Overview

overview

10

Static

static

10

2026-09-24...op.exe

windows10-2004-x64

10

2026-09-24...op.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/09/2026, 03:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-24_ac17bcaac507c97928e980fa1dc3a4ab_darkgate_elex_glassworm_neshta_ransomhub_remcos_stealc_stop.exe
  • Size 6.0MB
  • Sample260924-dpc69scf96
  • SHA256 220a3e3086526f63f24de160f9e8dc868e945c2d9d0b2224e258a2ca0204af4d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasiondiscoveryneshtapersistencespywarestealertrojan

Malware Config

Signatures

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Detect Neshta payload 64 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
  • Executes dropped EXE 28 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Drops desktop.ini file(s) 3 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Checks system information in the registry 2 TTPs 2 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 16 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 21 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 22 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 19 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_ac17bcaac507c97928e980fa1dc3a4ab_darkgate_elex_glassworm_neshta_ransomhub_remcos_stealc_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_ac17bcaac507c97928e980fa1dc3a4ab_darkgate_elex_glassworm_neshta_ransomhub_remcos_stealc_stop.exe"
    1⤵
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2948
    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-09-24_ac17bcaac507c97928e980fa1dc3a4ab_darkgate_elex_glassworm_neshta_ransomhub_remcos_stealc_stop.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-09-24_ac17bcaac507c97928e980fa1dc3a4ab_darkgate_elex_glassworm_neshta_ransomhub_remcos_stealc_stop.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Installs/modifies Browser Helper Object
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2572
      • C:\Windows\system32\regsvr32.exe
        C:\Windows\Sysnative\regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\3582-490\IDMShellExt64.dll"
        3⤵
          PID:3936
        • C:\Windows\svchost.com
          "C:\Windows\svchost.com" "C:\PROGRA~1\MOZILL~1\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
          3⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5340
          • C:\PROGRA~1\MOZILL~1\firefox.exe
            C:\PROGRA~1\MOZILL~1\firefox.exe https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:5544
            • C:\PROGRA~1\MOZILL~1\firefox.exe
              C:\PROGRA~1\MOZILL~1\firefox.exe https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
              5⤵
              • Drops desktop.ini file(s)
              • Checks processor information in registry
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:4072
              • C:\PROGRA~1\MOZILL~1\firefox.exe
                "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1940 -prefsLen 27097 -prefMapHandle 1944 -prefMapSize 270279 -ipcHandle 2028 -initialChannelId {5fa9c9ef-3ed6-4753-ad70-e242d41d1acd} -parentPid 4072 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4072" -appDir "C:\PROGRA~1\MOZILL~1\browser" - 1 gpu
                6⤵
                  PID:2036
                • C:\PROGRA~1\MOZILL~1\firefox.exe
                  "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2424 -prefsLen 27133 -prefMapHandle 2428 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {46e661fa-e33c-43b0-892f-daed12cc65f8} -parentPid 4072 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4072" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 2 socket
                  6⤵
                    PID:1200
                  • C:\PROGRA~1\MOZILL~1\firefox.exe
                    "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -isForBrowser -prefsHandle 4092 -prefsLen 25213 -prefMapHandle 4100 -prefMapSize 270279 -jsInitHandle 4104 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4112 -initialChannelId {1486a546-7062-4f82-b681-e1be4705eca7} -parentPid 4072 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4072" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 3 tab
                    6⤵
                    • Checks processor information in registry
                    PID:2488
                  • C:\PROGRA~1\MOZILL~1\firefox.exe
                    "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4296 -prefsLen 27323 -prefMapHandle 4300 -prefMapSize 270279 -ipcHandle 4368 -initialChannelId {75c1ebcc-78ac-4129-bdb2-6215e8f8d419} -parentPid 4072 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4072" -appDir "C:\PROGRA~1\MOZILL~1\browser" - 4 rdd
                    6⤵
                      PID:388
                    • C:\PROGRA~1\MOZILL~1\firefox.exe
                      "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -isForBrowser -prefsHandle 3436 -prefsLen 34822 -prefMapHandle 2748 -prefMapSize 270279 -jsInitHandle 2836 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1600 -initialChannelId {d0541af9-0f4b-4540-8c60-d2cf82741252} -parentPid 4072 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4072" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 5 tab
                      6⤵
                      • Checks processor information in registry
                      PID:5808
                    • C:\PROGRA~1\MOZILL~1\firefox.exe
                      "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -isForBrowser -prefsHandle 2824 -prefsLen 34957 -prefMapHandle 2876 -prefMapSize 270279 -jsInitHandle 2880 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5116 -initialChannelId {e6ed85c9-1420-4dfa-842d-2d8ee163ec62} -parentPid 4072 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4072" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 6 tab
                      6⤵
                      • Checks processor information in registry
                      PID:3704
                    • C:\PROGRA~1\MOZILL~1\firefox.exe
                      "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5076 -prefsLen 35010 -prefMapHandle 4996 -prefMapSize 270279 -ipcHandle 5064 -initialChannelId {f9b473f1-9f5b-4ca6-98d2-3262452210c4} -parentPid 4072 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4072" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 7 utility
                      6⤵
                      • Checks processor information in registry
                      PID:4160
                    • C:\PROGRA~1\MOZILL~1\firefox.exe
                      "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -isForBrowser -prefsHandle 5456 -prefsLen 32900 -prefMapHandle 5460 -prefMapSize 270279 -jsInitHandle 5464 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5472 -initialChannelId {c5978453-2a3a-4f9b-8261-5ab97666d306} -parentPid 4072 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4072" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 8 tab
                      6⤵
                      • Checks processor information in registry
                      PID:3560
                    • C:\PROGRA~1\MOZILL~1\firefox.exe
                      "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -isForBrowser -prefsHandle 5660 -prefsLen 32952 -prefMapHandle 5664 -prefMapSize 270279 -jsInitHandle 5668 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5676 -initialChannelId {0e1b01d4-c89b-4307-8c87-74ec8029476f} -parentPid 4072 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4072" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 9 tab
                      6⤵
                      • Checks processor information in registry
                      PID:5248
                    • C:\PROGRA~1\MOZILL~1\firefox.exe
                      "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -isForBrowser -prefsHandle 5868 -prefsLen 32952 -prefMapHandle 5872 -prefMapSize 270279 -jsInitHandle 5876 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5696 -initialChannelId {c2863188-8adb-4ed7-a4c8-9a1393b78fc7} -parentPid 4072 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4072" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 10 tab
                      6⤵
                      • Checks processor information in registry
                      PID:5576
              • C:\Windows\svchost.com
                "C:\Windows\svchost.com" "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\3582-490\IDMShellExt64.dll"
                3⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1176
                • C:\Windows\SysWOW64\regsvr32.exe
                  C:\Windows\System32\regsvr32.exe /s C:\Users\Admin\AppData\Local\Temp\3582-490\IDMShellExt64.dll
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:5324
              • C:\Windows\svchost.com
