323d3762c8652255bfea5cba0bb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              arh.exe
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe
              • Size 125KB
              • SHA256 fe44ca8d5050932851aa54c23133277e66db939501af58e5aeb7b67ec1dde7b5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              32BITM~1.EXE
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE
              • Size 142KB
              • SHA256 3e9da97a7106122245e77f13f3f3cc96c055d732ab841eb848d03ac25401c1bc
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              64BITM~1.EXE
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE
              • Size 278KB
              • SHA256 22a585c183e27b3c732028ff193733c2f9d03700a0e95e65c556b0592c43d880
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ADOBEA~1.EXE
              • Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE
              • Size 454KB
              • SHA256 bb07d817b8b1b6b4c25e62b6120e51dec10118557d7b6b696ad084a5ba5bfdeb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AdobeARM.exe
              • Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe
              • Size 1.2MB
              • SHA256 b1ec065f71cc40f400e006586d370997102860504fd643b235e8ed9f5607262a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jaureg.exe
              • Path C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe
              • Size 555KB
              • SHA256 c5a99f42100834599e4995d0a178b32b772a6e774a4050a6bb00438af0a6a1f3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VSTOIN~1.EXE
              • Path C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE
              • Size 121KB
              • SHA256 405b8bd647fa703e233b8b609a18999abe465a8458168f1daf23197bd2ea36aa
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              java.exe
              • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe
              • Size 325KB
              • SHA256 5e2e22ead49ce9cc11141dbeebbe5b93a530c966695d8efc2083f00e6be53423
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javaw.exe
              • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe
              • Size 325KB
              • SHA256 e2262c798729169f697e6c30e5211cde604fd8b14769311ff4ea81abba8c2781
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javaws.exe
              • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe
              • Size 505KB
              • SHA256 da73b6e071788372702104b9c72b6697e84e7c75e248e964996700b77c6b6f1c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              DISABL~1.EXE
              • Path C:\PROGRA~2\Google\Update\DISABL~1.EXE
              • Size 5.7MB
              • SHA256 3acf99624820fd862ac30780021108f0ff2df60db3df351cd17400404f279d3c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MI9C33~1.EXE
              • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MI9C33~1.EXE
              • Size 139KB
              • SHA256 8f5c7c8e0258a5caa37637b2fa36f3bd87569a97b5c1ecf40dab50e7255fcf9c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MIA062~1.EXE
              • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MIA062~1.EXE
              • Size 1.7MB
              • SHA256 da6de758d909ff5b7fb150a4a6a6b9774951aa2bd7c93966ea8951647386c330
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MICROS~1.EXE
              • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~1.EXE
              • Size 201KB
              • SHA256 0f201a8142c5a8adc36d2a177dd8d430eef2b05cff0e4faefb52440e823b54bb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MICROS~2.EXE
              • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~2.EXE
              • Size 250KB
              • SHA256 4d87b0eb331443b473c90650d31b893d00373ff88dcbcb3747f494407799af69
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MICROS~3.EXE
              • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~3.EXE
              • Size 139KB
              • SHA256 a60e32baf0c481d6b9db3b84c205716fe2e588cb5089c3d0e4e942e453bf086d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MICROS~4.EXE
              • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~4.EXE
              • Size 244KB
              • SHA256 67f6e8f14bcf0e6d570c1f4ac5a1bb80a4e1470b5bad5a7ee85689c476597d8e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MID1AD~1.EXE
              • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MID1AD~1.EXE
              • Size 276KB
              • SHA256 a1a0bf09839e6175e5508271774c6d94f4eb2130c914ea7666c1ecaf1a6fde47
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MI391D~1.EXE
              • Path C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MI391D~1.EXE
              • Size 139KB
              • SHA256 333bd0e32eb6dec7e3b6e153bc37ae3feb24a03e45df327a2f1de7eeb08ea4c6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MICROS~1.EXE
              • Path C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MICROS~1.EXE
              • Size 242KB
              • SHA256 03044d2ffe2c87ce479dbdb722183cb7f806510a5b27460153ef9b3906a0f7ec
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MICROS~4.EXE
              • Path C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MICROS~4.EXE
              • Size 223KB
              • SHA256 2b29cceb8d78c397f9be4f35f54752078e1d1d51653a8cbddbd06f7ccc860602
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              IE_TO_~1.EXE
              • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\BHO\IE_TO_~1.EXE
              • Size 557KB
              • SHA256 6bb357968887ad126579fb157f455e359ea036a4960a9f98f5cec1fe53931c98
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              COOKIE~1.EXE
              • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\COOKIE~1.EXE
              • Size 161KB
              • SHA256 5fee43e3295682e179d6e10c568aeb640bbbcf0d6b962fd27f5b372a45fc272d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ELEVAT~1.EXE
              • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\ELEVAT~1.EXE
              • Size 1.8MB
              • SHA256 47eb0dc0cd08f4faa389621c43d6407283e3c315012ef1078a6018c117f195b2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              IDENTI~1.EXE
              • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\IDENTI~1.EXE
              • Size 1.1MB
              • SHA256 94c99d3284962585c15fdb061e0685287df11c872ef930263e251d8d3084d5b0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              setup.exe
              • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\INSTAL~1\setup.exe
              • Size 6.6MB
