Overview

overview

10

Static

static

10

2026-09-24...op.exe

windows10-2004-x64

10

2026-09-24...op.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/09/2026, 04:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-24_2b3d42ceb0786e5cf725c493544acde3_darkgate_elex_glassworm_neshta_ransomhub_remcos_stealc_stop.exe
  • Size 5.9MB
  • Sample260924-epgp5adf73
  • SHA256 e3d11a8365954c73128012dc69513023810144b2187ecf091b079e5f1151e4e2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasiondiscoveryneshtapersistencespywarestealertrojan

Malware Config

Signatures

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Detect Neshta payload 64 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
  • Executes dropped EXE 28 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Drops desktop.ini file(s) 3 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Checks system information in the registry 2 TTPs 2 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 16 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 21 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 22 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 19 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_2b3d42ceb0786e5cf725c493544acde3_darkgate_elex_glassworm_neshta_ransomhub_remcos_stealc_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2b3d42ceb0786e5cf725c493544acde3_darkgate_elex_glassworm_neshta_ransomhub_remcos_stealc_stop.exe"
    1⤵
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:5800
    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-09-24_2b3d42ceb0786e5cf725c493544acde3_darkgate_elex_glassworm_neshta_ransomhub_remcos_stealc_stop.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-09-24_2b3d42ceb0786e5cf725c493544acde3_darkgate_elex_glassworm_neshta_ransomhub_remcos_stealc_stop.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Installs/modifies Browser Helper Object
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4904
      • C:\Windows\system32\regsvr32.exe
        C:\Windows\Sysnative\regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\3582-490\IDMShellExt64.dll"
        3⤵
          PID:4732
        • C:\Windows\svchost.com
          "C:\Windows\svchost.com" "C:\PROGRA~1\MOZILL~1\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
          3⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4988
          • C:\PROGRA~1\MOZILL~1\firefox.exe
            C:\PROGRA~1\MOZILL~1\firefox.exe https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:256
            • C:\PROGRA~1\MOZILL~1\firefox.exe
              C:\PROGRA~1\MOZILL~1\firefox.exe https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
              5⤵
              • Drops desktop.ini file(s)
              • Checks processor information in registry
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:760
              • C:\PROGRA~1\MOZILL~1\firefox.exe
                "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1944 -prefsLen 27097 -prefMapHandle 1948 -prefMapSize 270279 -ipcHandle 2032 -initialChannelId {7ba24799-4e9e-47c3-8ed2-17e998ceb14c} -parentPid 760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.760" -appDir "C:\PROGRA~1\MOZILL~1\browser" - 1 gpu
                6⤵
                  PID:5108
                • C:\PROGRA~1\MOZILL~1\firefox.exe
                  "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2424 -prefsLen 27133 -prefMapHandle 2428 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {fa6607f2-bf54-4673-88ec-e4e92fcd33d8} -parentPid 760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.760" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 2 socket
                  6⤵
                    PID:5928
                  • C:\PROGRA~1\MOZILL~1\firefox.exe
                    "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -isForBrowser -prefsHandle 3824 -prefsLen 25213 -prefMapHandle 3828 -prefMapSize 270279 -jsInitHandle 3832 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3840 -initialChannelId {a7f98bbb-235c-4e80-88cb-53fcf2db4258} -parentPid 760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.760" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 3 tab
                    6⤵
                    • Checks processor information in registry
                    PID:3344
                  • C:\PROGRA~1\MOZILL~1\firefox.exe
                    "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4012 -prefsLen 27323 -prefMapHandle 4016 -prefMapSize 270279 -ipcHandle 3872 -initialChannelId {64f8d5b8-2d2a-4a29-b697-a084bc131b42} -parentPid 760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.760" -appDir "C:\PROGRA~1\MOZILL~1\browser" - 4 rdd
                    6⤵
                      PID:4796
                    • C:\PROGRA~1\MOZILL~1\firefox.exe
                      "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -isForBrowser -prefsHandle 2972 -prefsLen 34822 -prefMapHandle 3016 -prefMapSize 270279 -jsInitHandle 3020 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3044 -initialChannelId {79bb39b1-26d2-4a4c-a930-38ab6d71703a} -parentPid 760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.760" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 5 tab
                      6⤵
                      • Checks processor information in registry
                      PID:5704
                    • C:\PROGRA~1\MOZILL~1\firefox.exe
                      "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5236 -prefsLen 35010 -prefMapHandle 5240 -prefMapSize 270279 -ipcHandle 5220 -initialChannelId {63e6fdbb-eead-45ca-975e-112f5628bb34} -parentPid 760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.760" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 6 utility
                      6⤵
                      • Checks processor information in registry
                      PID:936
                    • C:\PROGRA~1\MOZILL~1\firefox.exe
                      "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -isForBrowser -prefsHandle 5532 -prefsLen 35092 -prefMapHandle 2780 -prefMapSize 270279 -jsInitHandle 3024 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5232 -initialChannelId {08176d26-e2f9-414d-b28d-c7d69084759d} -parentPid 760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.760" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 7 tab
                      6⤵
                      • Checks processor information in registry
                      PID:5864
                    • C:\PROGRA~1\MOZILL~1\firefox.exe
                      "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -isForBrowser -prefsHandle 5848 -prefsLen 32952 -prefMapHandle 5852 -prefMapSize 270279 -jsInitHandle 5856 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5864 -initialChannelId {61cd20bb-bd9e-4826-897a-d9c1ed99b57e} -parentPid 760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.760" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 8 tab
                      6⤵
                      • Checks processor information in registry
                      PID:1984
                    • C:\PROGRA~1\MOZILL~1\firefox.exe
                      "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -isForBrowser -prefsHandle 4616 -prefsLen 32952 -prefMapHandle 2872 -prefMapSize 270279 -jsInitHandle 4432 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4704 -initialChannelId {56df3d07-0edd-4ba4-aff4-db0631fb2eb6} -parentPid 760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.760" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 9 tab
                      6⤵
                      • Checks processor information in registry
                      PID:4672
                    • C:\PROGRA~1\MOZILL~1\firefox.exe
                      "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -isForBrowser -prefsHandle 6040 -prefsLen 32952 -prefMapHandle 6044 -prefMapSize 270279 -jsInitHandle 6048 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2616 -initialChannelId {501d7cf7-2ab6-4c34-9d59-3552a7627554} -parentPid 760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.760" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 10 tab
                      6⤵
                      • Checks processor information in registry
                      PID:4148
              • C:\Windows\svchost.com
                "C:\Windows\svchost.com" "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\3582-490\IDMShellExt64.dll"
                3⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2296
                • C:\Windows\SysWOW64\regsvr32.exe
                  C:\Windows\System32\regsvr32.exe /s C:\Users\Admin\AppData\Local\Temp\3582-490\IDMShellExt64.dll
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:1500
              • C:\Windows\svchost.com
                "C:\Windows\svchost.com" "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\3582-490\IDMIECC64.dll"