                "C:\Windows\svchost.com" "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\3582-490\IDMIECC64.dll"
                3⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4280
                • C:\Windows\SysWOW64\regsvr32.exe
                  C:\Windows\System32\regsvr32.exe /s C:\Users\Admin\AppData\Local\Temp\3582-490\IDMIECC64.dll
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:3236
              • C:\Windows\svchost.com
                "C:\Windows\svchost.com" "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\3582-490\IDMGetAll64.dll"
                3⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1308
                • C:\Windows\SysWOW64\regsvr32.exe
                  C:\Windows\System32\regsvr32.exe /s C:\Users\Admin\AppData\Local\Temp\3582-490\IDMGetAll64.dll
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:6012
              • C:\Windows\svchost.com
                "C:\Windows\svchost.com" "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\3582-490\downlWithIDM64.dll"
                3⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4416
                • C:\Windows\SysWOW64\regsvr32.exe
                  C:\Windows\System32\regsvr32.exe /s C:\Users\Admin\AppData\Local\Temp\3582-490\downlWithIDM64.dll
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:2072
              • C:\Windows\svchost.com
                "C:\Windows\svchost.com" "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" https://www.internetdownloadmanager.com/welcome.html?v=643b10
                3⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2396
                • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                  C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe https://www.internetdownloadmanager.com/welcome.html?v=643b10
                  4⤵
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Checks system information in the registry
                  • Drops file in Windows directory
                  • Enumerates system info in registry
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of WriteProcessMemory
                  • System policy modification
                  PID:4572
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 --annotation=exe=C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x35c,0x7ffe7785c188,0x7ffe7785c194,0x7ffe7785c1a0
                    5⤵
                    • Executes dropped EXE
                    PID:3980
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,7931837764823774161,1757117957213663034,524288 --field-trial-handle=2324,i,17727004146202841294,12098054956436480562,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:11
                    5⤵
                    • Executes dropped EXE
                    • System Time Discovery
                    PID:2644
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1584,i,6615925541609373163,10721207879885242508,262144 --field-trial-handle=2324,i,17727004146202841294,12098054956436480562,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
                    5⤵
                    • Executes dropped EXE
                    PID:1740
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2528,i,8982503594441763272,11242380417900871680,524288 --field-trial-handle=2324,i,17727004146202841294,12098054956436480562,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:13
                    5⤵
                    • Executes dropped EXE
                    PID:3448
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,9539216800672484181,12724623153436393433,2097152 --field-trial-handle=2324,i,17727004146202841294,12098054956436480562,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
                    5⤵
                    • Executes dropped EXE
                    PID:4936
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,12113567211036176177,7746533610631008926,2097152 --field-trial-handle=2324,i,17727004146202841294,12098054956436480562,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
                    5⤵
                    • Executes dropped EXE
                    PID:2980
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4168,i,12824072054346205606,15864444924817601743,2097152 --field-trial-handle=2324,i,17727004146202841294,12098054956436480562,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:9
                    5⤵
                    • Executes dropped EXE
                    PID:5556
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4156,i,2201645344842601725,16709201098032408722,2097152 --field-trial-handle=2324,i,17727004146202841294,12098054956436480562,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:1
                    5⤵
                    • Executes dropped EXE
                    PID:5940
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,4949435790809796855,13285297955309113538,524288 --field-trial-handle=2324,i,17727004146202841294,12098054956436480562,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:14
                    5⤵
                    • Executes dropped EXE
                    PID:5608
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,801290868314421377,4889353188330561047,524288 --field-trial-handle=2324,i,17727004146202841294,12098054956436480562,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
                    5⤵
                    • Executes dropped EXE
                    PID:3460
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,15606193745233617108,4573996430591755877,524288 --field-trial-handle=2324,i,17727004146202841294,12098054956436480562,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
                    5⤵
                    • Executes dropped EXE
                    PID:2524
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,8745563048338734550,9801809700946754102,524288 --field-trial-handle=2324,i,17727004146202841294,12098054956436480562,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
                    5⤵
                    • Executes dropped EXE
                    PID:1632
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,16101151430619656537,10385038634362426913,524288 --field-trial-handle=2324,i,17727004146202841294,12098054956436480562,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
                    5⤵
                    • Executes dropped EXE
                    PID:708
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,4303829534130918750,5141397729275268386,524288 --field-trial-handle=2324,i,17727004146202841294,12098054956436480562,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:14
                    5⤵
                    • Executes dropped EXE
                    PID:2428
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,10955339632074748049,5473092809704472378,524288 --field-trial-handle=2324,i,17727004146202841294,12098054956436480562,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:14
                    5⤵
                    • Executes dropped EXE
                    PID:5016
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,7089951901086866420,6385209810384836937,524288 --field-trial-handle=2324,i,17727004146202841294,12098054956436480562,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:14
                    5⤵
                    • Executes dropped EXE
                    PID:6064
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,12155715173762659717,10219608324537047950,524288 --field-trial-handle=2324,i,17727004146202841294,12098054956436480562,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:14
                    5⤵
                    • Executes dropped EXE
                    PID:2216
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,17519657459938876570,16463137309796343305,524288 --field-trial-handle=2324,i,17727004146202841294,12098054956436480562,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:14
                    5⤵
                    • Executes dropped EXE
                    PID:3364
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,6426049276692676684,18006222104960005208,524288 --field-trial-handle=2324,i,17727004146202841294,12098054956436480562,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:14
                    5⤵
                    • Executes dropped EXE
                    PID:2776
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 1984
                3⤵
                • Program crash
                PID:3316
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2572 -ip 2572
            1⤵
              PID:2320
            • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
              "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --no-startup-window --win-session-start
              1⤵
              • Executes dropped EXE
              PID:4336