              • SHA256 4ea8adca8a7f73fc71c7e45ef98f8c422a8b161ca6b6fcd912aec701bebd08a5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MSEDGE~1.EXE
              • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\MSEDGE~1.EXE
              • Size 3.2MB
              • SHA256 fc0701d5c47cbd883929abfccf5f6ba88f76a4d0ebfa2d28160cf6c28f018e26
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MSEDGE~2.EXE
              • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\MSEDGE~2.EXE
              • Size 1.1MB
              • SHA256 550e6ad6b5fb0dabd28d9009c790b22e9444fc9fc30e952210727f6ac4a00389
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MSEDGE~3.EXE
              • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\MSEDGE~3.EXE
              • Size 1.5MB
              • SHA256 eb9bbc44c181ddef0d8b53b69bd7327f5c150c0b72d92805a9f3a9ba333f0575
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              NOTIFI~1.EXE
              • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\NOTIFI~1.EXE
              • Size 1.3MB
              • SHA256 447a7ccfbece37792dfd82e6cf4e644e261dbe0f3e23a13c475276e8e4fa3561
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PWAHEL~1.EXE
              • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\PWAHEL~1.EXE
              • Size 1.1MB
              • SHA256 c57f8707c1fda09d33efc6b615c0d48174253e9869772841446302748f1f9016
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              msedge.exe
              • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\msedge.exe
              • Size 3.8MB
              • SHA256 6773bf49098b9fa85725651bc789ec2bcef5dd563a356043468c1f7b235defef
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ie_to_edge_stub.exe
              • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\BHO\ie_to_edge_stub.exe
              • Size 562KB
              • SHA256 533d6da98378d3b1bb120b192bc5bd20bbeed6e123fe9fc6c15a4a3504932c71
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              setup.exe
              • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\INSTAL~1\setup.exe
              • Size 7.1MB
              • SHA256 70c13c14a682d65fd82ec72f578e160617f8b7c164414bcce613a9b9ebd0c878
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              cookie_exporter.exe
              • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\cookie_exporter.exe
              • Size 155KB
              • SHA256 30d26d2f766f716cd6b21cdc15065ee4191760ef0d37de51f67dead898fb8e7c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              elevated_tracing_service.exe
              • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevated_tracing_service.exe
              • Size 3.8MB
              • SHA256 c13ce5f473ff68ffdea61e8a4800008f527054f4561f2bf7853f6769d0c02dc5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              elevation_service.exe
              • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevation_service.exe
              • Size 2.2MB
              • SHA256 8c53985c403e44c0c899c2d1f2a0b8afb1f17fb928ff866271de7952c9ff7c66
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              identity_helper.exe
              • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\identity_helper.exe
              • Size 1.4MB
              • SHA256 cd0adfcf43373e05fcf8836cc998cb17e3aaade9f8b190e28ce4331bd026f23c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              msedge_pwa_launcher.exe
              • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge_pwa_launcher.exe
              • Size 1.8MB
              • SHA256 2c31887681976e9691cfed32b98a9f81898beaaee9ea3f7a90fe695b84190511
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              msedgewebview2.exe
              • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedgewebview2.exe
              • Size 3.4MB
              • SHA256 c0566225b047e50773acde8ada568ef7612809e74f2cc200504e60cf7a917c68
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              notification_click_helper.exe
              • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\notification_click_helper.exe
              • Size 1.6MB
              • SHA256 0faa9f1f62a95136d454efa51e6f8e8ff06a08d344fd26dc2216de09f6fbee4e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MSEDGE~1.EXE
              • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE
              • Size 1.5MB
              • SHA256 b4bdab2b2c7731923854f254ba1494c25a11331293c0ee4939afd10ba1e2b575
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PWAHEL~1.EXE
              • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE
              • Size 1.4MB
              • SHA256 df233ebee614cd9117f7e467f16f4c2225aadbc59213a5695913a4a87f792d6a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              msedge.exe
              • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
              • Size 4.0MB
              • SHA256 18f4157c2dabb39cf84662e17c471f69f679840a70be3a4685e0c4ed8ccc207a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\acaoqdel.default-release\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
              • Size 16KB
              • SHA256 3be6e65193d26304bd624d2db95a1e371906ca6cf72ec26a70d504b6b9639673
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              webext.sc.lz4
              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\acaoqdel.default-release\startupCache\webext.sc.lz4
              • Size 105KB
              • SHA256 ded6717609b2c4dab29705a9d67fd4bad723a503ec7a52de21f041f4e10330ac
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              2026-09-24_ac17bcaac507c97928e980fa1dc3a4ab_darkgate_elex_glassworm_neshta_ransomhub_remcos_stealc_stop.exe
              • Path C:\Users\Admin\AppData\Local\Temp\3582-490\2026-09-24_ac17bcaac507c97928e980fa1dc3a4ab_darkgate_elex_glassworm_neshta_ransomhub_remcos_stealc_stop.exe
              • Size 5.9MB
              • SHA256 1016152e6dcfc70f38e4036995419b966f12ef655d279f5bf634104fc54758eb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              tmpaddon
              • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
              • Size 11KB
              • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              tmpaddon
              • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
              • Size 502KB
              • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              data.safe.tmp
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\datareporting\glean\db\data.safe.tmp
              • Size 31KB