                3⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4116
                • C:\Windows\SysWOW64\regsvr32.exe
                  C:\Windows\System32\regsvr32.exe /s C:\Users\Admin\AppData\Local\Temp\3582-490\IDMIECC64.dll
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:3008
              • C:\Windows\svchost.com
                "C:\Windows\svchost.com" "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\3582-490\IDMGetAll64.dll"
                3⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1780
                • C:\Windows\SysWOW64\regsvr32.exe
                  C:\Windows\System32\regsvr32.exe /s C:\Users\Admin\AppData\Local\Temp\3582-490\IDMGetAll64.dll
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:3900
              • C:\Windows\svchost.com
                "C:\Windows\svchost.com" "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\3582-490\downlWithIDM64.dll"
                3⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:6104
                • C:\Windows\SysWOW64\regsvr32.exe
                  C:\Windows\System32\regsvr32.exe /s C:\Users\Admin\AppData\Local\Temp\3582-490\downlWithIDM64.dll
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:4524
              • C:\Windows\svchost.com
                "C:\Windows\svchost.com" "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" https://www.internetdownloadmanager.com/welcome.html?v=643b08
                3⤵
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:476
                • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                  C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe https://www.internetdownloadmanager.com/welcome.html?v=643b08
                  4⤵
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Checks system information in the registry
                  • Drops file in Windows directory
                  • Enumerates system info in registry
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of WriteProcessMemory
                  • System policy modification
                  PID:5516
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 --annotation=exe=C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x314,0x7fff2bfcc188,0x7fff2bfcc194,0x7fff2bfcc1a0
                    5⤵
                    • Executes dropped EXE
                    PID:5084
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,13642037094996532782,7229607677596266620,262144 --field-trial-handle=2428,i,16342797798732643786,5150815950808643304,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:2
                    5⤵
                    • Executes dropped EXE
                    PID:1328
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,6677407391553006553,11700038102434818672,524288 --field-trial-handle=2428,i,16342797798732643786,5150815950808643304,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:11
                    5⤵
                    • Executes dropped EXE
                    • System Time Discovery
                    PID:1108
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=316,i,15914273644305510923,13090976583150503582,524288 --field-trial-handle=2428,i,16342797798732643786,5150815950808643304,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:13
                    5⤵
                    • Executes dropped EXE
                    PID:4720
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3328,i,1671153883535691100,5072787468230074200,2097152 --field-trial-handle=2428,i,16342797798732643786,5150815950808643304,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
                    5⤵
                    • Executes dropped EXE
                    PID:5580
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3384,i,10312311873599416423,8334122884674677109,2097152 --field-trial-handle=2428,i,16342797798732643786,5150815950808643304,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:1
                    5⤵
                    • Executes dropped EXE
                    PID:6084
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,395097608129862713,6557095725264096076,2097152 --field-trial-handle=2428,i,16342797798732643786,5150815950808643304,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:1
                    5⤵
                    • Executes dropped EXE
                    PID:4364
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,3026457151016482762,2700151911121376189,2097152 --field-trial-handle=2428,i,16342797798732643786,5150815950808643304,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:9
                    5⤵
                    • Executes dropped EXE
                    PID:4452
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,12736688716303326372,6360463799118988120,524288 --field-trial-handle=2428,i,16342797798732643786,5150815950808643304,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
                    5⤵
                    • Executes dropped EXE
                    PID:3024
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3904,i,14964193221758175600,1054101343668919129,524288 --field-trial-handle=2428,i,16342797798732643786,5150815950808643304,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:14
                    5⤵
                    • Executes dropped EXE
                    PID:4568
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,8792275619499150777,11968288043240565950,524288 --field-trial-handle=2428,i,16342797798732643786,5150815950808643304,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
                    5⤵
                    • Executes dropped EXE
                    PID:3324
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,13243419687411505720,625557106746897196,524288 --field-trial-handle=2428,i,16342797798732643786,5150815950808643304,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
                    5⤵
                    • Executes dropped EXE
                    PID:6644
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,16405919271233394428,7706556119489444435,524288 --field-trial-handle=2428,i,16342797798732643786,5150815950808643304,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
                    5⤵
                    • Executes dropped EXE
                    PID:6948
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,719110405303934330,7053624496184312337,524288 --field-trial-handle=2428,i,16342797798732643786,5150815950808643304,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:14
                    5⤵
                    • Executes dropped EXE
                    PID:6896
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3696,i,13818226927232788288,11230878727493326653,524288 --field-trial-handle=2428,i,16342797798732643786,5150815950808643304,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
                    5⤵
                    • Executes dropped EXE
                    PID:6904
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,1389823493032098228,17362034339279749394,524288 --field-trial-handle=2428,i,16342797798732643786,5150815950808643304,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:14
                    5⤵
                    • Executes dropped EXE
                    PID:6940
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2104,i,13535442429279749464,7203131807575081696,524288 --field-trial-handle=2428,i,16342797798732643786,5150815950808643304,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
                    5⤵
                    • Executes dropped EXE
                    PID:6808
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,6493739556128059516,5637009884258847723,524288 --field-trial-handle=2428,i,16342797798732643786,5150815950808643304,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:14
                    5⤵
                    • Executes dropped EXE
                    PID:6928
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,327226890292005085,95075377545243742,524288 --field-trial-handle=2428,i,16342797798732643786,5150815950808643304,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:14
                    5⤵
                    • Executes dropped EXE
                    PID:6472
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 1472
                3⤵
                • Program crash
                PID:6824
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4904 -ip 4904
            1⤵
              PID:6672
            • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
              "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --no-startup-window --win-session-start
              1⤵
              • Executes dropped EXE
              PID:6740
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k GPSvcGroup
              1⤵
                PID:6972

