Overview

overview

10

Static

static

10

2026-10-19...op.exe

windows10-2004-x64

10

2026-10-19...op.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/10/2026, 15:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-19_79e226fa9187b53933f875a955515cf5_darkgate_elex_floxif_glassworm_remcos_stop.exe
  • Size 6.0MB
  • Sample261020-s7ev5scb96
  • SHA256 cdad70e0ff2a5371f6b06ae4c267c1ce91351b8a5b0c50eac9a7c208200af7ff
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarebackdoordefense_evasiondiscoveryfloxifpersistencespywarestealertrojanupx

Malware Config

Signatures

  • Family: Floxif, Floodfix

    Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

    backdoortrojanfloxif
  • Detects Floxif payload 1 IoCs
    backdoor
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 4 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 4 IoCs
  • UPX dump on OEP (original entry point) 7 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 21 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 22 IoCs
    adwarespyware
  • Modifies registry class 19 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-19_79e226fa9187b53933f875a955515cf5_darkgate_elex_floxif_glassworm_remcos_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-19_79e226fa9187b53933f875a955515cf5_darkgate_elex_floxif_glassworm_remcos_stop.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Enumerates connected drives
    • Installs/modifies Browser Helper Object
    • Drops file in Program Files directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2312
    • C:\Windows\system32\regsvr32.exe
      C:\Windows\Sysnative\regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
      2⤵
        PID:3192
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:5972
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
          3⤵
          • Checks processor information in registry
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:5532
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1960 -prefsLen 27097 -prefMapHandle 1964 -prefMapSize 270279 -ipcHandle 1924 -initialChannelId {68233fb3-1201-4938-ac38-1c0ac57322d1} -parentPid 5532 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5532" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
            4⤵
              PID:236
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2420 -prefsLen 27133 -prefMapHandle 2424 -prefMapSize 270279 -ipcHandle 2432 -initialChannelId {7cf176bf-ab34-4086-a8f6-135859fa3bd5} -parentPid 5532 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5532" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
              4⤵
                PID:1656
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3836 -prefsLen 25164 -prefMapHandle 3840 -prefMapSize 270279 -jsInitHandle 3844 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3852 -initialChannelId {e6cecf21-9c3d-42b8-9303-7235cdba76c3} -parentPid 5532 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5532" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
                4⤵
                • Checks processor information in registry
                PID:624
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3880 -prefsLen 27274 -prefMapHandle 3980 -prefMapSize 270279 -ipcHandle 4012 -initialChannelId {06d9a993-ab78-4160-9c98-fa076a506599} -parentPid 5532 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5532" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
                4⤵
                  PID:1932
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4500 -prefsLen 34773 -prefMapHandle 4504 -prefMapSize 270279 -jsInitHandle 4508 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4512 -initialChannelId {84657675-05eb-4650-ae5e-edde4f5a650d} -parentPid 5532 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5532" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                  4⤵
                  • Checks processor information in registry
                  PID:5688
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5192 -prefsLen 35010 -prefMapHandle 5196 -prefMapSize 270279 -ipcHandle 2932 -initialChannelId {21514a61-e2de-49ed-a23a-640a9b18a77b} -parentPid 5532 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5532" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
                  4⤵
                  • Checks processor information in registry
                  PID:4192
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5044 -prefsLen 35062 -prefMapHandle 5108 -prefMapSize 270279 -jsInitHandle 5052 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5464 -initialChannelId {ebd9769e-2ced-4762-be59-fba202e2a46f} -parentPid 5532 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5532" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
                  4⤵
                  • Checks processor information in registry
                  PID:5644
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4472 -prefsLen 32952 -prefMapHandle 3128 -prefMapSize 270279 -jsInitHandle 4476 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5652 -initialChannelId {51cc823d-0e5a-4211-b303-897ff7ee6daa} -parentPid 5532 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5532" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                  4⤵
                  • Checks processor information in registry
                  PID:5752
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5820 -prefsLen 32952 -prefMapHandle 5824 -prefMapSize 270279 -jsInitHandle 5828 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5836 -initialChannelId {39279f53-7e0e-4bb9-957a-e1075d51bfbc} -parentPid 5532 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5532" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                  4⤵
                  • Checks processor information in registry
                  PID:2152
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6028 -prefsLen 32952 -prefMapHandle 6032 -prefMapSize 270279 -jsInitHandle 6036 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6044 -initialChannelId {7f9c102a-5124-4905-aef5-9f9d474b188e} -parentPid 5532 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5532" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
                  4⤵
                  • Checks processor information in registry
                  PID:3780
            • C:\Windows\SysWOW64\regsvr32.exe
              "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:1872
            • C:\Windows\SysWOW64\regsvr32.exe
              "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:2740
            • C:\Windows\SysWOW64\regsvr32.exe
              "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:5256
            • C:\Windows\SysWOW64\regsvr32.exe
              "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:2604
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.internetdownloadmanager.com/welcome.html?v=643b15
              2⤵
              • Drops file in Windows directory
              • Enumerates system info in registry
              • Modifies registry class
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:5196
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffb3cf5c188,0x7ffb3cf5c194,0x7ffb3cf5c1a0
                3⤵
                  PID:5944
