Overview

overview

10

Static

static

10

2026-10-13...or.exe

windows10-2004-x64

10

2026-10-13...or.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    14/10/2026, 04:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-13_d98a98f4b254dca80c18d84c3041879e_cobalt-strike_dark-comet_darkgate_elex_gcleaner_glasswor.exe
  • Size 4.3MB
  • Sample261014-e26j1sfw4z
  • SHA256 08f30bb471c53a33ac9ac940d2af9eda22896190342b6402772778c41fb5c6bb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
backdoordiscoveryneshtaxredpersistencespywarestealer

Malware Config

Extracted

Family

  • xred

C2

  • xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred
  • Detect Neshta payload 64 IoCs
  • Executes dropped EXE 16 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 18 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 22 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 7 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-13_d98a98f4b254dca80c18d84c3041879e_cobalt-strike_dark-comet_darkgate_elex_gcleaner_glasswor.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-13_d98a98f4b254dca80c18d84c3041879e_cobalt-strike_dark-comet_darkgate_elex_gcleaner_glasswor.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5500
    • C:\Users\Admin\AppData\Local\Temp\._cache_2026-10-13_d98a98f4b254dca80c18d84c3041879e_cobalt-strike_dark-comet_darkgate_elex_gcleaner_glasswor.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_2026-10-13_d98a98f4b254dca80c18d84c3041879e_cobalt-strike_dark-comet_darkgate_elex_gcleaner_glasswor.exe"
      2⤵
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:6040
      • C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_2026-10-13_d98a98f4b254dca80c18d84c3041879e_cobalt-strike_dark-comet_darkgate_elex_gcleaner_glasswor.exe
        "C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_2026-10-13_d98a98f4b254dca80c18d84c3041879e_cobalt-strike_dark-comet_darkgate_elex_gcleaner_glasswor.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4836
        • C:\Users\Admin\AppData\Local\Temp\._cache_._cache_2026-10-13_d98a98f4b254dca80c18d84c3041879e_cobalt-strike_dark-comet_darkgate_elex_gcleaner_glasswor.exe
          "C:\Users\Admin\AppData\Local\Temp\._cache_._cache_2026-10-13_d98a98f4b254dca80c18d84c3041879e_cobalt-strike_dark-comet_darkgate_elex_gcleaner_glasswor.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:4120
          • C:\Windows\svchost.com
            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1148
            • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
              C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5988
              • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
                "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                • Suspicious use of WriteProcessMemory
                PID:1520
                • C:\Windows\svchost.com
                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE"
                  8⤵
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:4204
                  • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE
                    C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE
                    9⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:548
                    • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE
                      "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE"
                      10⤵
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      • Modifies registry class
                      • Suspicious use of WriteProcessMemory
                      PID:1268
                      • C:\Windows\svchost.com
                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:2512
                        • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
                          C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE
                          12⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:4296
                          • C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE
                            "C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE"
                            13⤵
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            • Modifies registry class
                            • Suspicious use of WriteProcessMemory
                            PID:4140
                            • C:\Windows\svchost.com
                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE"
                              14⤵
                              • Executes dropped EXE
                              • Drops file in Windows directory
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:1672
                              • C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
                                15⤵
                                • Executes dropped EXE
                                • Modifies registry class
                                • Suspicious use of WriteProcessMemory
                                PID:1480
                                • C:\Windows\svchost.com
                                  "C:\Windows\svchost.com" "C:\PROGRA~1\MOZILL~1\firefox.exe"
                                  16⤵
                                  • Executes dropped EXE
                                  • Drops file in Windows directory
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:5952
                                  • C:\PROGRA~1\MOZILL~1\firefox.exe
                                    C:\PROGRA~1\MOZILL~1\firefox.exe
                                    17⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:828
                                    • C:\PROGRA~1\MOZILL~1\firefox.exe
                                      C:\PROGRA~1\MOZILL~1\firefox.exe
                                      18⤵
                                      • Checks processor information in registry
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of FindShellTrayWindow
                                      • Suspicious use of SetWindowsHookEx
                                      • Suspicious use of WriteProcessMemory
                                      PID:2128
                                      • C:\PROGRA~1\MOZILL~1\firefox.exe