              Network

                    MITRE ATT&CK Enterprise v16

                    Reconnaissance

                    Resource Development

                    Initial Access

                    Execution

                    Persistence

                    Boot or Logon Autostart Execution

                    1
                    T1547

                    Registry Run Keys / Startup Folder

                    1
                    T1547.001

                    Browser Extensions

                    1
                    T1176

                    Event Triggered Execution

                    1
                    T1546

                    Change Default File Association

                    1
                    T1546.001

                    Privilege Escalation

                    Boot or Logon Autostart Execution

                    1
                    T1547

                    Registry Run Keys / Startup Folder

                    1
                    T1547.001

                    Event Triggered Execution

                    1
                    T1546

                    Change Default File Association

                    1
                    T1546.001

                    Defense Evasion

                    Modify Registry

                    5
                    T1112

                    Credential Access

                    Credentials from Password Stores

                    1
                    T1555

                    Credentials from Web Browsers

                    1
                    T1555.003

                    Unsecured Credentials

                    1
                    T1552

                    Credentials In Files

                    1
                    T1552.001

                    Discovery

                    Browser Information Discovery

                    1
                    T1217

                    Query Registry

                    5
                    T1012

                    System Information Discovery

                    5
                    T1082

                    System Location Discovery

                    1
                    T1614

                    System Language Discovery

                    1
                    T1614.001

                    System Time Discovery

                    1
                    T1124

                    Lateral Movement

                    Collection

                    Data from Local System

                    1
                    T1005

                    Command and Control

                    Exfiltration

                    Impact

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    ACROBR~1.EXE
                    • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE
                    • Size 328KB
                    • SHA256 888a1dd0033e5d758a4e731e3e55357de866e80d03b1b194375f714e1fd4351d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ACROTE~1.EXE
                    • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
                    • Size 86KB
                    • SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ADOBEC~1.EXE
                    • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE
                    • Size 5.7MB
                    • SHA256 1b5c715d71384f043843ea1785a6873a9f39d2daae112ccdeffcd88b10a3a403
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ADelRCP.exe
                    • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe
                    • Size 175KB
                    • SHA256 3f00404dd591c2856e6f71bd78423ed47199902e0b85f228e6c4de72c59ddffe
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    RdrCEF.exe
                    • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe
                    • Size 9.4MB
                    • SHA256 31da9632f5d25806b77b617d48da52a14afc574bbe1653120f97705284ea566c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    AcroRd32.exe
                    • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
                    • Size 2.4MB
                    • SHA256 8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    WCCHRO~1.EXE
                    • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE
                    • Size 183KB
                    • SHA256 ecd5e94da88c653e4c34b6ab325e0aca8824247b290336f75c410caa16381bc5
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Eula.exe
                    • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe
                    • Size 131KB
                    • SHA256 5c3ef3ec7594c040146e908014791dd15201ba58b4d70032770bb661b6a0e394
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    FULLTR~1.EXE
                    • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE
                    • Size 254KB
                    • SHA256 16d65f2463658a72dba205dcaa18bc3d0bab4453e726233d68bc176e69db0950
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    LOGTRA~1.EXE
                    • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE
                    • Size 386KB
                    • SHA256 473eb551101caeaf2d18f811342e21de323c8dd19ed21011997716871defe997
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    READER~1.EXE
                    • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE
                    • Size 92KB
                    • SHA256 2f947e3ca624ce7373080b4a3934e21644fb070a53feeaae442b15b849c2954f
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    WOW_HE~1.EXE
                    • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE
                    • Size 147KB
                    • SHA256 750824b5f75c91a6c2eeb8c5e60ae28d7a81e323d3762c8652255bfea5cba0bb
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    arh.exe
                    • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe
                    • Size 125KB
                    • SHA256 fe44ca8d5050932851aa54c23133277e66db939501af58e5aeb7b67ec1dde7b5
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    32BITM~1.EXE
                    • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE
                    • Size 142KB
                    • SHA256 3e9da97a7106122245e77f13f3f3cc96c055d732ab841eb848d03ac25401c1bc
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    64BITM~1.EXE