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1808,i,1559495155128337396,1226160106397301188,262144 --field-trial-handle=2288,i,18244233286494708417,11938308940505720623,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
                  3⤵
                    PID:3812
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,4089241987611566957,3224027246901544220,524288 --field-trial-handle=2288,i,18244233286494708417,11938308940505720623,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:11
                    3⤵
                    • System Time Discovery
                    PID:3364
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2348,i,10213900412552293889,12955257598332855902,524288 --field-trial-handle=2288,i,18244233286494708417,11938308940505720623,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:13
                    3⤵
                      PID:2704
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,8080207167031905021,6122376708863874116,2097152 --field-trial-handle=2288,i,18244233286494708417,11938308940505720623,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
                      3⤵
                        PID:3664
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,7004564322191324251,7921567855745582720,2097152 --field-trial-handle=2288,i,18244233286494708417,11938308940505720623,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
                        3⤵
                          PID:5480
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,197785308181072554,15233419332875862005,2097152 --field-trial-handle=2288,i,18244233286494708417,11938308940505720623,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:1
                          3⤵
                            PID:3172
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,6519798526869234411,17635556438454074469,2097152 --field-trial-handle=2288,i,18244233286494708417,11938308940505720623,262144 --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:9
                            3⤵
                              PID:5468
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3796,i,13300568594905199084,10870659892790018213,524288 --field-trial-handle=2288,i,18244233286494708417,11938308940505720623,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:14
                              3⤵
                                PID:2480
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,11518853830559463275,5130442527391280129,524288 --field-trial-handle=2288,i,18244233286494708417,11938308940505720623,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
                                3⤵
                                  PID:6476
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,11637680680694997639,16134228409824285456,524288 --field-trial-handle=2288,i,18244233286494708417,11938308940505720623,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
                                  3⤵
                                    PID:6484
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,7599418333227139543,2710264756498715466,524288 --field-trial-handle=2288,i,18244233286494708417,11938308940505720623,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
                                    3⤵
                                      PID:6584
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,7599418333227139543,2710264756498715466,524288 --field-trial-handle=2288,i,18244233286494708417,11938308940505720623,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
                                      3⤵
                                        PID:6592
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,11127489747945458483,18317908902085835846,524288 --field-trial-handle=2288,i,18244233286494708417,11938308940505720623,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
                                        3⤵
                                          PID:7164
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,15464772732752675699,14411258410332547718,524288 --field-trial-handle=2288,i,18244233286494708417,11938308940505720623,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:14
                                          3⤵
                                            PID:6740
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,6882405124276278594,13569486872445273583,524288 --field-trial-handle=2288,i,18244233286494708417,11938308940505720623,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
                                            3⤵
                                              PID:6316
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6668,i,16357757710791468555,7779361466862491690,524288 --field-trial-handle=2288,i,18244233286494708417,11938308940505720623,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:14
                                              3⤵
                                                PID:6324
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4708,i,5639773362281285609,6657408018530988153,524288 --field-trial-handle=2288,i,18244233286494708417,11938308940505720623,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:14
                                                3⤵
                                                  PID:4300
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,14067104670793190394,9895360937532195157,524288 --field-trial-handle=2288,i,18244233286494708417,11938308940505720623,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
                                                  3⤵
                                                    PID:7152
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6800,i,2844355149617675539,12246384016936051263,524288 --field-trial-handle=2288,i,18244233286494708417,11938308940505720623,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:14
                                                    3⤵
                                                      PID:4736
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,1853601631865100975,1640748015068688142,524288 --field-trial-handle=2288,i,18244233286494708417,11938308940505720623,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:14
                                                      3⤵
                                                        PID:2444
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,11068623472413568842,16666298139723050540,524288 --field-trial-handle=2288,i,18244233286494708417,11938308940505720623,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:14
                                                        3⤵
                                                          PID:6272
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=916,i,13678609996904499614,1322692531083778834,524288 --field-trial-handle=2288,i,18244233286494708417,11938308940505720623,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
                                                          3⤵
                                                            PID:6604
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                        1⤵
                                                          PID:4740
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                          1⤵
                                                            PID:6988
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                            1⤵
                                                              PID:6424