                                        "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1952 -prefsLen 27097 -prefMapHandle 1956 -prefMapSize 270279 -ipcHandle 2044 -initialChannelId {d1f5f166-5809-4224-a9e8-38844b184869} -parentPid 2128 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2128" -appDir "C:\PROGRA~1\MOZILL~1\browser" - 1 gpu
                                        19⤵
                                          PID:4732
                                        • C:\PROGRA~1\MOZILL~1\firefox.exe
                                          "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2412 -prefsLen 27133 -prefMapHandle 2416 -prefMapSize 270279 -ipcHandle 2432 -initialChannelId {28f1bf16-d8f8-413c-8f9b-662b91694b34} -parentPid 2128 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2128" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 2 socket
                                          19⤵
                                            PID:3564
                                          • C:\PROGRA~1\MOZILL~1\firefox.exe
                                            "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -isForBrowser -prefsHandle 3576 -prefsLen 27323 -prefMapHandle 3580 -prefMapSize 270279 -jsInitHandle 3584 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3592 -initialChannelId {19b70a89-f6f5-4b36-a4e8-9d712aea4817} -parentPid 2128 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2128" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 3 tab
                                            19⤵
                                            • Checks processor information in registry
                                            PID:5052
                                          • C:\PROGRA~1\MOZILL~1\firefox.exe
                                            "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3768 -prefsLen 27323 -prefMapHandle 3772 -prefMapSize 270279 -ipcHandle 3816 -initialChannelId {43154a8d-a8fc-44a9-8bf3-15148313ea99} -parentPid 2128 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2128" -appDir "C:\PROGRA~1\MOZILL~1\browser" - 4 rdd
                                            19⤵
                                              PID:1828
                                            • C:\PROGRA~1\MOZILL~1\firefox.exe
                                              "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -isForBrowser -prefsHandle 4476 -prefsLen 34822 -prefMapHandle 4480 -prefMapSize 270279 -jsInitHandle 4484 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4492 -initialChannelId {bec41dc3-da34-488c-9b67-05af3460557c} -parentPid 2128 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2128" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 5 tab
                                              19⤵
                                              • Checks processor information in registry
                                              PID:3468
                                            • C:\PROGRA~1\MOZILL~1\firefox.exe
                                              "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4972 -prefsLen 35010 -prefMapHandle 4976 -prefMapSize 270279 -ipcHandle 2816 -initialChannelId {b9f01f2b-e0f4-4de6-9b39-1ab93a61c97a} -parentPid 2128 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2128" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 6 utility
                                              19⤵
                                              • Checks processor information in registry
                                              PID:2792
                                            • C:\PROGRA~1\MOZILL~1\firefox.exe
                                              "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -isForBrowser -prefsHandle 5324 -prefsLen 32952 -prefMapHandle 5328 -prefMapSize 270279 -jsInitHandle 5332 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5340 -initialChannelId {b60a0587-fe27-492b-9374-601e53f5c62b} -parentPid 2128 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2128" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 7 tab
                                              19⤵
                                              • Checks processor information in registry
                                              PID:2404
                                            • C:\PROGRA~1\MOZILL~1\firefox.exe
                                              "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -isForBrowser -prefsHandle 5464 -prefsLen 32952 -prefMapHandle 5468 -prefMapSize 270279 -jsInitHandle 5472 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5356 -initialChannelId {ecd04510-4632-46c0-8d30-09a3f3523815} -parentPid 2128 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2128" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 8 tab
                                              19⤵
                                              • Checks processor information in registry
                                              PID:1728
                                            • C:\PROGRA~1\MOZILL~1\firefox.exe
                                              "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -isForBrowser -prefsHandle 5480 -prefsLen 32952 -prefMapHandle 5488 -prefMapSize 270279 -jsInitHandle 5492 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5272 -initialChannelId {094c6f20-2a39-43dc-868a-d894c97e0679} -parentPid 2128 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2128" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 9 tab
                                              19⤵
                                              • Checks processor information in registry
                                              PID:2160
          • C:\ProgramData\Synaptics\Synaptics.exe
            "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
            2⤵
            • Executes dropped EXE
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            PID:3048
        • C:\ProgramData\Synaptics\Synaptics.exe
          C:\ProgramData\Synaptics\Synaptics.exe
          1⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2844
        • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
          "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
          1⤵
          • Checks processor information in registry
          • Enumerates system info in registry
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious use of SetWindowsHookEx
          PID:5320