                    • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE
                    • Size 278KB
                    • SHA256 22a585c183e27b3c732028ff193733c2f9d03700a0e95e65c556b0592c43d880
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ADOBEA~1.EXE
                    • Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE
                    • Size 454KB
                    • SHA256 bb07d817b8b1b6b4c25e62b6120e51dec10118557d7b6b696ad084a5ba5bfdeb
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    AdobeARM.exe
                    • Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe
                    • Size 1.2MB
                    • SHA256 b1ec065f71cc40f400e006586d370997102860504fd643b235e8ed9f5607262a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    jaureg.exe
                    • Path C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe
                    • Size 555KB
                    • SHA256 c5a99f42100834599e4995d0a178b32b772a6e774a4050a6bb00438af0a6a1f3
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    VSTOIN~1.EXE
                    • Path C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE
                    • Size 121KB
                    • SHA256 405b8bd647fa703e233b8b609a18999abe465a8458168f1daf23197bd2ea36aa
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    java.exe
                    • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe
                    • Size 325KB
                    • SHA256 5e2e22ead49ce9cc11141dbeebbe5b93a530c966695d8efc2083f00e6be53423
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    javaw.exe
                    • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe
                    • Size 325KB
                    • SHA256 e2262c798729169f697e6c30e5211cde604fd8b14769311ff4ea81abba8c2781
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    javaws.exe
                    • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe
                    • Size 505KB
                    • SHA256 da73b6e071788372702104b9c72b6697e84e7c75e248e964996700b77c6b6f1c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    DISABL~1.EXE
                    • Path C:\PROGRA~2\Google\Update\DISABL~1.EXE
                    • Size 5.7MB
                    • SHA256 3acf99624820fd862ac30780021108f0ff2df60db3df351cd17400404f279d3c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    MI9C33~1.EXE
                    • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MI9C33~1.EXE
                    • Size 138KB
                    • SHA256 3bc53b54d6a2f0819c5f9fc43e9fc3b6579843c23b37039b6711c2af5a726cd1
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    MIA062~1.EXE
                    • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MIA062~1.EXE
                    • Size 1.6MB
                    • SHA256 500ea5da5125d05f27a8889af81ddbaa16d357588dce8f339672512b42e9e54a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    MICROS~1.EXE
                    • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MICROS~1.EXE
                    • Size 223KB
                    • SHA256 fe2d4359da69b28aa924ea8e144c8cb12250be7f8ab41485b4b86fe40ab49e14
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    MICROS~2.EXE
                    • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MICROS~2.EXE
                    • Size 242KB
                    • SHA256 e1680751388c4af523a769ce4e16ae013c7d8b7a1b03e56b97525bbb918b647b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    MICROS~3.EXE
                    • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MICROS~3.EXE
                    • Size 138KB
                    • SHA256 0c67d6d3361be736320cca1522b7a08cfaf7aaa8f04311dfeae2eaff8415834c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    MICROS~4.EXE
                    • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MICROS~4.EXE
                    • Size 256KB
                    • SHA256 54680d4ec289fc3dab85466803f01a6d7be5933abab940f7e1ec597c32aa7f64
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    MID1AD~1.EXE
                    • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MID1AD~1.EXE
                    • Size 302KB
                    • SHA256 7bda2feca295068adc7109ae2092010212a1f130d01d11b0b15843733d8832b1
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    MICROS~1.EXE
                    • Path C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MICROS~1.EXE
                    • Size 242KB
                    • SHA256 03044d2ffe2c87ce479dbdb722183cb7f806510a5b27460153ef9b3906a0f7ec
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    MICROS~4.EXE
                    • Path C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MICROS~4.EXE
                    • Size 223KB
                    • SHA256 2b29cceb8d78c397f9be4f35f54752078e1d1d51653a8cbddbd06f7ccc860602
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ie_to_edge_stub.exe
                    • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\BHO\ie_to_edge_stub.exe
                    • Size 553KB
                    • SHA256 7b2d809ff4b2691c04855f4bb3d89b88fa4d1d65c8c35d3941a26f015947cde9
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    setup.exe
                    • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\INSTAL~1\setup.exe
                    • Size 6.8MB
                    • SHA256 78e1d1e4460914eb8be59bb96d9897562a0ac65a5fbce63349f43ee56ba5e83b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    cookie_exporter.exe
                    • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\cookie_exporter.exe
                    • Size 157KB
                    • SHA256 3ecafed639ffb272e758902d1baa0b399c044bfb744cedd6bda1ed40516ca132
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    elevation_service.exe
                    • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\elevation_service.exe
                    • Size 1.7MB
                    • SHA256 2177d0e64ef5cd4d3ad386606feb8d45ae0a7d070f19583b67eea9407272b9f0
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    identity_helper.exe
                    • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\identity_helper.exe
                    • Size 1.2MB