                                                            Network

                                                                  MITRE ATT&CK Enterprise v16

                                                                  Reconnaissance

                                                                  Resource Development

                                                                  Initial Access

                                                                  Execution

                                                                  Persistence

                                                                  Boot or Logon Autostart Execution

                                                                  1
                                                                  T1547

                                                                  Registry Run Keys / Startup Folder

                                                                  1
                                                                  T1547.001

                                                                  Browser Extensions

                                                                  1
                                                                  T1176

                                                                  Privilege Escalation

                                                                  Boot or Logon Autostart Execution

                                                                  1
                                                                  T1547

                                                                  Registry Run Keys / Startup Folder

                                                                  1
                                                                  T1547.001

                                                                  Defense Evasion

                                                                  Modify Registry

                                                                  3
                                                                  T1112

                                                                  Credential Access

                                                                  Credentials from Password Stores

                                                                  1
                                                                  T1555

                                                                  Credentials from Web Browsers

                                                                  1
                                                                  T1555.003

                                                                  Unsecured Credentials

                                                                  1
                                                                  T1552

                                                                  Credentials In Files

                                                                  1
                                                                  T1552.001

                                                                  Discovery

                                                                  Browser Information Discovery

                                                                  1
                                                                  T1217

                                                                  Peripheral Device Discovery

                                                                  1
                                                                  T1120

                                                                  Query Registry

                                                                  4
                                                                  T1012

                                                                  System Information Discovery

                                                                  5
                                                                  T1082

                                                                  System Location Discovery

                                                                  1
                                                                  T1614

                                                                  System Language Discovery

                                                                  1
                                                                  T1614.001

                                                                  System Network Configuration Discovery

                                                                  1
                                                                  T1016

                                                                  System Time Discovery

                                                                  1
                                                                  T1124

                                                                  Lateral Movement

                                                                  Collection

                                                                  Data from Local System

                                                                  1
                                                                  T1005

                                                                  Command and Control

                                                                  Exfiltration

                                                                  Impact

                                                                  Replay Monitor

                                                                  Loading Replay Monitor...