        Network

              MITRE ATT&CK Enterprise v16

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Persistence

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Event Triggered Execution

              1
              T1546

              Change Default File Association

              1
              T1546.001

              Privilege Escalation

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Event Triggered Execution

              1
              T1546

              Change Default File Association

              1
              T1546.001

              Defense Evasion

              Modify Registry

              2
              T1112

              Credential Access

              Credentials from Password Stores

              1
              T1555

              Credentials from Web Browsers

              1
              T1555.003

              Unsecured Credentials

              1
              T1552

              Credentials In Files

              1
              T1552.001

              Discovery

              Query Registry

              3
              T1012

              System Information Discovery

              3
              T1082

              System Location Discovery

              1
              T1614

              System Language Discovery

              1
              T1614.001

              System Network Configuration Discovery

              1
              T1016

              Lateral Movement

              Collection

              Data from Local System

              1
              T1005

              Command and Control

              Exfiltration

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              ACROBR~1.EXE
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE
              • Size 328KB
              • SHA256 888a1dd0033e5d758a4e731e3e55357de866e80d03b1b194375f714e1fd4351d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ACROTE~1.EXE
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
              • Size 86KB
              • SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ADOBEC~1.EXE
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE
              • Size 5.7MB
              • SHA256 1b5c715d71384f043843ea1785a6873a9f39d2daae112ccdeffcd88b10a3a403
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ADelRCP.exe
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe
              • Size 175KB
              • SHA256 3f00404dd591c2856e6f71bd78423ed47199902e0b85f228e6c4de72c59ddffe
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              RdrCEF.exe
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe
              • Size 9.4MB
              • SHA256 31da9632f5d25806b77b617d48da52a14afc574bbe1653120f97705284ea566c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AcroRd32.exe
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
              • Size 2.4MB
              • SHA256 8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              WCCHRO~1.EXE
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE
              • Size 183KB
              • SHA256 ecd5e94da88c653e4c34b6ab325e0aca8824247b290336f75c410caa16381bc5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Eula.exe
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe
              • Size 131KB
              • SHA256 5c3ef3ec7594c040146e908014791dd15201ba58b4d70032770bb661b6a0e394
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              FULLTR~1.EXE
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE
              • Size 254KB
              • SHA256 16d65f2463658a72dba205dcaa18bc3d0bab4453e726233d68bc176e69db0950
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              LOGTRA~1.EXE
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE
              • Size 386KB
              • SHA256 473eb551101caeaf2d18f811342e21de323c8dd19ed21011997716871defe997
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              READER~1.EXE
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE
              • Size 92KB
              • SHA256 2f947e3ca624ce7373080b4a3934e21644fb070a53feeaae442b15b849c2954f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              WOW_HE~1.EXE
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE
              • Size 147KB
              • SHA256 750824b5f75c91a6c2eeb8c5e60ae28d7a81e323d3762c8652255bfea5cba0bb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              arh.exe
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe
              • Size 125KB
              • SHA256 fe44ca8d5050932851aa54c23133277e66db939501af58e5aeb7b67ec1dde7b5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              32BITM~1.EXE
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE
              • Size 142KB
              • SHA256 3e9da97a7106122245e77f13f3f3cc96c055d732ab841eb848d03ac25401c1bc
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              64BITM~1.EXE
              • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE
              • Size 278KB
              • SHA256 22a585c183e27b3c732028ff193733c2f9d03700a0e95e65c556b0592c43d880
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ADOBEA~1.EXE
              • Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE
              • Size 454KB
              • SHA256 bb07d817b8b1b6b4c25e62b6120e51dec10118557d7b6b696ad084a5ba5bfdeb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AdobeARM.exe
              • Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe
              • Size 1.2MB
              • SHA256 b1ec065f71cc40f400e006586d370997102860504fd643b235e8ed9f5607262a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              jaureg.exe
              • Path C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe
              • Size 555KB
              • SHA256 c5a99f42100834599e4995d0a178b32b772a6e774a4050a6bb00438af0a6a1f3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VSTOIN~1.EXE
              • Path C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE
              • Size 121KB
              • SHA256 405b8bd647fa703e233b8b609a18999abe465a8458168f1daf23197bd2ea36aa
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              java.exe
              • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe
              • Size 325KB
              • SHA256 5e2e22ead49ce9cc11141dbeebbe5b93a530c966695d8efc2083f00e6be53423
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javaw.exe
              • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe
              • Size 325KB
              • SHA256 e2262c798729169f697e6c30e5211cde604fd8b14769311ff4ea81abba8c2781
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              javaws.exe
              • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe
              • Size 505KB
              • SHA256 da73b6e071788372702104b9c72b6697e84e7c75e248e964996700b77c6b6f1c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              DISABL~1.EXE
              • Path C:\PROGRA~2\Google\Update\DISABL~1.EXE
              • Size 5.7MB
              • SHA256 3acf99624820fd862ac30780021108f0ff2df60db3df351cd17400404f279d3c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ie_to_edge_stub.exe
              • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\BHO\ie_to_edge_stub.exe
              • Size 553KB
              • SHA256 7b2d809ff4b2691c04855f4bb3d89b88fa4d1d65c8c35d3941a26f015947cde9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              setup.exe
              • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\INSTAL~1\setup.exe
              • Size 6.8MB
              • SHA256 78e1d1e4460914eb8be59bb96d9897562a0ac65a5fbce63349f43ee56ba5e83b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              cookie_exporter.exe
              • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\cookie_exporter.exe
              • Size 157KB
              • SHA256 3ecafed639ffb272e758902d1baa0b399c044bfb744cedd6bda1ed40516ca132
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              elevation_service.exe
              • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\elevation_service.exe
              • Size 1.7MB
              • SHA256 2177d0e64ef5cd4d3ad386606feb8d45ae0a7d070f19583b67eea9407272b9f0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              identity_helper.exe
              • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\identity_helper.exe
              • Size 1.2MB
              • SHA256 d2decf24ecc69018df3da6dde66ca81e168dbcea91c6d4ceb428a1929778b39e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              msedge.exe
              • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedge.exe
              • Size 3.9MB
              • SHA256 39cf8228fc39959bcd27f64512c81e5049eeed843387016d4c733982b622706d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              msedge_proxy.exe
              • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedge_proxy.exe
              • Size 1.2MB
              • SHA256 6f3f49143cab7ee4c239f74f6649241ddd527040ea390a3a214b1d7b8f113fc7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              msedge_pwa_launcher.exe
              • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedge_pwa_launcher.exe
              • Size 1.6MB
              • SHA256 c3f6a5111276371edf9e46fcb05869f993cb17cac5f8033ee5707ecddc244f5f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              msedgewebview2.exe
              • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedgewebview2.exe
              • Size 3.5MB
              • SHA256 47df542ec5d28a6c75c2d815e9b700c65f587186c02c8f1a2566fdab9e3b5d01
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              notification_helper.exe
              • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\notification_helper.exe
              • Size 1.4MB
              • SHA256 964abff6df613e4f987fa1615a0f7963d177c3c7418b4a719c3121e9752b5a00
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              pwahelper.exe
              • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\pwahelper.exe
              • Size 1.2MB
              • SHA256 07b4d83c273dd032f6a763951adc1196ca00568ce2cef2cd9c3a310788fbcd78
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ie_to_edge_stub.exe
              • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\BHO\ie_to_edge_stub.exe
              • Size 562KB
              • SHA256 533d6da98378d3b1bb120b192bc5bd20bbeed6e123fe9fc6c15a4a3504932c71
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              setup.exe
              • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\INSTAL~1\setup.exe
              • Size 7.1MB
              • SHA256 70c13c14a682d65fd82ec72f578e160617f8b7c164414bcce613a9b9ebd0c878
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              cookie_exporter.exe
              • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\cookie_exporter.exe
              • Size 155KB
              • SHA256 30d26d2f766f716cd6b21cdc15065ee4191760ef0d37de51f67dead898fb8e7c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              elevated_tracing_service.exe
              • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevated_tracing_service.exe
              • Size 3.8MB
              • SHA256 c13ce5f473ff68ffdea61e8a4800008f527054f4561f2bf7853f6769d0c02dc5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              elevation_service.exe
              • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevation_service.exe
              • Size 2.2MB
              • SHA256 8c53985c403e44c0c899c2d1f2a0b8afb1f17fb928ff866271de7952c9ff7c66
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              identity_helper.exe
              • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\identity_helper.exe
              • Size 1.4MB
              • SHA256 cd0adfcf43373e05fcf8836cc998cb17e3aaade9f8b190e28ce4331bd026f23c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              msedge_pwa_launcher.exe
              • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge_pwa_launcher.exe
              • Size 1.8MB
              • SHA256 2c31887681976e9691cfed32b98a9f81898beaaee9ea3f7a90fe695b84190511
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              msedgewebview2.exe
              • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedgewebview2.exe
              • Size 3.4MB
              • SHA256 c0566225b047e50773acde8ada568ef7612809e74f2cc200504e60cf7a917c68
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              notification_click_helper.exe
              • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\notification_click_helper.exe
              • Size 1.6MB
              • SHA256 0faa9f1f62a95136d454efa51e6f8e8ff06a08d344fd26dc2216de09f6fbee4e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              pwahelper.exe
              • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\pwahelper.exe
              • Size 1.4MB
              • SHA256 df233ebee614cd9117f7e467f16f4c2225aadbc59213a5695913a4a87f792d6a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MSEDGE~1.EXE
              • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE
              • Size 1.5MB
              • SHA256 b4bdab2b2c7731923854f254ba1494c25a11331293c0ee4939afd10ba1e2b575
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              msedge.exe
              • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