            Network

                  MITRE ATT&CK Enterprise v16

                  Reconnaissance

                  Resource Development

                  Initial Access

                  Execution

                  Persistence

                  Boot or Logon Autostart Execution

                  1
                  T1547

                  Registry Run Keys / Startup Folder

                  1
                  T1547.001

                  Browser Extensions

                  1
                  T1176

                  Event Triggered Execution

                  1
                  T1546

                  Change Default File Association

                  1
                  T1546.001

                  Privilege Escalation

                  Boot or Logon Autostart Execution

                  1
                  T1547

                  Registry Run Keys / Startup Folder

                  1
                  T1547.001

                  Event Triggered Execution

                  1
                  T1546

                  Change Default File Association

                  1
                  T1546.001

                  Defense Evasion

                  Modify Registry

                  5
                  T1112

                  Credential Access

                  Credentials from Password Stores

                  1
                  T1555

                  Credentials from Web Browsers

                  1
                  T1555.003

                  Unsecured Credentials

                  1
                  T1552

                  Credentials In Files

                  1
                  T1552.001

                  Discovery

                  Browser Information Discovery

                  1
                  T1217

                  Query Registry

                  5
                  T1012

                  System Information Discovery

                  5
                  T1082

                  System Location Discovery

                  1
                  T1614

                  System Language Discovery

                  1
                  T1614.001

                  System Time Discovery

                  1
                  T1124

                  Lateral Movement

                  Collection

                  Data from Local System

                  1
                  T1005

                  Command and Control

                  Exfiltration

                  Impact

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  ACROBR~1.EXE
                  • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE
                  • Size 328KB
                  • SHA256 888a1dd0033e5d758a4e731e3e55357de866e80d03b1b194375f714e1fd4351d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ACROTE~1.EXE
                  • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
                  • Size 86KB
                  • SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ADOBEC~1.EXE
                  • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE
                  • Size 5.7MB
                  • SHA256 1b5c715d71384f043843ea1785a6873a9f39d2daae112ccdeffcd88b10a3a403
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ADelRCP.exe
                  • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe
                  • Size 175KB
                  • SHA256 3f00404dd591c2856e6f71bd78423ed47199902e0b85f228e6c4de72c59ddffe
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  RdrCEF.exe
                  • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe
                  • Size 9.4MB
                  • SHA256 31da9632f5d25806b77b617d48da52a14afc574bbe1653120f97705284ea566c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  AcroRd32.exe
                  • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
                  • Size 2.4MB
                  • SHA256 8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  WCCHRO~1.EXE
                  • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE
                  • Size 183KB
                  • SHA256 ecd5e94da88c653e4c34b6ab325e0aca8824247b290336f75c410caa16381bc5
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Eula.exe
                  • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe
                  • Size 131KB
                  • SHA256 5c3ef3ec7594c040146e908014791dd15201ba58b4d70032770bb661b6a0e394
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  FULLTR~1.EXE
                  • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE
                  • Size 254KB
                  • SHA256 16d65f2463658a72dba205dcaa18bc3d0bab4453e726233d68bc176e69db0950
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  LOGTRA~1.EXE
                  • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE
                  • Size 386KB
                  • SHA256 473eb551101caeaf2d18f811342e21de323c8dd19ed21011997716871defe997
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  READER~1.EXE
                  • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE
                  • Size 92KB
                  • SHA256 2f947e3ca624ce7373080b4a3934e21644fb070a53feeaae442b15b849c2954f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  WOW_HE~1.EXE
                  • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE
                  • Size 147KB
                  • SHA256 750824b5f75c91a6c2eeb8c5e60ae28d7a81e323d3762c8652255bfea5cba0bb
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  arh.exe
                  • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe
                  • Size 125KB
                  • SHA256 fe44ca8d5050932851aa54c23133277e66db939501af58e5aeb7b67ec1dde7b5
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  32BITM~1.EXE
                  • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE
                  • Size 142KB
                  • SHA256 3e9da97a7106122245e77f13f3f3cc96c055d732ab841eb848d03ac25401c1bc
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  64BITM~1.EXE
                  • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE
                  • Size 278KB
                  • SHA256 22a585c183e27b3c732028ff193733c2f9d03700a0e95e65c556b0592c43d880
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ADOBEA~1.EXE
