Overview

overview

10

Static

static

10

2026-11-02...op.exe

windows10-2004-x64

10

2026-11-02...op.exe

windows11-ltsc_2024-x64

10

Resubmissions

02/11/2026, 22:30

261102-2ese7sfx8k10

02/11/2026, 00:58

261102-bbz3rs1x9r10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/11/2026, 22:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-02_6f561df7b189dd94817420ffda9fd6f0_darkgate_elex_floxif_glassworm_neshta_ransomhub_remcos_stop.exe
  • Size 6.3MB
  • Sample261102-2ese7sfx8k
  • SHA256 5e9f8d5ac3a379cad79db5b7c64ada350a5c864a60e6d891d619a4785a61a204
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarebackdoordefense_evasiondiscoveryfloxifneshtapersistencespywarestealertrojanupx

Malware Config

Signatures

  • Family: Floxif, Floodfix

    Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

    backdoortrojanfloxif
  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Detect Neshta payload 64 IoCs
  • Detects Floxif payload 1 IoCs
    backdoor
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 30 IoCs
  • Loads dropped DLL 3 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Checks system information in the registry 2 TTPs 2 IoCs

    System information is often read in order to detect sandboxing environments.

  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 21 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 22 IoCs
    adwarespyware
  • Modifies registry class 19 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-02_6f561df7b189dd94817420ffda9fd6f0_darkgate_elex_floxif_glassworm_neshta_ransomhub_remcos_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-02_6f561df7b189dd94817420ffda9fd6f0_darkgate_elex_floxif_glassworm_neshta_ransomhub_remcos_stop.exe"
    1⤵
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4188
    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-11-02_6f561df7b189dd94817420ffda9fd6f0_darkgate_elex_floxif_glassworm_neshta_ransomhub_remcos_stop.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-11-02_6f561df7b189dd94817420ffda9fd6f0_darkgate_elex_floxif_glassworm_neshta_ransomhub_remcos_stop.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Enumerates connected drives
      • Installs/modifies Browser Helper Object
      • Drops file in Program Files directory
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3548
      • C:\Windows\system32\regsvr32.exe
        C:\Windows\Sysnative\regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\3582-490\IDMShellExt64.dll"
        3⤵
          PID:2100
        • C:\Windows\svchost.com
          "C:\Windows\svchost.com" "C:\PROGRA~1\MOZILL~1\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
          3⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5412
          • C:\PROGRA~1\MOZILL~1\firefox.exe
            C:\PROGRA~1\MOZILL~1\firefox.exe https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:4672
            • C:\PROGRA~1\MOZILL~1\firefox.exe
              C:\PROGRA~1\MOZILL~1\firefox.exe https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
              5⤵
              • Checks processor information in registry
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:5048
              • C:\PROGRA~1\MOZILL~1\firefox.exe
                "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1924 -prefsLen 27097 -prefMapHandle 1928 -prefMapSize 270279 -ipcHandle 2012 -initialChannelId {72d99009-4ef6-4f40-9d72-37b3a7aaae19} -parentPid 5048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5048" -appDir "C:\PROGRA~1\MOZILL~1\browser" - 1 gpu
                6⤵
                  PID:4404
                • C:\PROGRA~1\MOZILL~1\firefox.exe
                  "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2396 -prefsLen 27133 -prefMapHandle 2400 -prefMapSize 270279 -ipcHandle 2416 -initialChannelId {56f2fb28-86ce-4865-92e0-ac9a53a10a6e} -parentPid 5048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5048" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 2 socket
                  6⤵
                    PID:432
                  • C:\PROGRA~1\MOZILL~1\firefox.exe
                    "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -isForBrowser -prefsHandle 4060 -prefsLen 25213 -prefMapHandle 4064 -prefMapSize 270279 -jsInitHandle 4068 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4076 -initialChannelId {74f39d64-2310-4ec6-980f-b7776143308e} -parentPid 5048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5048" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 3 tab
                    6⤵
                    • Checks processor information in registry
                    PID:3436
                  • C:\PROGRA~1\MOZILL~1\firefox.exe
                    "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4272 -prefsLen 27323 -prefMapHandle 4276 -prefMapSize 270279 -ipcHandle 4300 -initialChannelId {74309760-bc35-4349-904d-fab9bb215791} -parentPid 5048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5048" -appDir "C:\PROGRA~1\MOZILL~1\browser" - 4 rdd
                    6⤵
                      PID:4288
                    • C:\PROGRA~1\MOZILL~1\firefox.exe
                      "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -isForBrowser -prefsHandle 3592 -prefsLen 34822 -prefMapHandle 2700 -prefMapSize 270279 -jsInitHandle 3872 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3576 -initialChannelId {3bbde3db-493d-409e-81ef-fd3c4eab0ed3} -parentPid 5048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5048" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 5 tab
                      6⤵
                      • Checks processor information in registry
                      PID:3300
                    • C:\PROGRA~1\MOZILL~1\firefox.exe
                      "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5308 -prefsLen 35010 -prefMapHandle 5312 -prefMapSize 270279 -ipcHandle 1608 -initialChannelId {a56a22e4-5a16-4acd-9b33-e47e839d762c} -parentPid 5048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5048" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 6 utility
                      6⤵
                      • Checks processor information in registry
                      PID:564
                    • C:\PROGRA~1\MOZILL~1\firefox.exe
                      "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -isForBrowser -prefsHandle 5492 -prefsLen 35092 -prefMapHandle 5496 -prefMapSize 270279 -jsInitHandle 5500 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2608 -initialChannelId {00fbf711-2302-4024-a50e-d0efe6846d23} -parentPid 5048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5048" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 7 tab
                      6⤵
                      • Checks processor information in registry
                      PID:6252
                    • C:\PROGRA~1\MOZILL~1\firefox.exe
                      "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -isForBrowser -prefsHandle 5908 -prefsLen 32952 -prefMapHandle 5752 -prefMapSize 270279 -jsInitHandle 5848 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6068 -initialChannelId {8c940c95-cbef-49b4-99de-e21611fa423d} -parentPid 5048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5048" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 8 tab
                      6⤵
                      • Checks processor information in registry
                      PID:4524
                    • C:\PROGRA~1\MOZILL~1\firefox.exe
                      "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -isForBrowser -prefsHandle 5812 -prefsLen 32952 -prefMapHandle 5800 -prefMapSize 270279 -jsInitHandle 6028 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5836 -initialChannelId {50196817-12ca-4052-a2d5-2167dd97ec28} -parentPid 5048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5048" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 9 tab
                      6⤵
                      • Checks processor information in registry
                      PID:3444
                    • C:\PROGRA~1\MOZILL~1\firefox.exe
                      "C:\PROGRA~1\MOZILL~1\firefox.exe" -contentproc -isForBrowser -prefsHandle 5952 -prefsLen 32952 -prefMapHandle 6148 -prefMapSize 270279 -jsInitHandle 6152 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6160 -initialChannelId {426fed35-d795-4e57-a36d-28eaf33397e5} -parentPid 5048 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5048" -win32kLockedDown -appDir "C:\PROGRA~1\MOZILL~1\browser" - 10 tab
                      6⤵
                      • Checks processor information in registry
                      PID:3616
              • C:\Windows\svchost.com
                "C:\Windows\svchost.com" "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\3582-490\IDMShellExt64.dll"
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:5340
                • C:\Windows\SysWOW64\regsvr32.exe
                  C:\Windows\System32\regsvr32.exe /s C:\Users\Admin\AppData\Local\Temp\3582-490\IDMShellExt64.dll
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:3508
              • C:\Windows\svchost.com
                "C:\Windows\svchost.com" "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\3582-490\IDMIECC64.dll"
                3⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4564