                                                                  Downloads

                                                                  symsrv.dll
                                                                  • Path C:\Program Files\Common Files\System\symsrv.dll
                                                                  • Size 67KB
                                                                  • SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  symsrv.dll.000
                                                                  • Path C:\Program Files\Common Files\System\symsrv.dll.000
                                                                  • Size 114B
                                                                  • SHA256 aefc503b1ed462d7b6280228a7b5b710792273b78934426f88325341ac5b5a92
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  13622336-f81c-44ea-976f-bafdd8b1d85a.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\13622336-f81c-44ea-976f-bafdd8b1d85a.tmp
                                                                  • Size 34KB
                                                                  • SHA256 e7c94bc8d80df20bb14aec9fe0222f8c6961cf95184eff571ff7aee4b90da0fe
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  39b8a73e-2cbe-49b4-8904-dc94ea7eb166.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\39b8a73e-2cbe-49b4-8904-dc94ea7eb166.tmp
                                                                  • Size 39KB
                                                                  • SHA256 f98b4876a3abae2ef8f79cc9cf36a0fa7edd66ac3dd9f09c71709150a5a2eb40
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  47215789-8483-4454-a4a8-3a2bfccf0207.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\47215789-8483-4454-a4a8-3a2bfccf0207.tmp
                                                                  • Size 38KB
                                                                  • SHA256 c1829283a247f1f9ed37f9b0cb6c27b56aca5f12b94bf8d215f7211d7212978a
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  8003915e-24f5-4e15-ae63-f35cb92c38de.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8003915e-24f5-4e15-ae63-f35cb92c38de.tmp
                                                                  • Size 34KB
                                                                  • SHA256 3c34a58bca6b500f7839b0016983b5ef8519785bb45f73f27a2a6d33e85b727f
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  8f5f5fec-3f4e-47ba-bfcf-d8a153fd5f6e.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8f5f5fec-3f4e-47ba-bfcf-d8a153fd5f6e.tmp
                                                                  • Size 42KB
                                                                  • SHA256 50fab276d28760e4a20c5791258d0c7b72586ecace72a594231ba401b5716ce4
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  93411c5c-071d-40e0-be4d-965e76e06c66.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\93411c5c-071d-40e0-be4d-965e76e06c66.tmp
                                                                  • Size 105KB
                                                                  • SHA256 10bf49f629ba90a1161d0117602435d1a511d1f7a5e47b20fe3a693551550e5a
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  settings.dat
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                  • Size 280B
                                                                  • SHA256 54a604899198f01e1a2f5ec52bac53679a6d2775840ba8c81ab97c59f718adf8
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  settings.dat
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                  • Size 280B
                                                                  • SHA256 fe09a9e94fbd795d6fab442dc426ef79e7bd47dbd80086b003cb1cd34d18db58
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  043892c7-3644-4edf-8a8f-d9fe8fd476f5.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\043892c7-3644-4edf-8a8f-d9fe8fd476f5.tmp
                                                                  • Size 12KB
                                                                  • SHA256 71451da65cd0697f2d1f8c0fefe9e3a793813a00a6b3ee6295965c2c9a199d32
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  21f81e8b-912a-4338-bed1-0448095c80d0.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\21f81e8b-912a-4338-bed1-0448095c80d0.tmp
                                                                  • Size 70KB
                                                                  • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  temp-index
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                  • Size 3KB
                                                                  • SHA256 75ad363a65bfb1fa02f5b2c348db2aaa3212752a8b3d1fd149f725a4b5fd3c10
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  the-real-index
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                  • Size 3KB
                                                                  • SHA256 a88d79d2ae6e9f85c717ff9b7f9d0039811d54a180a288337a31b1643168a807
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  c756c0c5-c49c-4539-823d-1ba45d3f14c0.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\c756c0c5-c49c-4539-823d-1ba45d3f14c0.tmp
                                                                  • Size 2B
                                                                  • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  dasherSettingSchema.json
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
                                                                  • Size 854B
                                                                  • SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  838c29db-f194-4bc2-a11c-076793f69f25.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\838c29db-f194-4bc2-a11c-076793f69f25.tmp
                                                                  • Size 40B
                                                                  • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  c4d66a49-4b30-47c9-859c-30af70be7ba8.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c4d66a49-4b30-47c9-859c-30af70be7ba8.tmp
                                                                  • Size 2B
                                                                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  c807130d-c77c-4c76-9062-63c8f87ce9e3.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c807130d-c77c-4c76-9062-63c8f87ce9e3.tmp
                                                                  • Size 2KB
                                                                  • SHA256 77d052f3c6bb3484bc46e5c3ba4ab5ebf34085ccbbdcb8ff345674efd3a06693
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  sync_diagnostic.log