              • Size 4.0MB
              • SHA256 18f4157c2dabb39cf84662e17c471f69f679840a70be3a4685e0c4ed8ccc207a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Synaptics.exe
              • Path C:\ProgramData\Synaptics\Synaptics.exe
              • Size 753KB
              • SHA256 0608e52f91e68bd8f76fd95aed53fbd65c60c289889227cebbdf2fa08d191d45
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              activity-stream.contile.json
              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\activity-stream.contile.json
              • Size 4KB
              • SHA256 63c0ff3339604bca23de50aa4b30b8b75e26288e23ce3dc9ae76d88b1450a53e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              activity-stream.discovery_stream.json
              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\activity-stream.discovery_stream.json
              • Size 75KB
              • SHA256 158d673cab0edba7e4c08ddce988088f0e1f54387def63d8f0114763e866fe6e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              activity-stream.discovery_stream.json
              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\activity-stream.discovery_stream.json
              • Size 75KB
              • SHA256 bc2ecd4c9d5982bb12b0b13a4de8c7571c44a60d0e78bc9c05492489d3ce6ee1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              14733
              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\cache2\doomed\14733
              • Size 257KB
              • SHA256 189daa0fa3293d27068bd01b1adca2da1f2d781cd416dc95b644cbe39e314104
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              9955
              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\cache2\doomed\9955
              • Size 52B
              • SHA256 04f35bbbe4f8243b8249f10d4479f7ec93f7bcc68431e828d75cecb68971a8dd
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              E9338C5CCF1E2FCF149487351399F198A4F9FCD6
              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\cache2\entries\E9338C5CCF1E2FCF149487351399F198A4F9FCD6
              • Size 16KB
              • SHA256 695653a08543897cd75af4fd61bd85a971fdd22a2c7c46a704302bde822e3214
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              webext.sc.lz4
              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\startupCache\webext.sc.lz4
              • Size 104KB
              • SHA256 264b8c889f422073b57574b560edbce745078d438bdab15299055cfac57e94ec
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              webext.sc.lz4
              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\startupCache\webext.sc.lz4
              • Size 105KB
              • SHA256 f6c62e5f8e0fe64426233ea82ce5c90690b4cbe5057c491744654e2f71275a85
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ._cache_._cache_2026-10-13_d98a98f4b254dca80c18d84c3041879e_cobalt-strike_dark-comet_darkgate_elex_gcleaner_glasswor.exe
              • Path C:\Users\Admin\AppData\Local\Temp\._cache_._cache_2026-10-13_d98a98f4b254dca80c18d84c3041879e_cobalt-strike_dark-comet_darkgate_elex_gcleaner_glasswor.exe
              • Size 2.7MB
              • SHA256 66bc0dbd5797f44d9e972287235cabc5b9ffa1876d41ea84c524b5ef044a723c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ._cache_2026-10-13_d98a98f4b254dca80c18d84c3041879e_cobalt-strike_dark-comet_darkgate_elex_gcleaner_glasswor.exe
              • Path C:\Users\Admin\AppData\Local\Temp\._cache_2026-10-13_d98a98f4b254dca80c18d84c3041879e_cobalt-strike_dark-comet_darkgate_elex_gcleaner_glasswor.exe
              • Size 3.5MB
              • SHA256 bb635408e3a752b861ccf6537f721714cf8acc4bd6b22ea0e0f66a641072902a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ._cache_._cache_2026-10-13_d98a98f4b254dca80c18d84c3041879e_cobalt-strike_dark-comet_darkgate_elex_gcleaner_glasswor.exe
              • Path C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_._cache_2026-10-13_d98a98f4b254dca80c18d84c3041879e_cobalt-strike_dark-comet_darkgate_elex_gcleaner_glasswor.exe
              • Size 2.7MB
              • SHA256 dea1882f48e7059d1ee6ea5bf1a7ea3f88aa980ff97901d0bc648641a940e8f5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ._cache_2026-10-13_d98a98f4b254dca80c18d84c3041879e_cobalt-strike_dark-comet_darkgate_elex_gcleaner_glasswor.exe
              • Path C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_2026-10-13_d98a98f4b254dca80c18d84c3041879e_cobalt-strike_dark-comet_darkgate_elex_gcleaner_glasswor.exe
              • Size 3.5MB
              • SHA256 ac1be8f5cad64f9534f351bb9aaf0f85e5fb3568f69f3e0b9c07256c022cce11
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ._cache__CACHE~1.EXE
              • Path C:\Users\Admin\AppData\Local\Temp\3582-490\._cache__CACHE~1.EXE
              • Size 392KB
              • SHA256 a38dbe9b85a9b2d55b96ab456da00a39b40b38c67c6557f69954b070fda9fb94
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ._cache__CACHE~2.EXE
              • Path C:\Users\Admin\AppData\Local\Temp\3582-490\._cache__CACHE~2.EXE
              • Size 1.9MB
              • SHA256 20a3e43cf7c0d9a2e663c10dab01f3cfd936c6809fddd6b079c623fb253ae9be
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ._cache__CACHE~3.EXE
              • Path C:\Users\Admin\AppData\Local\Temp\3582-490\._cache__CACHE~3.EXE
              • Size 1.2MB
              • SHA256 8de55f346dfd0a444fa3073513d7b5670e62cd1582c5d126a0bbf3a505e8dc51
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              tmpaddon
              • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
              • Size 11KB
              • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              tmpaddon
              • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
              • Size 502KB
              • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              tmpaddon
              • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
              • Size 21.6MB
              • SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VUSAK5ILLOTR74381008.temp
              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\VUSAK5ILLOTR74381008.temp
              • Size 5KB
              • SHA256 e7f5009722c9965440da618e7e820479f4522346826b6b9502629004cc0ac4ab
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              addonStartup.json.lz4
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\addonStartup.json.lz4
              • Size 4KB
              • SHA256 7a1c1c230e758289f3290bdda9aff05e179bec4f25eb435e372816b85a791af3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              store.json.mozlz4
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\crashes\store.json.mozlz4
              • Size 66B
              • SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              data.safe.tmp
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\datareporting\glean\db\data.safe.tmp
              • Size 3KB
              • SHA256 526a2643390ef384615fced1f18467bb16abd5f275a35b5bb5e4bec91fc04c16
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              data.safe.tmp
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\datareporting\glean\db\data.safe.tmp
              • Size 5KB
              • SHA256 1c5acff999171c2e8416f91d69a37f350836a51d25f3b235774e48ed025a7dd1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              data.safe.tmp
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\datareporting\glean\db\data.safe.tmp
              • Size 7KB
              • SHA256 74406469a729168cf2c38bbeb47b277e53de1f09d97d6d9719a89705ebd6bb27
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              data.safe.tmp
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\datareporting\glean\db\data.safe.tmp
              • Size 5KB
              • SHA256 cbf4bdea73e0bb849ee820dc73183ed6b4931f99553496a8b3dd4193971835b6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              data.safe.tmp
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\datareporting\glean\db\data.safe.tmp
              • Size 7KB
              • SHA256 ca09be542c7cf4f1e4baad02726c777da1302d5aa02b23570e3bb6e7bb584ff7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              data.safe.tmp
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\datareporting\glean\db\data.safe.tmp
              • Size 7KB
              • SHA256 251189eddb6a9e876e198cfaa195860ec14074061cd21afb06eca71c2449c39e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              data.safe.tmp
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\datareporting\glean\db\data.safe.tmp
              • Size 2KB
              • SHA256 102588a509653f3297207be3e27bd00f5af07e8237a02df06d62ff112ff98cbc
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              data.safe.tmp
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\datareporting\glean\db\data.safe.tmp
              • Size 3KB
              • SHA256 175c0239ee8b1d15eb944b582c66ed2729b588c15e6c46b0a8ccfb6d16ae024a
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              data.safe.tmp
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\datareporting\glean\db\data.safe.tmp
              • Size 5KB
              • SHA256 4c926150c1e0922d70db4723f4756d41112b45789e903b14b8b29ad47e80d2b9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              data.safe.tmp
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\datareporting\glean\db\data.safe.tmp
              • Size 5KB
              • SHA256 78cec2083bdb6ff7a16e02c4752ab2648a33eb575524efe11581d9697a9b2231
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              data.safe.tmp
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\datareporting\glean\db\data.safe.tmp
              • Size 5KB
              • SHA256 8104de60e5d91eee4fd0d17a0129314389b3a71853de5f559811354280398018
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              data.safe.tmp
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\datareporting\glean\db\data.safe.tmp
              • Size 6KB
              • SHA256 f37c5d35a34200839cb3a2d355efc74b04347535c400dcb04ae1514d0a57e16c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              data.safe.tmp
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\datareporting\glean\db\data.safe.tmp
              • Size 3KB
              • SHA256 f41351ffac80b70316ce84ac1ba36c0d949ec023f0829f97868771a16ae796c5
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              events
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\datareporting\glean\events\events
              • Size 2KB
              • SHA256 f172befc7cc48d7ee0d9a60d05b813d59a6f142973b2e7976d995b54f935f773
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              0ccefceb-f75e-45ab-bfcc-a563997283e4
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\datareporting\glean\pending_pings\0ccefceb-f75e-45ab-bfcc-a563997283e4
              • Size 16KB
              • SHA256 8eb838c44bfaa56965e60e2402b64b941cf3fe634c0af0f6ced8e45512c7ce4c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              1d9cc478-5380-4fad-b68f-4243f38ce90c
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\datareporting\glean\pending_pings\1d9cc478-5380-4fad-b68f-4243f38ce90c
              • Size 883B
              • SHA256 1f3f17ccbd47e5c0831f1c89151b6239a1cbd8b081a7c0eba5e673eb7e414969
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              6ac47847-98f0-4c75-bc3f-ead01a792d88
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\datareporting\glean\pending_pings\6ac47847-98f0-4c75-bc3f-ead01a792d88
              • Size 235B
              • SHA256 eacfddf982c94f2b99021118e61d926766d4f31b57fcd0bccb2e369d0691da93
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              c9b05aff-eea8-4637-bca7-afbb9d55ddfc
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\datareporting\glean\pending_pings\c9b05aff-eea8-4637-bca7-afbb9d55ddfc
              • Size 2KB
              • SHA256 ea68230e86e2079807d931cb58f23aa88268213711b2859fa0b93a5a045d673b
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              e9f22b06-3fff-4ccf-8d61-1c879c88faf0
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\datareporting\glean\pending_pings\e9f22b06-3fff-4ccf-8d61-1c879c88faf0
              • Size 886B
              • SHA256 ee7174945637a5f3b5002cf3405e3078974338a072dfdd1c78ac418dd2270e42
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              f84951c7-0613-4e65-9c2e-dec78d0accfe
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\datareporting\glean\pending_pings\f84951c7-0613-4e65-9c2e-dec78d0accfe
              • Size 235B
              • SHA256 ff951a25546828c5042f2ab972179266d4defd943a24ce42949e916ec340988f
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              extension-preferences.json
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\extension-preferences.json
              • Size 942B
              • SHA256 aecfc11c0db969b2c79da2144415a8859c77d66fbfc37ca4924ac58a0ff29834
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              extensions.json
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\extensions.json
              • Size 14KB
              • SHA256 608115f77250171254420630f5a3ec02f1de543cf90ae13be8712a4cc9198cbd
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              gmpopenh264.dll
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
              • Size 1.1MB
              • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              gmpopenh264.info