                  • Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE
                  • Size 454KB
                  • SHA256 bb07d817b8b1b6b4c25e62b6120e51dec10118557d7b6b696ad084a5ba5bfdeb
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  AdobeARM.exe
                  • Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe
                  • Size 1.2MB
                  • SHA256 b1ec065f71cc40f400e006586d370997102860504fd643b235e8ed9f5607262a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  jaureg.exe
                  • Path C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe
                  • Size 555KB
                  • SHA256 c5a99f42100834599e4995d0a178b32b772a6e774a4050a6bb00438af0a6a1f3
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  VSTOIN~1.EXE
                  • Path C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE
                  • Size 121KB
                  • SHA256 405b8bd647fa703e233b8b609a18999abe465a8458168f1daf23197bd2ea36aa
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  java.exe
                  • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe
                  • Size 325KB
                  • SHA256 5e2e22ead49ce9cc11141dbeebbe5b93a530c966695d8efc2083f00e6be53423
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  javaw.exe
                  • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe
                  • Size 325KB
                  • SHA256 e2262c798729169f697e6c30e5211cde604fd8b14769311ff4ea81abba8c2781
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  javaws.exe
                  • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe
                  • Size 505KB
                  • SHA256 da73b6e071788372702104b9c72b6697e84e7c75e248e964996700b77c6b6f1c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  DISABL~1.EXE
                  • Path C:\PROGRA~2\Google\Update\DISABL~1.EXE
                  • Size 5.7MB
                  • SHA256 3acf99624820fd862ac30780021108f0ff2df60db3df351cd17400404f279d3c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MI9C33~1.EXE
                  • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MI9C33~1.EXE
                  • Size 138KB
                  • SHA256 3bc53b54d6a2f0819c5f9fc43e9fc3b6579843c23b37039b6711c2af5a726cd1
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MIA062~1.EXE
                  • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MIA062~1.EXE
                  • Size 1.6MB
                  • SHA256 500ea5da5125d05f27a8889af81ddbaa16d357588dce8f339672512b42e9e54a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MICROS~1.EXE
                  • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MICROS~1.EXE
                  • Size 223KB
                  • SHA256 fe2d4359da69b28aa924ea8e144c8cb12250be7f8ab41485b4b86fe40ab49e14
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MICROS~2.EXE
                  • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MICROS~2.EXE
                  • Size 242KB
                  • SHA256 e1680751388c4af523a769ce4e16ae013c7d8b7a1b03e56b97525bbb918b647b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MICROS~3.EXE
                  • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MICROS~3.EXE
                  • Size 138KB
                  • SHA256 0c67d6d3361be736320cca1522b7a08cfaf7aaa8f04311dfeae2eaff8415834c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MICROS~4.EXE
                  • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MICROS~4.EXE
                  • Size 256KB
                  • SHA256 54680d4ec289fc3dab85466803f01a6d7be5933abab940f7e1ec597c32aa7f64
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MID1AD~1.EXE
                  • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MID1AD~1.EXE
                  • Size 302KB
                  • SHA256 7bda2feca295068adc7109ae2092010212a1f130d01d11b0b15843733d8832b1
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MICROS~1.EXE
                  • Path C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MICROS~1.EXE
                  • Size 242KB
                  • SHA256 03044d2ffe2c87ce479dbdb722183cb7f806510a5b27460153ef9b3906a0f7ec
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MICROS~4.EXE
                  • Path C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MICROS~4.EXE
                  • Size 223KB
                  • SHA256 2b29cceb8d78c397f9be4f35f54752078e1d1d51653a8cbddbd06f7ccc860602
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ie_to_edge_stub.exe
                  • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\BHO\ie_to_edge_stub.exe
                  • Size 553KB
                  • SHA256 7b2d809ff4b2691c04855f4bb3d89b88fa4d1d65c8c35d3941a26f015947cde9
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  setup.exe
                  • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\INSTAL~1\setup.exe
                  • Size 6.8MB
                  • SHA256 78e1d1e4460914eb8be59bb96d9897562a0ac65a5fbce63349f43ee56ba5e83b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cookie_exporter.exe
                  • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\cookie_exporter.exe
                  • Size 157KB
                  • SHA256 3ecafed639ffb272e758902d1baa0b399c044bfb744cedd6bda1ed40516ca132
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  elevation_service.exe
                  • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\elevation_service.exe
                  • Size 1.7MB
                  • SHA256 2177d0e64ef5cd4d3ad386606feb8d45ae0a7d070f19583b67eea9407272b9f0
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  identity_helper.exe
                  • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\identity_helper.exe
                  • Size 1.2MB
                  • SHA256 d2decf24ecc69018df3da6dde66ca81e168dbcea91c6d4ceb428a1929778b39e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  msedge.exe
                  • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedge.exe
                  • Size 3.9MB
                  • SHA256 39cf8228fc39959bcd27f64512c81e5049eeed843387016d4c733982b622706d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  msedge_proxy.exe