                    • SHA256 d2decf24ecc69018df3da6dde66ca81e168dbcea91c6d4ceb428a1929778b39e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    msedge.exe
                    • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedge.exe
                    • Size 3.9MB
                    • SHA256 39cf8228fc39959bcd27f64512c81e5049eeed843387016d4c733982b622706d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    msedge_proxy.exe
                    • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedge_proxy.exe
                    • Size 1.2MB
                    • SHA256 6f3f49143cab7ee4c239f74f6649241ddd527040ea390a3a214b1d7b8f113fc7
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    msedge_pwa_launcher.exe
                    • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedge_pwa_launcher.exe
                    • Size 1.6MB
                    • SHA256 c3f6a5111276371edf9e46fcb05869f993cb17cac5f8033ee5707ecddc244f5f
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    msedgewebview2.exe
                    • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedgewebview2.exe
                    • Size 3.5MB
                    • SHA256 47df542ec5d28a6c75c2d815e9b700c65f587186c02c8f1a2566fdab9e3b5d01
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    notification_helper.exe
                    • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\notification_helper.exe
                    • Size 1.4MB
                    • SHA256 964abff6df613e4f987fa1615a0f7963d177c3c7418b4a719c3121e9752b5a00
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pwahelper.exe
                    • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\pwahelper.exe
                    • Size 1.2MB
                    • SHA256 07b4d83c273dd032f6a763951adc1196ca00568ce2cef2cd9c3a310788fbcd78
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ie_to_edge_stub.exe
                    • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\BHO\ie_to_edge_stub.exe
                    • Size 562KB
                    • SHA256 533d6da98378d3b1bb120b192bc5bd20bbeed6e123fe9fc6c15a4a3504932c71
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    setup.exe
                    • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\INSTAL~1\setup.exe
                    • Size 7.1MB
                    • SHA256 70c13c14a682d65fd82ec72f578e160617f8b7c164414bcce613a9b9ebd0c878
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    cookie_exporter.exe
                    • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\cookie_exporter.exe
                    • Size 155KB
                    • SHA256 30d26d2f766f716cd6b21cdc15065ee4191760ef0d37de51f67dead898fb8e7c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    elevated_tracing_service.exe
                    • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevated_tracing_service.exe
                    • Size 3.8MB
                    • SHA256 c13ce5f473ff68ffdea61e8a4800008f527054f4561f2bf7853f6769d0c02dc5
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    elevation_service.exe
                    • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevation_service.exe
                    • Size 2.2MB
                    • SHA256 8c53985c403e44c0c899c2d1f2a0b8afb1f17fb928ff866271de7952c9ff7c66
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    identity_helper.exe
                    • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\identity_helper.exe
                    • Size 1.4MB
                    • SHA256 cd0adfcf43373e05fcf8836cc998cb17e3aaade9f8b190e28ce4331bd026f23c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    msedge_pwa_launcher.exe
                    • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge_pwa_launcher.exe
                    • Size 1.8MB
                    • SHA256 2c31887681976e9691cfed32b98a9f81898beaaee9ea3f7a90fe695b84190511
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    msedgewebview2.exe
                    • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedgewebview2.exe
                    • Size 3.4MB
                    • SHA256 c0566225b047e50773acde8ada568ef7612809e74f2cc200504e60cf7a917c68
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    notification_click_helper.exe
                    • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\notification_click_helper.exe
                    • Size 1.6MB
                    • SHA256 0faa9f1f62a95136d454efa51e6f8e8ff06a08d344fd26dc2216de09f6fbee4e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    MSEDGE~1.EXE
                    • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE
                    • Size 1.5MB
                    • SHA256 b4bdab2b2c7731923854f254ba1494c25a11331293c0ee4939afd10ba1e2b575
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    PWAHEL~1.EXE
                    • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE
                    • Size 1.4MB
                    • SHA256 df233ebee614cd9117f7e467f16f4c2225aadbc59213a5695913a4a87f792d6a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    msedge.exe
                    • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    • Size 4.0MB
                    • SHA256 18f4157c2dabb39cf84662e17c471f69f679840a70be3a4685e0c4ed8ccc207a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    msedge.exe
                    • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    • Size 3.9MB
                    • SHA256 6d8e5d6a4d1c147b90b5a394a5054840e19dfa3eae3ea706ffb367477cecb929
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    settings.dat
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                    • Size 280B
                    • SHA256 4123fa2cc2e73053b7602d1d53a57b01f3a6cd8872729fcd7ed66886082b1b99
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    settings.dat
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                    • Size 280B
                    • SHA256 a201096456be1e380b7687844e70aa8e2d987a06740acf66db0d56e000a3b50d
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    BookmarkMergedSurfaceOrdering
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                    • Size 6B
                    • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                    • MD5 SHA1 SHA512
                    Submit Download