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                  • Size 5KB
                                                                  • SHA256 05f1f294fa840e64715516d5ab5d6e1ad19bce157507faad7d063475767d6c99
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  b517f16b-fabc-4889-af85-0e6784cf81e3.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b517f16b-fabc-4889-af85-0e6784cf81e3.tmp
                                                                  • Size 29KB
                                                                  • SHA256 55cce6320e1406b1485ccd1e14e6f71a1fb6a56d74c1f0418c5a459b9bef6e8d
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  ba73696e-f34b-4a14-838a-1348e3e3cff4.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ba73696e-f34b-4a14-838a-1348e3e3cff4.tmp
                                                                  • Size 12KB
                                                                  • SHA256 0a064965f0f51133166209d61a40c1b02fd37eed6fa000b70921b49b531c24e0
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  d234c5b5-b66a-4a21-b8c6-3baac52dd700.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d234c5b5-b66a-4a21-b8c6-3baac52dd700.tmp
                                                                  • Size 12KB
                                                                  • SHA256 074ce7030e63c7dfd3f40c561094793f95925459140b546cd0a928f0289ce411
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  e1d15731-e1cc-4426-9fcc-ff979100bdcd.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e1d15731-e1cc-4426-9fcc-ff979100bdcd.tmp
                                                                  • Size 6B
                                                                  • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  OperationConfig
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                  • Size 3KB
                                                                  • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  e59fb322-587b-47a7-a2cb-2cca2bfa23c5.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e59fb322-587b-47a7-a2cb-2cca2bfa23c5.tmp
                                                                  • Size 22KB
                                                                  • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  479fd6c8-76b8-4a7a-987a-de32a3586f93.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\479fd6c8-76b8-4a7a-987a-de32a3586f93.tmp
                                                                  • Size 252B
                                                                  • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  6e218570-e115-44df-ae3c-a3d88a886c03.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\6e218570-e115-44df-ae3c-a3d88a886c03.tmp
                                                                  • Size 132B
                                                                  • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
                                                                  • Size 158KB
                                                                  • SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  73a39059-8169-4a01-b52e-55b3ab18b983.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\73a39059-8169-4a01-b52e-55b3ab18b983.tmp
                                                                  • Size 13B
                                                                  • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  metadata.json
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                  • Size 132B
                                                                  • SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  f3ee50bd-03ee-4dfb-b498-159273d0c354.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f3ee50bd-03ee-4dfb-b498-159273d0c354.tmp
                                                                  • Size 37KB
                                                                  • SHA256 98aaf50353c9e28778400160fca9e9c689e52b96092304258121e55b00fa3186
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  activity-stream.contile.json
                                                                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\q70bjwr6.default-release\activity-stream.contile.json
                                                                  • Size 4KB
                                                                  • SHA256 038b5680f4f7e5bf4ffd45442d06258299244c0ad90a85019d63ded111c6d32e
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  activity-stream.discovery_stream.json
                                                                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\q70bjwr6.default-release\activity-stream.discovery_stream.json
                                                                  • Size 75KB
                                                                  • SHA256 19bd1b40722874eabf68bef1dfe56d74110acbdf13e913b7b1d3ae0d3b4aa4e8
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  E9338C5CCF1E2FCF149487351399F198A4F9FCD6
                                                                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\q70bjwr6.default-release\cache2\entries\E9338C5CCF1E2FCF149487351399F198A4F9FCD6
                                                                  • Size 16KB
                                                                  • SHA256 b03ecac6d6f27ff445fc5a05c00e8995d97f0fdf889d90c76e81811f8aa0f6d2
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  webext.sc.lz4
                                                                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\q70bjwr6.default-release\startupCache\webext.sc.lz4
                                                                  • Size 104KB
                                                                  • SHA256 2ca0b8af3b9fb33ec6a1a1537fc0e5e9c48a81c2f385e2f1d228b4f9641af6ad
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  webext.sc.lz4
                                                                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\q70bjwr6.default-release\startupCache\webext.sc.lz4
                                                                  • Size 105KB
                                                                  • SHA256 38253f7b1e0e86f765f0d503542abba1618970b79bf3af419b23f48383a30ba0
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  4afb3217-996b-488f-98cd-5dab2a24725f.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\4afb3217-996b-488f-98cd-5dab2a24725f.tmp
                                                                  • Size 10KB