                  • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedge_proxy.exe
                  • Size 1.2MB
                  • SHA256 6f3f49143cab7ee4c239f74f6649241ddd527040ea390a3a214b1d7b8f113fc7
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  msedge_pwa_launcher.exe
                  • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedge_pwa_launcher.exe
                  • Size 1.6MB
                  • SHA256 c3f6a5111276371edf9e46fcb05869f993cb17cac5f8033ee5707ecddc244f5f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  msedgewebview2.exe
                  • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedgewebview2.exe
                  • Size 3.5MB
                  • SHA256 47df542ec5d28a6c75c2d815e9b700c65f587186c02c8f1a2566fdab9e3b5d01
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  notification_helper.exe
                  • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\notification_helper.exe
                  • Size 1.4MB
                  • SHA256 964abff6df613e4f987fa1615a0f7963d177c3c7418b4a719c3121e9752b5a00
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  pwahelper.exe
                  • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\pwahelper.exe
                  • Size 1.2MB
                  • SHA256 07b4d83c273dd032f6a763951adc1196ca00568ce2cef2cd9c3a310788fbcd78
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ie_to_edge_stub.exe
                  • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\BHO\ie_to_edge_stub.exe
                  • Size 562KB
                  • SHA256 533d6da98378d3b1bb120b192bc5bd20bbeed6e123fe9fc6c15a4a3504932c71
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  setup.exe
                  • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\INSTAL~1\setup.exe
                  • Size 7.1MB
                  • SHA256 70c13c14a682d65fd82ec72f578e160617f8b7c164414bcce613a9b9ebd0c878
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  cookie_exporter.exe
                  • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\cookie_exporter.exe
                  • Size 155KB
                  • SHA256 30d26d2f766f716cd6b21cdc15065ee4191760ef0d37de51f67dead898fb8e7c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  elevated_tracing_service.exe
                  • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevated_tracing_service.exe
                  • Size 3.8MB
                  • SHA256 c13ce5f473ff68ffdea61e8a4800008f527054f4561f2bf7853f6769d0c02dc5
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  elevation_service.exe
                  • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevation_service.exe
                  • Size 2.2MB
                  • SHA256 8c53985c403e44c0c899c2d1f2a0b8afb1f17fb928ff866271de7952c9ff7c66
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  identity_helper.exe
                  • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\identity_helper.exe
                  • Size 1.4MB
                  • SHA256 cd0adfcf43373e05fcf8836cc998cb17e3aaade9f8b190e28ce4331bd026f23c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  msedge_pwa_launcher.exe
                  • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge_pwa_launcher.exe
                  • Size 1.8MB
                  • SHA256 2c31887681976e9691cfed32b98a9f81898beaaee9ea3f7a90fe695b84190511
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  msedgewebview2.exe
                  • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedgewebview2.exe
                  • Size 3.4MB
                  • SHA256 c0566225b047e50773acde8ada568ef7612809e74f2cc200504e60cf7a917c68
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  notification_click_helper.exe
                  • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\notification_click_helper.exe
                  • Size 1.6MB
                  • SHA256 0faa9f1f62a95136d454efa51e6f8e8ff06a08d344fd26dc2216de09f6fbee4e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MSEDGE~1.EXE
                  • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE
                  • Size 1.5MB
                  • SHA256 b4bdab2b2c7731923854f254ba1494c25a11331293c0ee4939afd10ba1e2b575
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  PWAHEL~1.EXE
                  • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE
                  • Size 1.4MB
                  • SHA256 df233ebee614cd9117f7e467f16f4c2225aadbc59213a5695913a4a87f792d6a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  msedge.exe
                  • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                  • Size 4.0MB
                  • SHA256 18f4157c2dabb39cf84662e17c471f69f679840a70be3a4685e0c4ed8ccc207a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  msedge.exe
                  • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                  • Size 3.9MB
                  • SHA256 6d8e5d6a4d1c147b90b5a394a5054840e19dfa3eae3ea706ffb367477cecb929
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  settings.dat
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                  • Size 280B
                  • SHA256 4123fa2cc2e73053b7602d1d53a57b01f3a6cd8872729fcd7ed66886082b1b99
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  settings.dat
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                  • Size 280B
                  • SHA256 a201096456be1e380b7687844e70aa8e2d987a06740acf66db0d56e000a3b50d
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  the-real-index
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                  • Size 2KB
                  • SHA256 37c89efd078d7ccf3b181b3e4f975429447daf70880f5a4048183db8dcc56b69
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  the-real-index~RFe5b76f2.TMP
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5b76f2.TMP
                  • Size 2KB
                  • SHA256 2ba70d84cf371ce9fa838c83a6faef8a2e1fa22ac28cb77c7b81d5f26a580734
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  SiteList-Enterprise.json
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                  • Size 2B
                  • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                  • MD5 SHA1 SHA512
                  Submit Download