              • SHA256 b695eee0b6db283c511cde119394a918bc4a2ff4c037eada59bec219bc9a6e11
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              data.safe.tmp
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\datareporting\glean\db\data.safe.tmp
              • Size 31KB
              • SHA256 28aeec613519129afd3f636b8032c0f54e56c098bb44feb228004e48358d02d9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              data.safe.tmp
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\datareporting\glean\db\data.safe.tmp
              • Size 31KB
              • SHA256 5145146971ee7b6b582c6e1cc4d7b2891474437094bfcff954466074c50a5160
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              data.safe.tmp
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\datareporting\glean\db\data.safe.tmp
              • Size 6KB
              • SHA256 e4de508a6b87cdfa2402bea9cc78deff1eec682a12fd6ffab1bc72151196187f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              data.safe.tmp
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\datareporting\glean\db\data.safe.tmp
              • Size 3KB
              • SHA256 ecff4e8e8f0022980cd00684d1285180244f87b0af06188dd5d13fcb75c2d2f8
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              data.safe.tmp
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\datareporting\glean\db\data.safe.tmp
              • Size 7KB
              • SHA256 6c9a75690997e10bf0e5a8932876d3aa1acb48b7a34dd94f382469418a25520b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              events
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\datareporting\glean\events\events
              • Size 1KB
              • SHA256 5a0f0cf476111228ac7293af12e801e78d4eb0699ad7dee917176894c75af856
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              0f875688-2b7e-4688-b489-79ac3df6aca8
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\datareporting\glean\pending_pings\0f875688-2b7e-4688-b489-79ac3df6aca8
              • Size 235B
              • SHA256 1afa61b5d63c7ba67a304066f1c9c93245cd31dcbc41b2184c797a80c0cb348e
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              26b6eb14-30a8-4b11-af53-1a5c809380d6
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\datareporting\glean\pending_pings\26b6eb14-30a8-4b11-af53-1a5c809380d6
              • Size 2KB
              • SHA256 dd9e3b99077d307732e879463392e8eb42417d9b3e933692f13b0ac9e02fbdd1
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              2c72a447-8986-47f1-9e72-7612553be260
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\datareporting\glean\pending_pings\2c72a447-8986-47f1-9e72-7612553be260
              • Size 235B
              • SHA256 3ee2c624dcf02da10710cc8a96b5cfd4bb7a6e2663c74b8ba9491e21c5efce4d
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              3094dd57-4f3e-439c-be30-36a02a46cb7c
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\datareporting\glean\pending_pings\3094dd57-4f3e-439c-be30-36a02a46cb7c
              • Size 883B
              • SHA256 ef97797647159376ecf29813aa372599fbc3a9e70e414305a7970a004ce19e6a
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              3f540105-61d6-4444-98d9-2518bd72dc53
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\datareporting\glean\pending_pings\3f540105-61d6-4444-98d9-2518bd72dc53
              • Size 15KB
              • SHA256 8705534e19f17b69091a74f872962f878ec7f54295b476988d591a13481d7b99
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              42c9eb77-b3d0-4945-8311-4e1c55110904
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\datareporting\glean\pending_pings\42c9eb77-b3d0-4945-8311-4e1c55110904
              • Size 886B
              • SHA256 094ae7f100983b6b6d41484f7b4881fcf9d65c1baa94ed4068dcf7f4bf7d9133
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              extensions.json
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\extensions.json
              • Size 16KB
              • SHA256 f192b938661faa74ec9994bdb262ea19f7094134472d28a28f2c0d96f72f2560
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              gmpopenh264.dll
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
              • Size 1.1MB
              • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              gmpopenh264.info
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
              • Size 116B
              • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              manifest.json
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
              • Size 1002B
              • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              widevinecdm.dll
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
              • Size 21.6MB
              • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              prefs-1.js
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\prefs-1.js
              • Size 8KB
              • SHA256 ba9e94557e8524ffd55ee890be7627b1a03f9da89ee2d4144c630f7d12a33069
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              prefs-1.js
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\prefs-1.js
              • Size 6KB
              • SHA256 7258e3b644f38233e9b19f2ff40f385df74fe7f6dc9bd68d1239a3b832a583d0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              prefs.js
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\prefs.js
              • Size 6KB
              • SHA256 391912f3155d80273ba0bd818ca2875374cb5382ea5033e3737b6624b27ead5b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              prefs.js
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\prefs.js
              • Size 6KB
              • SHA256 e07c07a64e9d64065cfb0c76c5df98ce07f4c98e0db2e4f9570abca3dbab1b5e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              recovery.baklz4
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\sessionstore-backups\recovery.baklz4
              • Size 4KB
              • SHA256 11ec7ecd5a19a8fe72634cde2986e2f64b054f8304f8bc65303b0df6606ac8da
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              recovery.jsonlz4
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\acaoqdel.default-release\sessionstore-backups\recovery.jsonlz4
              • Size 4KB
              • SHA256 6a64557bd64ad19981d2d28bf404ff3f2bf6b16ffab9c11c416505a95edfe56e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              directx.sys
              • Path C:\Windows\directx.sys
              • Size 34B
              • SHA256 8083b6294f20a9b1ffe3de2760d729323ab692aeebc91e4dfaf907b03b6577af
              • MD5 SHA1 SHA512
              Submit Download