                • C:\Windows\SysWOW64\regsvr32.exe
                  C:\Windows\System32\regsvr32.exe /s C:\Users\Admin\AppData\Local\Temp\3582-490\IDMIECC64.dll
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:1252
              • C:\Windows\svchost.com
                "C:\Windows\svchost.com" "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\3582-490\IDMGetAll64.dll"
                3⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2296
                • C:\Windows\SysWOW64\regsvr32.exe
                  C:\Windows\System32\regsvr32.exe /s C:\Users\Admin\AppData\Local\Temp\3582-490\IDMGetAll64.dll
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:4352
              • C:\Windows\svchost.com
                "C:\Windows\svchost.com" "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\3582-490\downlWithIDM64.dll"
                3⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1592
                • C:\Windows\SysWOW64\regsvr32.exe
                  C:\Windows\System32\regsvr32.exe /s C:\Users\Admin\AppData\Local\Temp\3582-490\downlWithIDM64.dll
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:1428
              • C:\Windows\svchost.com
                "C:\Windows\svchost.com" "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" https://www.internetdownloadmanager.com/welcome.html?v=643b16
                3⤵
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:6608
                • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                  C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe https://www.internetdownloadmanager.com/welcome.html?v=643b16
                  4⤵
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Checks system information in the registry
                  • Drops file in Windows directory
                  • Reads the TCP/IP host and domain name from the registry
                  • Enumerates system info in registry
                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of WriteProcessMemory
                  • System policy modification
                  PID:1808
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 --annotation=exe=C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x350,0x7ff83cb6c188,0x7ff83cb6c194,0x7ff83cb6c1a0
                    5⤵
                    • Executes dropped EXE
                    PID:6700
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,7769548367623693212,1646393586022681440,262144 --field-trial-handle=2348,i,4938676733389954385,4185728357550056515,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
                    5⤵
                    • Executes dropped EXE
                    PID:7060
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,14199531152543422904,7522280805860766885,524288 --field-trial-handle=2348,i,4938676733389954385,4185728357550056515,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:11
                    5⤵
                    • Executes dropped EXE
                    • Reads the TCP/IP host and domain name from the registry
                    • System Time Discovery
                    PID:7068
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3380,i,6758479171803078699,172322940103404362,2097152 --field-trial-handle=2348,i,4938676733389954385,4185728357550056515,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:1
                    5⤵
                    • Executes dropped EXE
                    PID:4168
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3368,i,8705758716292067744,1722589743439706851,2097152 --field-trial-handle=2348,i,4938676733389954385,4185728357550056515,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:1
                    5⤵
                    • Executes dropped EXE
                    PID:2440
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2536,i,10545589122560304654,8429896160271687274,524288 --field-trial-handle=2348,i,4938676733389954385,4185728357550056515,262144 --variations-seed-version --mojo-platform-channel-handle=3200 /prefetch:13
                    5⤵
                    • Executes dropped EXE
                    PID:7140
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,13676073122578394030,4876904948119786035,2097152 --field-trial-handle=2348,i,4938676733389954385,4185728357550056515,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:1
                    5⤵
                    • Executes dropped EXE
                    PID:260
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,12481102976445855148,3962229507843648467,2097152 --field-trial-handle=2348,i,4938676733389954385,4185728357550056515,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:9
                    5⤵
                    • Executes dropped EXE
                    PID:3180
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,14318802456967867542,15575761577774218911,524288 --field-trial-handle=2348,i,4938676733389954385,4185728357550056515,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
                    5⤵
                    • Executes dropped EXE
                    PID:1044
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,12669804091801656794,8311304621916739811,524288 --field-trial-handle=2348,i,4938676733389954385,4185728357550056515,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:14
                    5⤵
                    • Executes dropped EXE
                    PID:6924
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,13119210509171497818,12594141500505372669,524288 --field-trial-handle=2348,i,4938676733389954385,4185728357550056515,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
                    5⤵
                    • Executes dropped EXE
                    PID:7108
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,8095360747714167013,15659066186602689964,524288 --field-trial-handle=2348,i,4938676733389954385,4185728357550056515,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:14
                    5⤵
                    • Executes dropped EXE
                    PID:4952
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,3590743413306788075,12685247686023948363,524288 --field-trial-handle=2348,i,4938676733389954385,4185728357550056515,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:14
                    5⤵
                    • Executes dropped EXE
                    PID:2560
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,8121794117527810122,14373099842153055100,524288 --field-trial-handle=2348,i,4938676733389954385,4185728357550056515,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:14
                    5⤵
                    • Executes dropped EXE
                    PID:7156
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,13558941396115818669,11504747816070001467,524288 --field-trial-handle=2348,i,4938676733389954385,4185728357550056515,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:14
                    5⤵
                    • Executes dropped EXE
                    PID:6884
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,3677324248277463282,1730354074098354166,524288 --field-trial-handle=2348,i,4938676733389954385,4185728357550056515,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
                    5⤵
                    • Executes dropped EXE
                    PID:5016
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,11484617632043935412,15779050346915656538,524288 --field-trial-handle=2348,i,4938676733389954385,4185728357550056515,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:14
                    5⤵
                    • Executes dropped EXE
                    PID:3068
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,12799099846081343285,8211135252126870912,524288 --field-trial-handle=2348,i,4938676733389954385,4185728357550056515,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
                    5⤵
                    • Executes dropped EXE
                    PID:1112
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,3988066232741909461,5215101554936339902,524288 --field-trial-handle=2348,i,4938676733389954385,4185728357550056515,262144 --variations-seed-version --mojo-platform-channel-handle=3108 /prefetch:14
                    5⤵
                    • Executes dropped EXE
                    PID:6260
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,2955877537417602463,13652645534686773310,524288 --field-trial-handle=2348,i,4938676733389954385,4185728357550056515,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:14
                    5⤵
                    • Executes dropped EXE
                    PID:7072
                  • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                    "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,4358823381946552275,9210214087282781897,524288 --field-trial-handle=2348,i,4938676733389954385,4185728357550056515,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
                    5⤵
                    • Executes dropped EXE
                    PID:6896
          • C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
            "C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe" --no-startup-window --win-session-start
            1⤵
            • Executes dropped EXE
            PID:1052