                  Edge Profile.ico
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                  • Size 70KB
                  • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  01f18343-d583-481b-a727-f72ff0483bdf.tmp
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\01f18343-d583-481b-a727-f72ff0483bdf.tmp
                  • Size 2B
                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                  • MD5 SHA1 SHA512
                  Submit Download

                  Network Persistent State
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                  • Size 2KB
                  • SHA256 81084378f2acdd223ae6d63dd3905f4cfa380374970898c458b9313fcd4b5d36
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Sdch Dictionaries
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                  • Size 40B
                  • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                  • MD5 SHA1 SHA512
                  Submit Download

                  Preferences
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                  • Size 11KB
                  • SHA256 3989f4f68fc5355ab0d827ea1a7643b6af8ba8cdd79afb3496d0db8746c94cfd
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Preferences
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                  • Size 12KB
                  • SHA256 e021626d254e368c1c695bfe589eb975bfdd7150eb2af100945e397dd2859616
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Preferences
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                  • Size 12KB
                  • SHA256 6f4c7d1725a68c04472b1f0ca3b8cfa87dff17e4f9cff8a7c52b58c516a3bc10
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Secure Preferences
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                  • Size 27KB
                  • SHA256 934b152a2a1548a86226e7b9ad6e330fd87212445c078eaa3f2ad019c1a9f867
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  OperationConfig
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                  • Size 22KB
                  • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  OperationConfig~RFe5c071c.TMP
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5c071c.TMP
                  • Size 3KB
                  • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  Local State
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                  • Size 28KB
                  • SHA256 11099bde967bf66b2c0da317ee1f3312a20dab5a780301f82bbc2c3a8a6d72e7
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Local State
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                  • Size 32KB
                  • SHA256 d16cc814a08d063e605efbcd64ec0f57fc9cdf16093052bdf95a98432147955c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Local State
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                  • Size 37KB
                  • SHA256 8e75d4d9d0de304a706abe927627fc61ebf84a76982f31deeb2c8767c9c9b87d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Local State
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                  • Size 37KB
                  • SHA256 65b703837f9516cc6ba7b0f70c8978db74c2b3af148c3ebdf0046fb48aeeda25
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Local State
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                  • Size 37KB
                  • SHA256 d316a13eb9e78a4bafb122639b47772b43bb82f0c8de72465f3c61277a353e62
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Local State
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                  • Size 37KB
                  • SHA256 df04f666d0688a42ac4c8e455412527b00e831ca6dc8cb40804bf4c2164678a2
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Local State
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                  • Size 28KB
                  • SHA256 b12ba10fc2585d0789fb8c568af2b324de05dc362b74a6c3e3c73609ca41bd81
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  metadata.json
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                  • Size 132B
                  • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  metadata.json
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                  • Size 252B
                  • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  de7f1abb-d6e5-4e54-aceb-12e691ca95c1.tmp
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\de7f1abb-d6e5-4e54-aceb-12e691ca95c1.tmp
                  • Size 13B
                  • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                  • MD5 SHA1 SHA512
                  Submit Download