                                                                  • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  b8fb6474-9af1-40d4-ab65-1dc8c7188a86.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\b8fb6474-9af1-40d4-ab65-1dc8c7188a86.tmp
                                                                  • Size 1B
                                                                  • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  c006b515-1d6c-409e-b395-9a828bfcfa5d.zip
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\c006b515-1d6c-409e-b395-9a828bfcfa5d.zip
                                                                  • Size 3.8MB
                                                                  • SHA256 2fe9151f44f1da557deb1bb33c03984afd9f685a92960cd67c028be6c8e7be43
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  content.js
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5196_1017499769\CRX_INSTALL\content.js
                                                                  • Size 9KB
                                                                  • SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  messages.json
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5196_1361585566\CRX_INSTALL\_locales\en_CA\messages.json
                                                                  • Size 711B
                                                                  • SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  tmpaddon
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                                  • Size 11KB
                                                                  • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  tmpaddon
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                                  • Size 502KB
                                                                  • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  tmpaddon
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                                  • Size 21.6MB
                                                                  • SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  addonStartup.json.lz4
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\addonStartup.json.lz4
                                                                  • Size 4KB
                                                                  • SHA256 c07d2416c1529eb2a39a4aed2ef34fb5135d2bc2f2d0e2c4cd6e879f4ad25951
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  broadcast-listeners.json
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\broadcast-listeners.json
                                                                  • Size 221B
                                                                  • SHA256 4737ab736a292e25cd706019004d44872aec9d759c7ab93439130ff093d13f93
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  broadcast-listeners.json
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\broadcast-listeners.json
                                                                  • Size 221B
                                                                  • SHA256 cb706b53c33bbc19288361729ca5a12116e93138dc0c35d5549281fbbf5cfafc
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  compatibility.ini
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\compatibility.ini
                                                                  • Size 198B
                                                                  • SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  store.json.mozlz4
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\crashes\store.json.mozlz4
                                                                  • Size 66B
                                                                  • SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  data.safe.tmp
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\datareporting\glean\db\data.safe.tmp
                                                                  • Size 7KB
                                                                  • SHA256 1f7b9463377bae990d4a30da52b35b7e234b25dbdc72b115975565b7ae4c551e
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  data.safe.tmp
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\datareporting\glean\db\data.safe.tmp
                                                                  • Size 35KB
                                                                  • SHA256 28f5c7732bfc5717ccb7507f0df2b5e5a429d22bea1c9af698da1cd0a58f8b8b
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  data.safe.tmp
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\datareporting\glean\db\data.safe.tmp
                                                                  • Size 35KB
                                                                  • SHA256 cb597814dab96153a81bc02300ead75ab695eacab589261b3be607ba31259645
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  data.safe.tmp
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\datareporting\glean\db\data.safe.tmp
                                                                  • Size 35KB
                                                                  • SHA256 fe13f5903ca0d0c142184542ba872dea8de59996bae80372f9c42319c53e80a1
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  data.safe.tmp
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\datareporting\glean\db\data.safe.tmp
                                                                  • Size 7KB
                                                                  • SHA256 102fab6838df60b2dcb94e81ec75680f878407700aa00ac4a5eb38b4623f0c8f
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  events
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\datareporting\glean\events\events
                                                                  • Size 1KB
                                                                  • SHA256 0d526ffabe638b3de6702517afebe53f5fc9436d6df839a11fda7eb2071602c4
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  1d01b83d-4001-464a-b0e2-4313f9f0361c
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\datareporting\glean\pending_pings\1d01b83d-4001-464a-b0e2-4313f9f0361c
                                                                  • Size 235B
                                                                  • SHA256 531b5726d8164dd43c15848d96a5e7a17cecfef1ab10de438c7eb20b4022eeb1
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  3d302c6b-5e32-48f4-b18e-a15365324d3a
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\datareporting\glean\pending_pings\3d302c6b-5e32-48f4-b18e-a15365324d3a
                                                                  • Size 14KB
                                                                  • SHA256 b0c27c161cc5fc17d2d7bd85715bc127ce6e35cedee8a7833a7b4260c88df216