          Network

                MITRE ATT&CK Enterprise v16

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Persistence

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Browser Extensions

                1
                T1176

                Event Triggered Execution

                1
                T1546

                Change Default File Association

                1
                T1546.001

                Privilege Escalation

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Event Triggered Execution

                1
                T1546

                Change Default File Association

                1
                T1546.001

                Defense Evasion

                Modify Registry

                5
                T1112

                Credential Access

                Credentials from Password Stores

                1
                T1555

                Credentials from Web Browsers

                1
                T1555.003

                Unsecured Credentials

                1
                T1552

                Credentials In Files

                1
                T1552.001

                Discovery

                Browser Information Discovery

                1
                T1217

                Peripheral Device Discovery

                1
                T1120

                Query Registry

                6
                T1012

                System Information Discovery

                6
                T1082

                System Location Discovery

                1
                T1614

                System Language Discovery

                1
                T1614.001

                System Network Configuration Discovery

                1
                T1016

                System Time Discovery

                1
                T1124

                Lateral Movement

                Collection

                Data from Local System

                1
                T1005

                Command and Control

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                ACROBR~1.EXE
                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE
                • Size 328KB
                • SHA256 888a1dd0033e5d758a4e731e3e55357de866e80d03b1b194375f714e1fd4351d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ACROTE~1.EXE
                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
                • Size 86KB
                • SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ADOBEC~1.EXE
                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE
                • Size 5.7MB
                • SHA256 1b5c715d71384f043843ea1785a6873a9f39d2daae112ccdeffcd88b10a3a403
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ADelRCP.exe
                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe
                • Size 175KB
                • SHA256 3f00404dd591c2856e6f71bd78423ed47199902e0b85f228e6c4de72c59ddffe
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                RdrCEF.exe
                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe
                • Size 9.4MB
                • SHA256 31da9632f5d25806b77b617d48da52a14afc574bbe1653120f97705284ea566c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AcroRd32.exe
                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
                • Size 2.4MB
                • SHA256 8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                WCCHRO~1.EXE
                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE
                • Size 183KB
                • SHA256 ecd5e94da88c653e4c34b6ab325e0aca8824247b290336f75c410caa16381bc5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Eula.exe
                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe
                • Size 131KB
                • SHA256 5c3ef3ec7594c040146e908014791dd15201ba58b4d70032770bb661b6a0e394
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                FULLTR~1.EXE
                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE
                • Size 254KB
                • SHA256 16d65f2463658a72dba205dcaa18bc3d0bab4453e726233d68bc176e69db0950
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                LOGTRA~1.EXE
                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE
                • Size 386KB
                • SHA256 473eb551101caeaf2d18f811342e21de323c8dd19ed21011997716871defe997
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                READER~1.EXE
                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE
                • Size 92KB
                • SHA256 2f947e3ca624ce7373080b4a3934e21644fb070a53feeaae442b15b849c2954f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                WOW_HE~1.EXE
                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE
                • Size 147KB
                • SHA256 750824b5f75c91a6c2eeb8c5e60ae28d7a81e323d3762c8652255bfea5cba0bb
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                arh.exe
                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe
                • Size 125KB
                • SHA256 fe44ca8d5050932851aa54c23133277e66db939501af58e5aeb7b67ec1dde7b5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                32BITM~1.EXE
                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE
                • Size 142KB
                • SHA256 3e9da97a7106122245e77f13f3f3cc96c055d732ab841eb848d03ac25401c1bc
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                64BITM~1.EXE
                • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE
                • Size 278KB
                • SHA256 22a585c183e27b3c732028ff193733c2f9d03700a0e95e65c556b0592c43d880
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ADOBEA~1.EXE
                • Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE
                • Size 454KB
                • SHA256 bb07d817b8b1b6b4c25e62b6120e51dec10118557d7b6b696ad084a5ba5bfdeb
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AdobeARM.exe
                • Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe
                • Size 1.2MB
                • SHA256 b1ec065f71cc40f400e006586d370997102860504fd643b235e8ed9f5607262a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                jaureg.exe
                • Path C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe
                • Size 555KB
                • SHA256 c5a99f42100834599e4995d0a178b32b772a6e774a4050a6bb00438af0a6a1f3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                VSTOIN~1.EXE
                • Path C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE
                • Size 121KB
                • SHA256 405b8bd647fa703e233b8b609a18999abe465a8458168f1daf23197bd2ea36aa
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                java.exe
                • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe
                • Size 325KB
                • SHA256 5e2e22ead49ce9cc11141dbeebbe5b93a530c966695d8efc2083f00e6be53423
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javaw.exe
                • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe
                • Size 325KB
                • SHA256 e2262c798729169f697e6c30e5211cde604fd8b14769311ff4ea81abba8c2781
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                javaws.exe
                • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe
                • Size 505KB
                • SHA256 da73b6e071788372702104b9c72b6697e84e7c75e248e964996700b77c6b6f1c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                DISABL~1.EXE
                • Path C:\PROGRA~2\Google\Update\DISABL~1.EXE
                • Size 5.7MB
                • SHA256 3acf99624820fd862ac30780021108f0ff2df60db3df351cd17400404f279d3c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MI9C33~1.EXE
                • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MI9C33~1.EXE
                • Size 138KB
                • SHA256 3bc53b54d6a2f0819c5f9fc43e9fc3b6579843c23b37039b6711c2af5a726cd1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MICROS~1.EXE
                • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MICROS~1.EXE
                • Size 223KB
                • SHA256 fe2d4359da69b28aa924ea8e144c8cb12250be7f8ab41485b4b86fe40ab49e14
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MICROS~2.EXE
                • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MICROS~2.EXE
                • Size 242KB
                • SHA256 e1680751388c4af523a769ce4e16ae013c7d8b7a1b03e56b97525bbb918b647b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MICROS~3.EXE
                • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MICROS~3.EXE
                • Size 138KB
                • SHA256 0c67d6d3361be736320cca1522b7a08cfaf7aaa8f04311dfeae2eaff8415834c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MICROS~4.EXE
                • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MICROS~4.EXE
                • Size 256KB
                • SHA256 54680d4ec289fc3dab85466803f01a6d7be5933abab940f7e1ec597c32aa7f64
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MID1AD~1.EXE
                • Path C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MID1AD~1.EXE
                • Size 302KB
                • SHA256 7bda2feca295068adc7109ae2092010212a1f130d01d11b0b15843733d8832b1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ie_to_edge_stub.exe
                • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\BHO\ie_to_edge_stub.exe
                • Size 553KB
                • SHA256 7b2d809ff4b2691c04855f4bb3d89b88fa4d1d65c8c35d3941a26f015947cde9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                setup.exe
                • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\INSTAL~1\setup.exe
                • Size 6.8MB
                • SHA256 78e1d1e4460914eb8be59bb96d9897562a0ac65a5fbce63349f43ee56ba5e83b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                cookie_exporter.exe
                • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\cookie_exporter.exe
                • Size 157KB
                • SHA256 3ecafed639ffb272e758902d1baa0b399c044bfb744cedd6bda1ed40516ca132
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                elevation_service.exe
                • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\elevation_service.exe
                • Size 1.7MB
                • SHA256 2177d0e64ef5cd4d3ad386606feb8d45ae0a7d070f19583b67eea9407272b9f0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                identity_helper.exe
                • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\identity_helper.exe
                • Size 1.2MB
                • SHA256 d2decf24ecc69018df3da6dde66ca81e168dbcea91c6d4ceb428a1929778b39e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                msedge.exe
                • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedge.exe
                • Size 3.9MB
                • SHA256 39cf8228fc39959bcd27f64512c81e5049eeed843387016d4c733982b622706d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                msedge_proxy.exe
                • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedge_proxy.exe
                • Size 1.2MB
                • SHA256 6f3f49143cab7ee4c239f74f6649241ddd527040ea390a3a214b1d7b8f113fc7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                msedge_pwa_launcher.exe
                • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedge_pwa_launcher.exe
                • Size 1.6MB
                • SHA256 c3f6a5111276371edf9e46fcb05869f993cb17cac5f8033ee5707ecddc244f5f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                msedgewebview2.exe
                • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedgewebview2.exe
                • Size 3.5MB
                • SHA256 47df542ec5d28a6c75c2d815e9b700c65f587186c02c8f1a2566fdab9e3b5d01
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                notification_helper.exe
                • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\notification_helper.exe
                • Size 1.4MB
                • SHA256 964abff6df613e4f987fa1615a0f7963d177c3c7418b4a719c3121e9752b5a00
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pwahelper.exe
                • Path C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\pwahelper.exe
                • Size 1.2MB
                • SHA256 07b4d83c273dd032f6a763951adc1196ca00568ce2cef2cd9c3a310788fbcd78
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ie_to_edge_stub.exe
                • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\BHO\ie_to_edge_stub.exe
                • Size 562KB
                • SHA256 533d6da98378d3b1bb120b192bc5bd20bbeed6e123fe9fc6c15a4a3504932c71
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                setup.exe
                • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\INSTAL~1\setup.exe
                • Size 7.1MB
                • SHA256 70c13c14a682d65fd82ec72f578e160617f8b7c164414bcce613a9b9ebd0c878
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                cookie_exporter.exe
                • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\cookie_exporter.exe
                • Size 155KB