                  AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ej9v93ms.default-release\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
                  • Size 16KB
                  • SHA256 2c8adae8668526ffe6d8bd7ce2927e042210f01033d866c85c704ac683b83f66
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  webext.sc.lz4
                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ej9v93ms.default-release\startupCache\webext.sc.lz4
                  • Size 104KB
                  • SHA256 eea6752115cc69308ab6408550543fe2ab7a6a7161a13d084955da884a057941
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  2026-09-24_ac17bcaac507c97928e980fa1dc3a4ab_darkgate_elex_glassworm_neshta_ransomhub_remcos_stealc_stop.exe
                  • Path C:\Users\Admin\AppData\Local\Temp\3582-490\2026-09-24_ac17bcaac507c97928e980fa1dc3a4ab_darkgate_elex_glassworm_neshta_ransomhub_remcos_stealc_stop.exe
                  • Size 5.9MB
                  • SHA256 1016152e6dcfc70f38e4036995419b966f12ef655d279f5bf634104fc54758eb
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  content_new.js
                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4572_1995936632\CRX_INSTALL\content_new.js
                  • Size 10KB
                  • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  tmpaddon
                  • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                  • Size 11KB
                  • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  tmpaddon
                  • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                  • Size 502KB
                  • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  data.safe.tmp
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\db\data.safe.tmp
                  • Size 32KB
                  • SHA256 2d98a595743a1cc5cb3b9257ca4df59408f69d2b851ade00b55e392e5a5ba54c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  data.safe.tmp
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\db\data.safe.tmp
                  • Size 5KB
                  • SHA256 3fb3701f8eb617fe95b2e09f4e66a4139da9b16c7230e92d6fccb54a85102d95
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  data.safe.tmp
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\db\data.safe.tmp
                  • Size 32KB
                  • SHA256 2c9cb1c2c3ea1d7672385a98ac480b383ef09f7880c9ebb1e341f79ee4dd6710
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  data.safe.tmp
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\db\data.safe.tmp
                  • Size 32KB
                  • SHA256 2aa4d4154a93bd62c17955b5e426d57ec37f7879e5b81efcc782d7108af761e4
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  data.safe.tmp
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\db\data.safe.tmp
                  • Size 7KB
                  • SHA256 e0c88787abc024cfdeb0b43d6ca08e053e5e6c89925a1141d6a17ffffedf2764
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  events
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\events\events
                  • Size 1KB
                  • SHA256 81db378ca732b99694b805596e89cd10a633715b6f1bbdf803cc28241a341d28
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  463a09f8-d2c8-4239-880d-75bfec6f9de4
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\pending_pings\463a09f8-d2c8-4239-880d-75bfec6f9de4
                  • Size 16KB
                  • SHA256 128eca21c7c227d05cac7fb6cabbfe1cdf17822f38047a647894ca8c1c505c23
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  70329677-6924-45be-9cdc-0b5e3d7bfa4c
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\pending_pings\70329677-6924-45be-9cdc-0b5e3d7bfa4c
                  • Size 235B
                  • SHA256 5e4fb27aa35ff647383657e2a05bff802649f6116cf91946087b219e26236928
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  74a179bd-3bed-43fe-88d3-bc8f83101b69
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\pending_pings\74a179bd-3bed-43fe-88d3-bc8f83101b69
                  • Size 2KB
                  • SHA256 69462333baa9f5662b4d5f8e735fa74e10021623751b6b9bf477bf91ee026e56
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  95d38013-dcfb-47ea-b494-c401c2bcdf8d
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\pending_pings\95d38013-dcfb-47ea-b494-c401c2bcdf8d
                  • Size 235B
                  • SHA256 8cb3b635e2460347abe747a3a2687ff8df25ba96942aa38a9955b5e555ef3254
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  bd8ca67c-2929-4427-b2c7-5c0e0466b88d
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\pending_pings\bd8ca67c-2929-4427-b2c7-5c0e0466b88d
                  • Size 886B
                  • SHA256 737f52c9f716e3d0f1b4ad13a1cdbc6ad8d33710b06d2cf4f9fe484886e09d0b
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  d840c7ea-0af0-4e62-8a50-1c5db25aa43c
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\pending_pings\d840c7ea-0af0-4e62-8a50-1c5db25aa43c
                  • Size 883B
                  • SHA256 b9cb0df23212a5537e75a9bf725a513e5fe4ee4f8d06a1ee65022ba4168e79e8
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  extensions.json
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\extensions.json
                  • Size 16KB
                  • SHA256 fccb86f024c0fb44bac41574aaf53a0be77a0d19e862d7f5a3cf396ad70eb537
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  gmpopenh264.dll
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                  • Size 1.1MB
                  • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  gmpopenh264.info
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                  • Size 116B
                  • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  manifest.json
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
                  • Size 1002B
                  • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  widevinecdm.dll
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
                  • Size 21.6MB
                  • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  prefs-1.js
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\prefs-1.js
                  • Size 6KB
                  • SHA256 3f9fb9dc7a127d9ade614c51f1da47108ef69205f4b143faecf2c74ff44227d8
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  prefs-1.js
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\prefs-1.js
                  • Size 7KB
                  • SHA256 31956192d08773c3692e1ac80f672250bf40638927abd2521678966bd6fda69d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  prefs-1.js
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\prefs-1.js
                  • Size 6KB
                  • SHA256 c43771e552d8e3dd85de2d14df8006ebbb8df23af5986e27f514cb5fde5094b4
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  prefs.js
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\prefs.js
                  • Size 6KB
                  • SHA256 3826632827f791c00d99ff6c2749ed8ebbd17bd7ab0fd01683d2aebf1082ebf4
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  prefs.js
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\prefs.js
                  • Size 6KB
                  • SHA256 133bcb275fe57f4a1c15b04f0723572eb6471b23b0dd11609c724c4fd752ff00
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  recovery.baklz4
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\sessionstore-backups\recovery.baklz4
                  • Size 4KB
                  • SHA256 164a43c6fa92077afb6769d7d7393979c52149c0710f2b28611ee92e940898a5
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  recovery.jsonlz4
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\sessionstore-backups\recovery.jsonlz4
                  • Size 4KB
                  • SHA256 60f17a2a214186568fa14f6a23f7036aa073ff04db3f09fc1fd3f3a86091ef50
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  3870112724rsegmnoittet-es.sqlite
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                  • Size 6.6MB
                  • SHA256 0128cec2b62b9f1dc643d6d8104bc392910c27de406ab2d75140ee325efd8e70
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  3870112724rsegmnoittet-es.sqlite
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                  • Size 7.3MB
                  • SHA256 4d97e57981664dde0d8e0715f74ae4618a447d9958473c70ef90af73a672acf0
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  3870112724rsegmnoittet-es.sqlite
                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                  • Size 7.4MB
                  • SHA256 0712aab1cbabec09d15517ef7933bc2934bbdf0bcc16b613f75528dcd3f0085e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  directx.sys
                  • Path C:\Windows\directx.sys
                  • Size 34B
                  • SHA256 8083b6294f20a9b1ffe3de2760d729323ab692aeebc91e4dfaf907b03b6577af
                  • MD5 SHA1 SHA512
                  Submit Download