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  8f351836-ba68-44cc-ae43-3dfb3cd76dd6
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\datareporting\glean\pending_pings\8f351836-ba68-44cc-ae43-3dfb3cd76dd6
                                                                  • Size 883B
                                                                  • SHA256 13850f7d8aee686c7f0959ec3dbed07889e5df2449073ec8f6a1e1bd07872166
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  a4d063fd-cf9e-4363-9189-bbb0c8c1a7e5
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\datareporting\glean\pending_pings\a4d063fd-cf9e-4363-9189-bbb0c8c1a7e5
                                                                  • Size 2KB
                                                                  • SHA256 25d9aa6a1990d964c258445713b2422f76c93263f41919a018a08a8bcc1929d7
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  ace231e9-45b0-4d84-93aa-4157a11d6292
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\datareporting\glean\pending_pings\ace231e9-45b0-4d84-93aa-4157a11d6292
                                                                  • Size 886B
                                                                  • SHA256 c73e1ee3b672dab19bd890ba7b73bfb4207c75e66f405509b44593e45771dfd8
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  f37b59d8-d603-4db1-95cd-d31c074a97c9
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\datareporting\glean\pending_pings\f37b59d8-d603-4db1-95cd-d31c074a97c9
                                                                  • Size 235B
                                                                  • SHA256 730e1e5df2178e492e9e87bd987d75991b03439aad997af3fb7cececdb0066da
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  extension-preferences.json
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\extension-preferences.json
                                                                  • Size 942B
                                                                  • SHA256 aecfc11c0db969b2c79da2144415a8859c77d66fbfc37ca4924ac58a0ff29834
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  extensions.json
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\extensions.json
                                                                  • Size 14KB
                                                                  • SHA256 2bee2a0c066a67e3eb6077cb18e38a40d5a357164158b119c3d8e3f00a58736d
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  gmpopenh264.dll
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                                                                  • Size 1.1MB
                                                                  • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  gmpopenh264.info
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                                                                  • Size 116B
                                                                  • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  LICENSE
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE
                                                                  • Size 473B
                                                                  • SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  manifest.json
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
                                                                  • Size 1002B
                                                                  • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  widevinecdm.dll
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
                                                                  • Size 21.6MB
                                                                  • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  widevinecdm.dll.sig
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll.sig
                                                                  • Size 1KB
                                                                  • SHA256 c5f50bed6afd38490baca2ce8e8fdd1a39849c9f0dc06478a8a2e9226526607b
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  prefs-1.js
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\prefs-1.js
                                                                  • Size 6KB
                                                                  • SHA256 27d74005afca9d5158d59f1a3341e794e3dd8950148411898fbf41c425151a0e
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  prefs.js
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\prefs.js
                                                                  • Size 12KB
                                                                  • SHA256 39a4eb8885c6830ad7caf56bab554f91894483bc4530eab54af42ee690255e89
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  prefs.js
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\prefs.js
                                                                  • Size 6KB
                                                                  • SHA256 2ab5470524ca4e518eba1b1598cca13c7fdaf0c0b2af6f66f033b65c8521cca1
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  prefs.js
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\prefs.js
                                                                  • Size 6KB
                                                                  • SHA256 633dad2e3465b10e4cb69229b2972f9f51b44c9e9691a4357e0126f96f75dffd
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  prefs.js
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\prefs.js
                                                                  • Size 8KB
                                                                  • SHA256 9903c69d37a3f2569f3a132447e83308369f911f380d843bc01f7e694382a0c2
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  sessionCheckpoints.json
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\sessionCheckpoints.json
                                                                  • Size 90B
                                                                  • SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  sessionCheckpoints.json
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\sessionCheckpoints.json
                                                                  • Size 53B
                                                                  • SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  recovery.jsonlz4
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\sessionstore-backups\recovery.jsonlz4
                                                                  • Size 4KB
                                                                  • SHA256 950b0ac1a542ac5cd5b073fb4e763b2034397eccac9cbe358235faafd207ac85