                • SHA256 30d26d2f766f716cd6b21cdc15065ee4191760ef0d37de51f67dead898fb8e7c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                elevated_tracing_service.exe
                • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevated_tracing_service.exe
                • Size 3.8MB
                • SHA256 c13ce5f473ff68ffdea61e8a4800008f527054f4561f2bf7853f6769d0c02dc5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                elevation_service.exe
                • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevation_service.exe
                • Size 2.2MB
                • SHA256 8c53985c403e44c0c899c2d1f2a0b8afb1f17fb928ff866271de7952c9ff7c66
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                identity_helper.exe
                • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\identity_helper.exe
                • Size 1.4MB
                • SHA256 cd0adfcf43373e05fcf8836cc998cb17e3aaade9f8b190e28ce4331bd026f23c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                msedge_pwa_launcher.exe
                • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge_pwa_launcher.exe
                • Size 1.8MB
                • SHA256 2c31887681976e9691cfed32b98a9f81898beaaee9ea3f7a90fe695b84190511
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                msedgewebview2.exe
                • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedgewebview2.exe
                • Size 3.4MB
                • SHA256 c0566225b047e50773acde8ada568ef7612809e74f2cc200504e60cf7a917c68
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                notification_click_helper.exe
                • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\notification_click_helper.exe
                • Size 1.6MB
                • SHA256 0faa9f1f62a95136d454efa51e6f8e8ff06a08d344fd26dc2216de09f6fbee4e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MSEDGE~1.EXE
                • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE
                • Size 1.5MB
                • SHA256 b4bdab2b2c7731923854f254ba1494c25a11331293c0ee4939afd10ba1e2b575
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                PWAHEL~1.EXE
                • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE
                • Size 1.4MB
                • SHA256 df233ebee614cd9117f7e467f16f4c2225aadbc59213a5695913a4a87f792d6a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                msedge.exe
                • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                • Size 4.0MB
                • SHA256 18f4157c2dabb39cf84662e17c471f69f679840a70be3a4685e0c4ed8ccc207a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                msedge.exe
                • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                • Size 3.9MB
                • SHA256 6d8e5d6a4d1c147b90b5a394a5054840e19dfa3eae3ea706ffb367477cecb929
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                symsrv.dll
                • Path C:\Program Files\Common Files\System\symsrv.dll
                • Size 67KB
                • SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                symsrv.dll.000
                • Path C:\Program Files\Common Files\System\symsrv.dll.000
                • Size 114B
                • SHA256 aefc503b1ed462d7b6280228a7b5b710792273b78934426f88325341ac5b5a92
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                0392e4bc-e548-47fa-a248-60ba3568cc81.tmp
                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0392e4bc-e548-47fa-a248-60ba3568cc81.tmp
                • Size 37KB
                • SHA256 22f51addacb2f896f1768f5de570bf3fb97e8c2172c6de56053ecacbdcc7a270
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                129c3721-ea86-4f7b-b680-fc2344ea0e4f.tmp
                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\129c3721-ea86-4f7b-b680-fc2344ea0e4f.tmp
                • Size 37KB
                • SHA256 343abfc32ccb48c74759f2f838c523fc3cee2d8b5c099d64a639d81eca4d562f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                2785b625-ad09-4cd3-97dc-a85a619cf350.tmp
                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2785b625-ad09-4cd3-97dc-a85a619cf350.tmp
                • Size 38KB
                • SHA256 ba6b43cfa5bce169ace49f2cce56c3e950a67ab084e7f8f5740bb71deb4ece4e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                34392f02-e7fc-4851-b4e5-3ae23f993c0e.tmp
                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\34392f02-e7fc-4851-b4e5-3ae23f993c0e.tmp
                • Size 38KB
                • SHA256 f380988dc94aa513c6e4400366b47f92b627a1bc8ff2ed5d03c1915de3b731bf
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                4dd0e849-d3fa-4d0a-91b1-74887d55cda8.tmp
                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4dd0e849-d3fa-4d0a-91b1-74887d55cda8.tmp
                • Size 28KB
                • SHA256 2c29481b9de9daab0f31150a7fa4c62032c6c052bc9217268c07befbd5e917e8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                62237f00-58de-4272-ba25-51ce9f739090.tmp
                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\62237f00-58de-4272-ba25-51ce9f739090.tmp
                • Size 38KB
                • SHA256 f2e222bb9a532ba082addfc2bd7b930193a2d5478198f008e1752cce6343471d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                settings.dat
                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                • Size 280B
                • SHA256 97f58c0ff1008d9a744980b06de74b1bc42fdd2408c0871566ecacc80738c498
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                settings.dat
                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                • Size 280B
                • SHA256 355a29997d085f70c135b61fb8e48fe3b3d9b6030190662c9d930bd533b88c78
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                the-real-index
                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                • Size 3KB
                • SHA256 d0eb67e282befccbd37f2962152a5fa6ab2f706a5fce9d22286c31da5642e27e
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                the-real-index
                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                • Size 3KB
                • SHA256 0ca20274542d72c5982046442ff6f6a00575654f7dd534e2de5729ea11e16077
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                61c43529-f496-4f00-8329-72de9c35d192.tmp
                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\61c43529-f496-4f00-8329-72de9c35d192.tmp
                • Size 2B
                • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                • MD5 SHA1 SHA512
                Submit Download