                  directx.sys
                  • Path C:\Windows\directx.sys
                  • Size 47B
                  • SHA256 1ca11ed09e232331ff2d75bce2948f38a3149c592bd059c18380b266d56a26ec
                  • MD5 SHA1 SHA512
                  Submit Download

                  svchost.com
                  • Path C:\Windows\svchost.com
                  • Size 40KB
                  • SHA256 d14ca7a0b977ff84658b3f765ef24af54fa46b36c5c93decbc4a4b8e712ff896
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  memory/1176-686-0x0000000000400000-0x000000000041B000-memory.dmp
                  Download

                  memory/1308-698-0x0000000000400000-0x000000000041B000-memory.dmp
                  Download

                  memory/1740-1200-0x0000029C1BFA0000-0x0000029C1BFCF000-memory.dmp
                  Download

                  memory/1740-879-0x00007FFE9BE20000-0x00007FFE9BE21000-memory.dmp
                  Download

                  memory/2216-1543-0x000002A5E6F80000-0x000002A5E6FAF000-memory.dmp
                  Download

                  memory/2396-841-0x0000000000400000-0x000000000041B000-memory.dmp
                  Download

                  memory/2488-239-0x00007FFE9BE20000-0x00007FFE9BE21000-memory.dmp
                  Download

                  memory/2948-732-0x0000000000400000-0x000000000041B000-memory.dmp
                  Download

                  memory/2948-1045-0x0000000000400000-0x000000000041B000-memory.dmp
                  Download

                  memory/2948-1281-0x0000000000400000-0x000000000041B000-memory.dmp
                  Download

                  memory/2948-642-0x0000000000400000-0x000000000041B000-memory.dmp
                  Download

                  memory/2948-227-0x0000000000400000-0x000000000041B000-memory.dmp
                  Download

                  memory/2948-727-0x0000000000400000-0x000000000041B000-memory.dmp
                  Download

                  memory/4072-1323-0x00000164C3920000-0x00000164C3A12000-memory.dmp
                  Download

                  memory/4072-615-0x00000164C3920000-0x00000164C3A12000-memory.dmp
                  Download

                  memory/4072-1618-0x00000164C3920000-0x00000164C3A12000-memory.dmp
                  Download

                  memory/4072-722-0x00000164C3920000-0x00000164C3A12000-memory.dmp
                  Download

                  memory/4072-1487-0x00000164C3920000-0x00000164C3A12000-memory.dmp
                  Download

                  memory/4072-573-0x00000164D5790000-0x00000164D57A0000-memory.dmp
                  Download

                  memory/4072-1599-0x00000164C3920000-0x00000164C3A12000-memory.dmp
                  Download

                  memory/4072-1506-0x00000164C3920000-0x00000164C3A12000-memory.dmp
                  Download

                  memory/4072-1510-0x00000164C3920000-0x00000164C3A12000-memory.dmp
                  Download

                  memory/4072-1574-0x00000164C3920000-0x00000164C3A12000-memory.dmp
                  Download

                  memory/4072-1013-0x00000164C3920000-0x00000164C3A12000-memory.dmp
                  Download

                  memory/4072-1525-0x00000164C3920000-0x00000164C3A12000-memory.dmp
                  Download

                  memory/4072-1549-0x00000164C3920000-0x00000164C3A12000-memory.dmp
                  Download

                  memory/4072-731-0x00000164C3920000-0x00000164C3A12000-memory.dmp
                  Download

                  memory/4280-692-0x0000000000400000-0x000000000041B000-memory.dmp
                  Download

                  memory/4416-704-0x0000000000400000-0x000000000041B000-memory.dmp
                  Download

                  memory/4936-881-0x00007FFE9BE20000-0x00007FFE9BE21000-memory.dmp
                  Download

                  memory/5340-1280-0x0000000000400000-0x000000000041B000-memory.dmp
                  Download

                  memory/5340-721-0x0000000000400000-0x000000000041B000-memory.dmp
                  Download

                  memory/5340-1012-0x0000000000400000-0x000000000041B000-memory.dmp
                  Download

                  memory/5340-614-0x0000000000400000-0x000000000041B000-memory.dmp
                  Download

                  memory/5340-730-0x0000000000400000-0x000000000041B000-memory.dmp
                  Download