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  recovery.jsonlz4
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\sessionstore-backups\recovery.jsonlz4
                                                                  • Size 4KB
                                                                  • SHA256 a11630f4886d51b6cfa3b3220e20c1f64daf3d04d494ac5f545c078eb32c5bbb
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  3870112724rsegmnoittet-es.sqlite
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                  • Size 7.5MB
                                                                  • SHA256 611292c9c942e369efd78cfd101b3af4f9f25333fe22ef0499aefbd173f5c898
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  3870112724rsegmnoittet-es.sqlite
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                  • Size 7.5MB
                                                                  • SHA256 1dc8d2b05be2e818f5d3540777a6779ac06843018a3909e61254703596e459a3
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  3870112724rsegmnoittet-es.sqlite
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                  • Size 7.5MB
                                                                  • SHA256 62c671896b725921c45302fbb0cf864e1e4e2fcf15cecebc997a2572f677df32
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  3870112724rsegmnoittet-es.sqlite
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                  • Size 5.5MB
                                                                  • SHA256 593271bb5ae2b024464a33889916ce18af1139b112ec02368716ab16d58a8c6c
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  3870112724rsegmnoittet-es.sqlite
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                  • Size 5.5MB
                                                                  • SHA256 eeaaff2545c719dce7764934c390e6934a216d29e11de6a2432d54d9d03df5a4
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  3870112724rsegmnoittet-es.sqlite
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                  • Size 5.5MB
                                                                  • SHA256 120d8564d71972d12d8bdfa6e5b47f6f3e11470f7445193dbf7171201fe9517c
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  3870112724rsegmnoittet-es.sqlite
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                  • Size 6.2MB
                                                                  • SHA256 7eb56bdd0eca8622af450c4e13b958f1d972adeeb2131e0aa7cb3fe34237f25a
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  3870112724rsegmnoittet-es.sqlite
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                  • Size 7.5MB
                                                                  • SHA256 e970a1d68d0d353baade3e2393f4a7849b707cc73dbce819d606ec3c6f4b621f
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  3870112724rsegmnoittet-es.sqlite
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                  • Size 7.5MB
                                                                  • SHA256 5e98da618c6d80972333576edc7e241dece237570a4281c982c8b8cad0a8d853
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  3870112724rsegmnoittet-es.sqlite
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                  • Size 7.5MB
                                                                  • SHA256 0bf74026811913ef1521e92c8378d6e03b86ebcf207010ebf6fee61bd8839f7f
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  3870112724rsegmnoittet-es.sqlite
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                  • Size 7.5MB
                                                                  • SHA256 a72434265f83141b08e9115033a6a57f4738f6179c5f7ae092a97b676e3efdfa
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  targeting.snapshot.json
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\targeting.snapshot.json
                                                                  • Size 3KB
                                                                  • SHA256 0477786f5f05eaea83045b57bfdfe4564c30973f49e465c1f53dd369bf4ad6ab
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  manifest.json
                                                                  • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5196_1705509953\manifest.json
                                                                  • Size 43B
                                                                  • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  manifest.json
                                                                  • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5196_566962030\manifest.json
                                                                  • Size 135B
                                                                  • SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  memory/2312-473-0x0000000000130000-0x0000000000725000-memory.dmp
                                                                  Download

                                                                  memory/2312-447-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                  Download

                                                                  memory/2312-976-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                  Download

                                                                  memory/2312-974-0x0000000000130000-0x0000000000725000-memory.dmp
                                                                  Download

                                                                  memory/2312-25-0x0000000000130000-0x0000000000725000-memory.dmp
                                                                  Download

                                                                  memory/2312-26-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                  Download

                                                                  memory/2312-16-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                  Download

                                                                  memory/2312-474-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                  Download

                                                                  memory/2312-9-0x0000000000131000-0x0000000000132000-memory.dmp
                                                                  Download

                                                                  memory/2312-481-0x0000000000130000-0x0000000000725000-memory.dmp
                                                                  Download

                                                                  memory/2312-3-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                  Download