                dasherSettingSchema.json
                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
                • Size 854B
                • SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                0445179d-6003-4757-9d48-1053e0e5bea2.tmp
                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0445179d-6003-4757-9d48-1053e0e5bea2.tmp
                • Size 2B
                • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                • MD5 SHA1 SHA512
                Submit Download

                0da19364-670e-43d7-b53e-78c7f1cb70c6.tmp
                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0da19364-670e-43d7-b53e-78c7f1cb70c6.tmp
                • Size 40B
                • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                • MD5 SHA1 SHA512
                Submit Download

                aa63ec17-e48a-484d-a3cc-774069492465.tmp
                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\aa63ec17-e48a-484d-a3cc-774069492465.tmp
                • Size 2KB
                • SHA256 8689b543f50215afa102273f4d2cc00905542cd113b960481cfc1cfd7fe021b5
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                a62e616d-e004-43dc-a32f-8feb8aab6f18.tmp
                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a62e616d-e004-43dc-a32f-8feb8aab6f18.tmp
                • Size 27KB
                • SHA256 37a8bd85bf8d87c465d3af276644e6bde7f9523183d363de51cb0f194fee8437
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                b0cbb174-789a-42e9-9514-b9d39aac86a4.tmp
                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b0cbb174-789a-42e9-9514-b9d39aac86a4.tmp
                • Size 11KB
                • SHA256 e5e6e3c6dab69f637fabc804af35743919afff5b8f529570b8c989035d3a5995
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                c90489cc-c659-48f9-ae03-e4699d7b5bd9.tmp
                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c90489cc-c659-48f9-ae03-e4699d7b5bd9.tmp
                • Size 12KB
                • SHA256 022a4028d17e2bf708f1c752edcfa7f828f2be8e39ab78c979c022845018cee0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                cebfeb10-9c43-4687-b210-f91a79e1a7cb.tmp
                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cebfeb10-9c43-4687-b210-f91a79e1a7cb.tmp
                • Size 12KB
                • SHA256 82aa6c0bebf9809ff37f9aa80722957b74ba8ec989748838104956e893d39fea
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                fc9f701a-8be1-4d5f-a767-c1403842f3a7.tmp
                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fc9f701a-8be1-4d5f-a767-c1403842f3a7.tmp
                • Size 70KB
                • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                f0bcf3aa-763d-4a1d-91b0-98df174d7858.tmp
                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f0bcf3aa-763d-4a1d-91b0-98df174d7858.tmp
                • Size 22KB
                • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ab474034-a7ec-4919-9c1a-2eeeec84c617.tmp
                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ab474034-a7ec-4919-9c1a-2eeeec84c617.tmp
                • Size 28KB
                • SHA256 7489658a0eecacd465d7dbbe87111bf9a6ece090b6c65b72bd35d5c5322d5af5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                1010a25d-dc0f-47d9-ab1b-c2891381f257.tmp
                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\1010a25d-dc0f-47d9-ab1b-c2891381f257.tmp
                • Size 132B
                • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                d9f91781-1774-4c53-9ac9-4ede5c124273.tmp
                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d9f91781-1774-4c53-9ac9-4ede5c124273.tmp
                • Size 32KB
                • SHA256 6d31eb49ddda9546c5394698bd0be41512684bc37b2b0c1b38461864bb212aeb
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                29484def-44ab-4d5f-bb24-5806c09edf31.tmp
                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\29484def-44ab-4d5f-bb24-5806c09edf31.tmp
                • Size 13B
                • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                • MD5 SHA1 SHA512
                Submit Download

                3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
                • Size 158KB
                • SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                4c4f1963-ef27-43ce-80fd-3f609855eb11.tmp
                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4c4f1963-ef27-43ce-80fd-3f609855eb11.tmp
                • Size 132B
                • SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                activity-stream.contile.json
                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xoeudfhc.default-release\activity-stream.contile.json
                • Size 4KB
                • SHA256 e2d610893bfb7e3191bdac1af21571703507cfbe52bd4944bcbed5217acf08a8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                activity-stream.discovery_stream.json
                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xoeudfhc.default-release\activity-stream.discovery_stream.json
                • Size 75KB
                • SHA256 8eb2b83e070848a609ea0b4eeb4c7c421c54a7d18f6617ba3be9ae67b588ff36
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                06A6D86B39A0E3DCE68006525D21C3AAB6C8E0B4
                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xoeudfhc.default-release\cache2\entries\06A6D86B39A0E3DCE68006525D21C3AAB6C8E0B4
                • Size 16KB
                • SHA256 13614e9abc2abae7e106f89408d455cafb6c81ed4227e3e8367531aa6be87153
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                webext.sc.lz4
                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xoeudfhc.default-release\startupCache\webext.sc.lz4
                • Size 104KB
                • SHA256 b6a5173a470706ec14250b9d11fb1ff4fcbc47a8d938c2f4b05c791f69eb8071
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                webext.sc.lz4
                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xoeudfhc.default-release\startupCache\webext.sc.lz4
                • Size 105KB
                • SHA256 b0d9ce22277859726a7af6450ab44eb965eab6dda3a10214e06b34e4345bad32
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                2026-11-02_6f561df7b189dd94817420ffda9fd6f0_darkgate_elex_floxif_glassworm_neshta_ransomhub_remcos_stop.exe
                • Path C:\Users\Admin\AppData\Local\Temp\2026-11-02_6f561df7b189dd94817420ffda9fd6f0_darkgate_elex_floxif_glassworm_neshta_ransomhub_remcos_stop.exe
                • Size 6.4MB
                • SHA256 25e576ed43a68b67c70bc46c04b335df7229c86b933138b1e278eae2a0d116db
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                2026-11-02_6f561df7b189dd94817420ffda9fd6f0_darkgate_elex_floxif_glassworm_neshta_ransomhub_remcos_stop.exe
                • Path C:\Users\Admin\AppData\Local\Temp\3582-490\2026-11-02_6f561df7b189dd94817420ffda9fd6f0_darkgate_elex_floxif_glassworm_neshta_ransomhub_remcos_stop.exe
                • Size 6.3MB
                • SHA256 f79b55182c30c0d241301a178ab214275fe1e225d3d438afc91ae33a20761bba
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                4feb417d-88dd-40f2-ac7d-392114042d62.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\4feb417d-88dd-40f2-ac7d-392114042d62.tmp
                • Size 10KB
                • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                70a90555-1516-4d39-acaa-9051c09969e9.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\70a90555-1516-4d39-acaa-9051c09969e9.tmp
                • Size 1B
                • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                • MD5 SHA1 SHA512
                Submit Download