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
              • Size 116B
              • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              LICENSE
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE
              • Size 473B
              • SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              manifest.json
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
              • Size 1002B
              • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              widevinecdm.dll
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
              • Size 21.6MB
              • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              widevinecdm.dll.sig
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll.sig
              • Size 1KB
              • SHA256 c5f50bed6afd38490baca2ce8e8fdd1a39849c9f0dc06478a8a2e9226526607b
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              prefs-1.js
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\prefs-1.js
              • Size 6KB
              • SHA256 5e4f58ad3537f55b5392a06299951dba567bf4b5f59a4b65a08f067b230f27e2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              prefs-1.js
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\prefs-1.js
              • Size 7KB
              • SHA256 b351c8380ed3db5395241a75b70b9d37db17f72a60744e366b3675b28e27238f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              prefs.js
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\prefs.js
              • Size 6KB
              • SHA256 4aa516cb7a60bcbb3b16b5fc2be0495e306ad38664c038fb5a7ae5b37b8ab0f8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              prefs.js
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\prefs.js
              • Size 6KB
              • SHA256 de5f5657919626467a640a8d4b3adf4c67ed9ca11dd6d7a221bbacc6ba676dd6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              prefs.js
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\prefs.js
              • Size 6KB
              • SHA256 037c33f2fa613e9c2238b65419aecb207013e6883d3983d2afd8b2cd57d6f65b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              prefs.js
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\prefs.js
              • Size 7KB
              • SHA256 cfdc2919f1715c7946f76fecc2f3729c74c001f26182a4e3718272227fb9379d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              prefs.js
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\prefs.js
              • Size 6KB
              • SHA256 a4332d502a46d1e92dceecd114f98a13702669bf3d8151442f935e6bf75d5bba
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              sessionCheckpoints.json
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\sessionCheckpoints.json
              • Size 53B
              • SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              sessionCheckpoints.json
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\sessionCheckpoints.json
              • Size 90B
              • SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              recovery.jsonlz4
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\sessionstore-backups\recovery.jsonlz4
              • Size 1KB
              • SHA256 850a101e04f82d70ee8ac3a8150ddd0e839f94dbae171e60a1f241af2d9e06bb
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              recovery.jsonlz4
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\sessionstore-backups\recovery.jsonlz4
              • Size 1KB
              • SHA256 d1fac6a2ec60b53d264487ead0791b5370a0bfc026a841a82eef5d026e3de7d5
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              3870112724rsegmnoittet-es.sqlite
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
              • Size 6.3MB
              • SHA256 091c1659fdda2d9ed019070d8927c26732e2c062aac69e2d4aa9f4a3761a814b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              3870112724rsegmnoittet-es.sqlite
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
              • Size 7.5MB
              • SHA256 9816b7f1e37f651f8deab9509090078fec7333acce0f85734158c0d48342c0a0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              3870112724rsegmnoittet-es.sqlite
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
              • Size 7.6MB
              • SHA256 4b89a8039f99170b8344384420dfedf8c133e4c98a501698644e3f4cbac46720
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              3870112724rsegmnoittet-es.sqlite
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
              • Size 7.6MB
              • SHA256 bc7039ce043030243c7ab720b9354be70b4c63845c5438de95899faf9afddb7e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              3870112724rsegmnoittet-es.sqlite
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
              • Size 7.6MB
              • SHA256 5e7df23aacbd181fedd175dfebbdb76f61cd84df7885850a3d9751419b508948
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              3870112724rsegmnoittet-es.sqlite
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
              • Size 7.6MB
              • SHA256 0039cb65136db3f308252e27a5f51eb31f99072e1a39e47c71d06351f572b3c9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              3870112724rsegmnoittet-es.sqlite
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
              • Size 7.6MB
              • SHA256 5466f9c9de8e936addd2fbb52de586036b76ae8eace407c5d0313e2c5a66619e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              targeting.snapshot.json
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\targeting.snapshot.json
              • Size 3KB
              • SHA256 bcbf9586bfafaa33aa193d2e66950bb5b4bcabc92a67806d1059376e980c5d08
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              directx.sys
              • Path C:\Windows\directx.sys
              • Size 57B
              • SHA256 998e1546bc98d29ffccb70e81ed00a01f3dbd3015e947d1aabca4cb01775ce28
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              directx.sys
              • Path C:\Windows\directx.sys
              • Size 57B
              • SHA256 a43fa861957415e3b0f25e2b54d931961cd309ff1d5354a9362852895b90b3e1
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              directx.sys
              • Path C:\Windows\directx.sys
              • Size 57B
              • SHA256 e0a7bae2a9ac263cff5d725922e40272d8854278d901233a93a5267859c00a3c
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              directx.sys
              • Path C:\Windows\directx.sys
              • Size 34B
              • SHA256 b33200e2c157ba1d66f336dcc9cfb6afbeab553554f955aac5f9f522d69418f7
              • MD5 SHA1 SHA512
              Submit Download