                    the-real-index
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                    • Size 1KB
                    • SHA256 4ec885917a1e0d3b0db6161a2127f3d1401b5a508fb07859a274698cdaa0a294
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    SiteList-Enterprise.json
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                    • Size 2B
                    • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                    • MD5 SHA1 SHA512
                    Submit Download

                    Edge Profile.ico
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                    • Size 70KB
                    • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Network Persistent State
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                    • Size 2KB
                    • SHA256 1eee4c2a05f2ee087974f817ea1c9aa022c67df2a7cc53fdc25be0631394d3d8
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    SCT Auditing Pending Reports
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                    • Size 2B
                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                    • MD5 SHA1 SHA512
                    Submit Download

                    Sdch Dictionaries
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                    • Size 40B
                    • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                    • MD5 SHA1 SHA512
                    Submit Download

                    Preferences
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                    • Size 11KB
                    • SHA256 4ddc8bb96b934aa285777459b56f4eb6bb997cf2d112f183b484198e06bda5e6
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Preferences
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                    • Size 12KB
                    • SHA256 6a3aeb695c83eca9808b68fcab6bdb8b002af7baf02639718fc90fd951c92910
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Preferences
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                    • Size 12KB
                    • SHA256 a2db984894c3c6b21b529258caae2629aafbf76b4ce759adfb732c4fcbbcdab4
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Secure Preferences
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                    • Size 27KB
                    • SHA256 2562de9f919a80dfe4b4dbabd87f71986dc9ae00966d31f653a533ed719870ab
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    sync_diagnostic.log
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                    • Size 5KB
                    • SHA256 5ee3a9946c0c2d747a485b2bd685b06c09555985fb2f3e2e528f6efb9be9eca2
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    32dfc13c-fe10-44f7-a59e-459a131a0141.tmp
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\32dfc13c-fe10-44f7-a59e-459a131a0141.tmp
                    • Size 22KB
                    • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Local State
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                    • Size 37KB
                    • SHA256 301fa449c8ba70219e4ee121ea8fc51ecaddf550cfd9e1b096778aa6ff8fde91
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Local State
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                    • Size 28KB
                    • SHA256 f06a16dd23f12f266d0fee88fbeba08b433540a39573fe45efd26a1665e7090b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Local State
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                    • Size 37KB
                    • SHA256 b5eb5d2ff31f5f3020721f66d09ff15969c7f542b904d2fe67cddb227745b91e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Local State
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                    • Size 37KB
                    • SHA256 dc0ab5305fae037cf8d289b01028ea67c5871c82b8e2ec7c2151961319f0b56b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Local State
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                    • Size 28KB
                    • SHA256 c3251af48abbfbb8ca17cdf700c5b912d9df2247f23b700122b15457451e859b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Local State
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                    • Size 32KB
                    • SHA256 4c83b5dfaed20216391421a0539ca5814b446baaea7392f9ce302ac52312e373
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    metadata.json
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                    • Size 132B
                    • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    metadata.json
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                    • Size 252B
                    • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    8f4cfd0a-c410-4fc0-9aa8-a97813566af3.tmp
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8f4cfd0a-c410-4fc0-9aa8-a97813566af3.tmp
                    • Size 13B
                    • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                    • MD5 SHA1 SHA512
                    Submit Download