                content.js
                • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1808_1118910925\CRX_INSTALL\content.js
                • Size 9KB
                • SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                messages.json
                • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1808_39774553\CRX_INSTALL\_locales\en_CA\messages.json
                • Size 711B
                • SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                tmpaddon
                • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                • Size 11KB
                • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                tmpaddon
                • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                • Size 21.9MB
                • SHA256 1090c5d6881985c042370d506e15f1db1d0a88bfb7e9602a9202fac421098eb3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                tmpaddon-1
                • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                • Size 502KB
                • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                addonStartup.json.lz4
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\addonStartup.json.lz4
                • Size 5KB
                • SHA256 3bf89404a4fb235326a4e7fb3df3e0d33f27aa91e49f91659f48ef470710a40b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                addonStartup.json.lz4
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\addonStartup.json.lz4
                • Size 5KB
                • SHA256 d3dd41668dff187570cf160a5c43c0b0676be9337a2fe119eef2400bb526634a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                broadcast-listeners.json
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\broadcast-listeners.json
                • Size 221B
                • SHA256 9dafe71115480c7f2edad2f21194c77c4e1a056a6e7135847fc8d5ea01d69c12
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                store.json.mozlz4
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\crashes\store.json.mozlz4
                • Size 66B
                • SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                data.safe.tmp
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\db\data.safe.tmp
                • Size 36KB
                • SHA256 cdaad4bb4622c89c97e8017ef1e09af1bbba92b38d3dc3972f8fdb216b23238e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                data.safe.tmp
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\db\data.safe.tmp
                • Size 6KB
                • SHA256 0ffef71d62c861c81d42d5a3af890aeb26cd591571accfc28e89bf6662bf2969
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                data.safe.tmp
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\db\data.safe.tmp
                • Size 7KB
                • SHA256 8090f7f8971c43f9be7abc909cadf9d398ccd16176352179512ccc033b291435
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                data.safe.tmp
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\db\data.safe.tmp
                • Size 7KB
                • SHA256 259b925b425b5891f3bfc180b48c97d6f27608851f6935d5f46d183e059c9dda
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                data.safe.tmp
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\db\data.safe.tmp
                • Size 36KB
                • SHA256 dc9e3391a9323af7c25d29b584e26f4d2fc54c1ec00b2e3cbe1401fe94b1233d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                events
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\events\events
                • Size 1KB
                • SHA256 3d644b6a4bd51fb12d4084d5fc7cf4a00a65a273b6211451cebae306cf2cc293
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                events
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\events\events
                • Size 2KB
                • SHA256 7a915f9c4d8782020b14ec87aca9db018dc0287856d5dec0a97be8f9cf3fb684
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                0f2a9109-ee59-4e62-ac1a-a0c7b423ba9e
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\pending_pings\0f2a9109-ee59-4e62-ac1a-a0c7b423ba9e
                • Size 2KB
                • SHA256 45e8a156a22131035722175e7ba1b445cc39ed428ba2a5ce4a24fa63843b6b9d
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                40419456-2765-4bd8-b49e-bca7f7803f81
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\pending_pings\40419456-2765-4bd8-b49e-bca7f7803f81
                • Size 235B
                • SHA256 c6c4f96f081dc2b23794305291ef0ff8e13f88b7cdd4a04fc504741d0f0b334c
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                5cb792e5-4bee-412a-9141-139a7adef1a7
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\pending_pings\5cb792e5-4bee-412a-9141-139a7adef1a7
                • Size 16KB
                • SHA256 9a22c8c1c22ca5ec23d3dec7779d391ebd9891b6ebadacc94eaedf8e76120544
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                8961d1ab-d9a0-4d61-9edb-224fb5956d73
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\pending_pings\8961d1ab-d9a0-4d61-9edb-224fb5956d73
                • Size 886B
                • SHA256 360d6642675ca0f71471f3e3756ea7960f19003e10376a2fb3f2604a1a6a216c
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                bbc2a963-3a90-487a-8451-17ab726d65fc
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\pending_pings\bbc2a963-3a90-487a-8451-17ab726d65fc
                • Size 883B
                • SHA256 18ffc1c34916b1a626bd961347689c9bcbb5c687cf381237632d94cb17301fea
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                ef49bab9-6df6-443b-ae39-f70937f8bc3a
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\pending_pings\ef49bab9-6df6-443b-ae39-f70937f8bc3a
                • Size 235B
                • SHA256 d1cc81d8e4cc3b0e0b7e754ff69c55d35f9742579cf6bad9249c32cb7f0724a7
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                extension-preferences.json
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\extension-preferences.json
                • Size 942B
                • SHA256 aecfc11c0db969b2c79da2144415a8859c77d66fbfc37ca4924ac58a0ff29834
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                extensions.json
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\extensions.json
                • Size 14KB
                • SHA256 a2e21f6b1af114d61328e7decb2a1b15d63ce8587e88f19a3b4a1f892427f15e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                gmpopenh264.dll
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                • Size 1.1MB
                • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                gmpopenh264.info
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                • Size 116B
                • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                LICENSE