              svchost.com
              • Path C:\Windows\svchost.com
              • Size 40KB
              • SHA256 980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/548-364-0x0000000000400000-0x00000000005F5000-memory.dmp
              Download

              memory/1148-271-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/1268-375-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/1520-329-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/1672-394-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/1728-868-0x000001FDF49F0000-0x000001FDF59F0000-memory.dmp
              Download

              memory/1828-860-0x000001E925640000-0x000001E926640000-memory.dmp
              Download

              memory/2128-1293-0x0000023B75B00000-0x0000023B75BF2000-memory.dmp
              Download

              memory/2128-906-0x0000023B75B00000-0x0000023B75BF2000-memory.dmp
              Download

              memory/2128-1346-0x0000023B75B00000-0x0000023B75BF2000-memory.dmp
              Download

              memory/2128-1425-0x0000023B75B00000-0x0000023B75BF2000-memory.dmp
              Download

              memory/2128-887-0x0000023B75B00000-0x0000023B75BF2000-memory.dmp
              Download

              memory/2128-1407-0x0000023B75B00000-0x0000023B75BF2000-memory.dmp
              Download

              memory/2128-1315-0x0000023B75B00000-0x0000023B75BF2000-memory.dmp
              Download

              memory/2128-1265-0x0000023B75B00000-0x0000023B75BF2000-memory.dmp
              Download

              memory/2128-1395-0x0000023B75B00000-0x0000023B75BF2000-memory.dmp
              Download

              memory/2128-1383-0x0000023B75B00000-0x0000023B75BF2000-memory.dmp
              Download

              memory/2128-1370-0x0000023B75B00000-0x0000023B75BF2000-memory.dmp
              Download

              memory/2128-1358-0x0000023B75B00000-0x0000023B75BF2000-memory.dmp
              Download

              memory/2128-841-0x0000023B00000000-0x0000023B01000000-memory.dmp
              Download

              memory/2128-1437-0x0000023B75B00000-0x0000023B75BF2000-memory.dmp
              Download

              memory/2128-840-0x0000023B75B00000-0x0000023B75BF2000-memory.dmp
              Download

              memory/2160-869-0x000002564D3C0000-0x000002564E3C0000-memory.dmp
              Download

              memory/2404-867-0x00000228B9310000-0x00000228BA310000-memory.dmp
              Download

              memory/2512-376-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/2792-866-0x000001DA6D000000-0x000001DA6E000000-memory.dmp
              Download

              memory/2844-80-0x0000000000400000-0x00000000004C2000-memory.dmp
              Download

              memory/3048-440-0x0000000000400000-0x00000000004C2000-memory.dmp
              Download

              memory/3048-845-0x0000000000400000-0x00000000004C2000-memory.dmp
              Download

              memory/3048-1349-0x0000000000400000-0x00000000004C2000-memory.dmp
              Download

              memory/3468-861-0x000002C4EF000000-0x000002C4F0000000-memory.dmp
              Download

              memory/3564-843-0x0000020412CB0000-0x0000020413CB0000-memory.dmp
              Download

              memory/4120-1039-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/4120-1285-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/4120-1297-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/4120-898-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/4120-858-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/4120-461-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/4140-393-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/4204-332-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/4296-378-0x0000000000400000-0x000000000052F000-memory.dmp
              Download

              memory/4732-842-0x000001DD41A20000-0x000001DD42A20000-memory.dmp
              Download

              memory/4836-120-0x0000000000400000-0x0000000000782000-memory.dmp
              Download

              memory/5052-859-0x000001D4DA730000-0x000001D4DB730000-memory.dmp
              Download

              memory/5052-451-0x00007FFF36F20000-0x00007FFF36F21000-memory.dmp
              Download

              memory/5320-434-0x00007FFEF8D20000-0x00007FFEF8D30000-memory.dmp
              Download

              memory/5320-441-0x00007FFEF60A0000-0x00007FFEF60B0000-memory.dmp
              Download

              memory/5320-433-0x00007FFEF8D20000-0x00007FFEF8D30000-memory.dmp
              Download

              memory/5320-436-0x00007FFEF8D20000-0x00007FFEF8D30000-memory.dmp
              Download

              memory/5320-435-0x00007FFEF8D20000-0x00007FFEF8D30000-memory.dmp
              Download

              memory/5320-437-0x00007FFEF8D20000-0x00007FFEF8D30000-memory.dmp
              Download

              memory/5320-438-0x00007FFEF60A0000-0x00007FFEF60B0000-memory.dmp
              Download

              memory/5500-0-0x0000000002700000-0x0000000002701000-memory.dmp
              Download

              memory/5500-1-0x00000000004A0000-0x00000000004A1000-memory.dmp
              Download

              memory/5500-73-0x0000000000400000-0x0000000000849000-memory.dmp
              Download

              memory/5952-417-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/5988-318-0x0000000000400000-0x00000000006BC000-memory.dmp
              Download

              memory/6040-924-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/6040-1278-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/6040-896-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/6040-439-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/6040-1298-0x0000000000400000-0x000000000041B000-memory.dmp
              Download

              memory/6040-844-0x0000000000400000-0x000000000041B000-memory.dmp
              Download