              svchost.com
              • Path C:\Windows\svchost.com
              • Size 40KB
              • SHA256 d14ca7a0b977ff84658b3f765ef24af54fa46b36c5c93decbc4a4b8e712ff896
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/680-1013-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/680-734-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/680-248-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/680-687-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/680-1018-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/1432-714-0x000001BA79F00000-0x000001BA79FAC000-memory.dmp
              Download

              memory/1752-724-0x00000225AAB30000-0x00000225AABDC000-memory.dmp
              Download

              memory/2780-679-0x000001988BA00000-0x000001988BAAC000-memory.dmp
              Download

              memory/2780-243-0x00007FFB838F0000-0x00007FFB838F1000-memory.dmp
              Download

              memory/3156-288-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/3156-713-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/3156-228-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/3156-749-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/3156-1020-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/3156-1015-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/3160-688-0x000001ADBBDB0000-0x000001ADBBEA2000-memory.dmp
              Download

              memory/3160-612-0x000001ADC9AE0000-0x000001ADC9AF0000-memory.dmp
              Download

              memory/3160-1240-0x000001ADBBDB0000-0x000001ADBBEA2000-memory.dmp
              Download

              memory/3160-1014-0x000001ADBBDB0000-0x000001ADBBEA2000-memory.dmp
              Download

              memory/3160-1252-0x000001ADBBDB0000-0x000001ADBBEA2000-memory.dmp
              Download

              memory/3160-1226-0x000001ADBBDB0000-0x000001ADBBEA2000-memory.dmp
              Download

              memory/3160-735-0x000001ADBBDB0000-0x000001ADBBEA2000-memory.dmp
              Download

              memory/3160-1264-0x000001ADBBDB0000-0x000001ADBBEA2000-memory.dmp
              Download

              memory/3160-1040-0x000001ADBBDB0000-0x000001ADBBEA2000-memory.dmp
              Download

              memory/3160-1051-0x000001ADBBDB0000-0x000001ADBBEA2000-memory.dmp
              Download

              memory/3160-1234-0x000001ADBBDB0000-0x000001ADBBEA2000-memory.dmp
              Download

              memory/3160-1076-0x000001ADBBDB0000-0x000001ADBBEA2000-memory.dmp
              Download

              memory/3160-1103-0x000001ADBBDB0000-0x000001ADBBEA2000-memory.dmp
              Download

              memory/3160-1246-0x000001ADBBDB0000-0x000001ADBBEA2000-memory.dmp
              Download

              memory/3160-249-0x000001ADBBDB0000-0x000001ADBBEA2000-memory.dmp
              Download

              memory/3368-700-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/3948-723-0x000001E348300000-0x000001E3483AC000-memory.dmp
              Download

              memory/5368-694-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/5512-715-0x000002C5AE000000-0x000002C5AE0AC000-memory.dmp
              Download

              memory/5592-706-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/5708-712-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/6124-722-0x0000019D46300000-0x0000019D463AC000-memory.dmp
              Download