                    AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ej9v93ms.default-release\cache2\entries\AABAB860D2646FDCEACF8AAC0CD412654CE5E4C0
                    • Size 16KB
                    • SHA256 e474c3b3ad93e835242bc3b39591279607a52026c0fdf6da897062621cf2137a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    webext.sc.lz4
                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ej9v93ms.default-release\startupCache\webext.sc.lz4
                    • Size 105KB
                    • SHA256 189510059ce11de3836cdbb174aebf031e9ee7cb791573cf4df4abfb97065a9e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    2026-09-24_2b3d42ceb0786e5cf725c493544acde3_darkgate_elex_glassworm_neshta_ransomhub_remcos_stealc_stop.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\3582-490\2026-09-24_2b3d42ceb0786e5cf725c493544acde3_darkgate_elex_glassworm_neshta_ransomhub_remcos_stealc_stop.exe
                    • Size 5.9MB
                    • SHA256 ad96c2b22bd51743dd915823315bc321519b226951166457dcce84d6a6037636
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    content_new.js
                    • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5516_535446156\CRX_INSTALL\content_new.js
                    • Size 10KB
                    • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    tmpaddon
                    • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                    • Size 11KB
                    • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    tmpaddon
                    • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                    • Size 502KB
                    • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    data.safe.tmp
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\db\data.safe.tmp
                    • Size 31KB
                    • SHA256 ed9bbff9e948e8a5d2446c513a58ecebcb9b223042c366df5f7bf802bd45744e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    data.safe.tmp
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\db\data.safe.tmp
                    • Size 7KB
                    • SHA256 0f46d40bcf3934498759c8888cc6e2bdeb978bf882b6e4f9c710fa7bd91433ba
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    data.safe.tmp
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\db\data.safe.tmp
                    • Size 31KB
                    • SHA256 f8c3cd5ba878cf4fcc56a907775616d2c96cc0270b6b58f9808a146aeec9ffae
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    events
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\events\events
                    • Size 1KB
                    • SHA256 dcf227011163c41b0f9bd5c02deb0e5bb1d24e4c95ec4292e3f7a704a913b4dc
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    44a18fac-a5fd-426a-8627-cce42cab210a
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\pending_pings\44a18fac-a5fd-426a-8627-cce42cab210a
                    • Size 235B
                    • SHA256 5b7e2998cd33229f32903382cf7ef33aa21d2e0856f1c1e563f995e710dd4a01
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    52dfe332-4ce9-423b-8262-cbf1e2f6dcc6
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\pending_pings\52dfe332-4ce9-423b-8262-cbf1e2f6dcc6
                    • Size 235B
                    • SHA256 0337f3d76987bbfed8175767775a407446fae58337ad84adfd8f84459d0aff9c
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    b711230a-5648-4f50-8dbf-715038b595b9
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\pending_pings\b711230a-5648-4f50-8dbf-715038b595b9
                    • Size 2KB
                    • SHA256 5b1d4fe1e2575727f77663a415d6f07f283dff3a767c9401140f16fd5cb18a98
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    c39e7f6f-9ac3-4321-b094-103c1a3bdb2f
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\pending_pings\c39e7f6f-9ac3-4321-b094-103c1a3bdb2f
                    • Size 883B
                    • SHA256 86209f655978e73ac105fe06aa974051f7b785ab59d66db11afa4236d28c178e
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    c6d1abd2-2589-415c-ad39-e4916988e393
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\pending_pings\c6d1abd2-2589-415c-ad39-e4916988e393
                    • Size 886B
                    • SHA256 8b6f4e4c7cb266a7bac753583d23113bb2fff97e3233cda1784f728b6bfd0c4d
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    e060fd29-3f3f-4553-83b0-e5824777f4df
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\datareporting\glean\pending_pings\e060fd29-3f3f-4553-83b0-e5824777f4df
                    • Size 16KB
                    • SHA256 98016f9d9fc752502271f8bb64afd167458643d12514b2edc5ed6a185d51840e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    extensions.json
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\extensions.json
                    • Size 16KB
                    • SHA256 da0375177ee80f92f5768fc381acd34e0bba0c682c37f77179489667e998b5bd
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    gmpopenh264.dll
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                    • Size 1.1MB
                    • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    gmpopenh264.info
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                    • Size 116B
                    • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    manifest.json
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
                    • Size 1002B
                    • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    widevinecdm.dll
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
                    • Size 21.6MB
                    • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    prefs-1.js
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\prefs-1.js
                    • Size 7KB
                    • SHA256 079c8acb9fd27feb60e3031718b61e54f26ec951c5cd882f77d62126e383e330
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    prefs-1.js
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\prefs-1.js
                    • Size 6KB
                    • SHA256 e9118eb79c7b3955126bfaabf653f170189677be91781ad7b97c12fab90e49ee
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    prefs.js
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\prefs.js
                    • Size 6KB
                    • SHA256 818ce02e0f40bbc0fc0080fff7619fb53ed613d2895a16942bbb8ce8a7f3d3f6
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    prefs.js
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\prefs.js
                    • Size 6KB
                    • SHA256 9050529639fde81b19a1ff5215925880ec897670816f2312c29374c1a2c195a1
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    recovery.baklz4
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\sessionstore-backups\recovery.baklz4
                    • Size 4KB
                    • SHA256 2da1f441cd913f33f8d8ed8e6d4b3ef8b79081e4680cdd7624ccec4ca335594c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    recovery.jsonlz4
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\sessionstore-backups\recovery.jsonlz4
                    • Size 4KB
                    • SHA256 1200d7eabb270bc87878c061e8af64bd1102f1d1d92313b158b474deff22782f
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    3870112724rsegmnoittet-es.sqlite
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                    • Size 7.3MB
                    • SHA256 46e50bb66a983e6af2f83e78b5c4099f776f925ae332dd870b71471008692f8d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    3870112724rsegmnoittet-es.sqlite
                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ej9v93ms.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                    • Size 5.6MB
                    • SHA256 dc56e8f46b19f655fd6724945349df66f36d8d45a5bf4e925119c3cc363481a8
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    directx.sys
                    • Path C:\Windows\directx.sys
                    • Size 34B
                    • SHA256 8083b6294f20a9b1ffe3de2760d729323ab692aeebc91e4dfaf907b03b6577af
                    • MD5 SHA1 SHA512
                    Submit Download

                    directx.sys
                    • Path C:\Windows\directx.sys
                    • Size 47B
                    • SHA256 1ca11ed09e232331ff2d75bce2948f38a3149c592bd059c18380b266d56a26ec
                    • MD5 SHA1 SHA512
                    Submit Download

                    svchost.com
                    • Path C:\Windows\svchost.com
                    • Size 40KB
                    • SHA256 d14ca7a0b977ff84658b3f765ef24af54fa46b36c5c93decbc4a4b8e712ff896
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    memory/476-737-0x0000000000400000-0x000000000041B000-memory.dmp
                    Download

                    memory/760-705-0x0000027E65EF0000-0x0000027E65FE2000-memory.dmp
                    Download

                    memory/760-1612-0x0000027E65EF0000-0x0000027E65FE2000-memory.dmp
                    Download

                    memory/760-1577-0x0000027E65EF0000-0x0000027E65FE2000-memory.dmp
                    Download

                    memory/760-1553-0x0000027E65EF0000-0x0000027E65FE2000-memory.dmp
                    Download

                    memory/760-1322-0x0000027E65EF0000-0x0000027E65FE2000-memory.dmp
                    Download

                    memory/760-800-0x0000027E65EF0000-0x0000027E65FE2000-memory.dmp
                    Download

                    memory/760-1521-0x0000027E65EF0000-0x0000027E65FE2000-memory.dmp
                    Download

                    memory/760-1643-0x0000027E65EF0000-0x0000027E65FE2000-memory.dmp
                    Download

                    memory/760-1499-0x0000027E65EF0000-0x0000027E65FE2000-memory.dmp
                    Download

                    memory/760-1488-0x0000027E65EF0000-0x0000027E65FE2000-memory.dmp
                    Download

                    memory/760-1223-0x0000027E65EF0000-0x0000027E65FE2000-memory.dmp
                    Download

                    memory/760-1399-0x0000027E65EF0000-0x0000027E65FE2000-memory.dmp
                    Download

                    memory/760-635-0x0000027E65EF0000-0x0000027E65FE2000-memory.dmp
                    Download

                    memory/760-642-0x0000027E76E90000-0x0000027E76EA0000-memory.dmp
                    Download

                    memory/1328-1126-0x00000250954C0000-0x000002509583C000-memory.dmp
                    Download

                    memory/1328-771-0x00007FFF4E8C0000-0x00007FFF4E8C1000-memory.dmp
                    Download

                    memory/1780-689-0x0000000000400000-0x000000000041B000-memory.dmp
                    Download

                    memory/1984-714-0x0000026F82A30000-0x0000026F82DAC000-memory.dmp
                    Download

                    memory/2296-688-0x0000000000400000-0x000000000041B000-memory.dmp
                    Download

                    memory/3344-234-0x00007FFF4E8C0000-0x00007FFF4E8C1000-memory.dmp
                    Download

                    memory/3344-669-0x000002662F000000-0x000002662F37C000-memory.dmp
                    Download

                    memory/4116-687-0x0000000000400000-0x000000000041B000-memory.dmp
                    Download

                    memory/4148-716-0x000001D917F70000-0x000001D9182EC000-memory.dmp
                    Download

                    memory/4364-1128-0x000001AF55400000-0x000001AF5577C000-memory.dmp
                    Download

                    memory/4452-1129-0x0000018B292A0000-0x0000018B2961C000-memory.dmp
                    Download

                    memory/4672-715-0x0000023247B00000-0x0000023247E7C000-memory.dmp
                    Download

                    memory/4988-704-0x0000000000400000-0x000000000041B000-memory.dmp
                    Download

                    memory/4988-799-0x0000000000400000-0x000000000041B000-memory.dmp
                    Download

                    memory/4988-634-0x0000000000400000-0x000000000041B000-memory.dmp
                    Download

                    memory/4988-999-0x0000000000400000-0x000000000041B000-memory.dmp
                    Download

                    memory/5580-772-0x00007FFF4E8C0000-0x00007FFF4E8C1000-memory.dmp
                    Download

                    memory/5704-696-0x000001B0B8A70000-0x000001B0B8DEC000-memory.dmp
                    Download

                    memory/5800-913-0x0000000000400000-0x000000000041B000-memory.dmp
                    Download

                    memory/5800-133-0x0000000000400000-0x000000000041B000-memory.dmp
                    Download

                    memory/5800-676-0x0000000000400000-0x000000000041B000-memory.dmp
                    Download

                    memory/5800-1031-0x0000000000400000-0x000000000041B000-memory.dmp
                    Download

                    memory/5800-235-0x0000000000400000-0x000000000041B000-memory.dmp
                    Download

                    memory/5800-717-0x0000000000400000-0x000000000041B000-memory.dmp
                    Download

                    memory/5864-703-0x000001BDD77E0000-0x000001BDD7B5C000-memory.dmp
                    Download

                    memory/6084-1127-0x00000131A65D0000-0x00000131A694C000-memory.dmp
                    Download

                    memory/6104-695-0x0000000000400000-0x000000000041B000-memory.dmp
                    Download

                    memory/6808-1545-0x000001BD1A0E0000-0x000001BD1A45C000-memory.dmp
                    Download