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\gmp-widevinecdm\4.10.3112.0\LICENSE
                • Size 473B
                • SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                manifest.json
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\gmp-widevinecdm\4.10.3112.0\manifest.json
                • Size 1005B
                • SHA256 1cc15465230ffb75fd028ee3b2189c8774f56bc7dee8dd17b952e6ca92144004
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                widevinecdm.dll
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\gmp-widevinecdm\4.10.3112.0\widevinecdm.dll
                • Size 21.9MB
                • SHA256 7b44e84403fbb3faee15ca2d56eb8432fdf4eb68812c4460abdd20972528e825
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                widevinecdm.dll.sig
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\gmp-widevinecdm\4.10.3112.0\widevinecdm.dll.sig
                • Size 1KB
                • SHA256 f9f160cb5ca37ef81a3aa80eeb7fef8b302e18c82d92c34f42503e0ab085ada5
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                prefs-1.js
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\prefs-1.js
                • Size 6KB
                • SHA256 09f6625e3c4cc98974d9cca7552d5a38075db3f6b50cffb6fc9c2d976f5f2f8d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                prefs-1.js
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\prefs-1.js
                • Size 6KB
                • SHA256 e531c7949d1d11a9c360075cb4776b0751624fd54d29d72d99fbbbaf04fa7816
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                prefs.js
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\prefs.js
                • Size 6KB
                • SHA256 b07e960d7c4d39925dd18baadced539b6e2c0af1e3e78ced2f9f06ff96c3dacb
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                prefs.js
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\prefs.js
                • Size 7KB
                • SHA256 5c6417858e5474f66f386a1f5f8559532518411501d20b0cecee7028f013c00b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                prefs.js
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\prefs.js
                • Size 12KB
                • SHA256 1b4053c44508d0108a2a9d36031858e09d171dbcab567b55011e3e6b9273397f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                sessionCheckpoints.json
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\sessionCheckpoints.json
                • Size 90B
                • SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                sessionCheckpoints.json
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\sessionCheckpoints.json
                • Size 53B
                • SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                recovery.jsonlz4
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\sessionstore-backups\recovery.jsonlz4
                • Size 4KB
                • SHA256 cdb372adb260137c7208270d29bef5cea34c92d7d5f64774416fdeda67c86517
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                recovery.jsonlz4
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\sessionstore-backups\recovery.jsonlz4
                • Size 4KB
                • SHA256 2f33c31722d5c34fa3e2ef54277abfd6eb987dd8efbbfaae4c2fcc4270eb9d1e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                3870112724rsegmnoittet-es.sqlite
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                • Size 5.7MB
                • SHA256 6843bcf250608866c3cdb09f3dc9e9809e8b043ea78898c7d0ac206f97ce10af
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                3870112724rsegmnoittet-es.sqlite
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                • Size 6.5MB
                • SHA256 310a2ea7cfdfb6ea411637fdeaf41a108e096f0d62fe49aabcb498f25cdc0d86
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                3870112724rsegmnoittet-es.sqlite
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                • Size 7.5MB
                • SHA256 8baf51c2e8d97e43257b1b7d09a821c7f46c8929a87996cddb5dccbe0914793f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                3870112724rsegmnoittet-es.sqlite
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                • Size 7.6MB
                • SHA256 60405e2789abd8ab64c9ab113828013f84c66c2da8c32abde6b63d6160959b41
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                3870112724rsegmnoittet-es.sqlite
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                • Size 7.6MB
                • SHA256 cf9bb39e54fd817166ef7bda9cd856a86adf2b61f9f0b0a7173139b46d789a33
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                3870112724rsegmnoittet-es.sqlite
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                • Size 7.6MB
                • SHA256 33284bc2b9ebe0d35da37950fce831a34c08bf7c5382793d31211515e67e9f8c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                3870112724rsegmnoittet-es.sqlite
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                • Size 5.5MB
                • SHA256 f30f81a71a24ab071ae08b8363874c58d00593d6637a4ac8141c75d0d956af74
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                targeting.snapshot.json
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\targeting.snapshot.json
                • Size 3KB
                • SHA256 50d9aef52bbf1e60df5e0ea557ab9231fbf2adda74e6c167d6b1b027aefa3810
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                manifest.json
                • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1808_1624735401\manifest.json
                • Size 135B
                • SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                manifest.json
                • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1808_2078881261\manifest.json
                • Size 43B
                • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                • MD5 SHA1 SHA512
                Submit Download

                directx.sys
                • Path C:\Windows\directx.sys
                • Size 34B
                • SHA256 8083b6294f20a9b1ffe3de2760d729323ab692aeebc91e4dfaf907b03b6577af
                • MD5 SHA1 SHA512
                Submit Download

                directx.sys
                • Path C:\Windows\directx.sys
                • Size 47B
                • SHA256 1ca11ed09e232331ff2d75bce2948f38a3149c592bd059c18380b266d56a26ec
                • MD5 SHA1 SHA512
                Submit Download

                svchost.com
                • Path C:\Windows\svchost.com
                • Size 40KB
                • SHA256 d14ca7a0b977ff84658b3f765ef24af54fa46b36c5c93decbc4a4b8e712ff896
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/432-660-0x0000019F8E170000-0x0000019F8F170000-memory.dmp
                Download

                memory/564-806-0x0000016752D20000-0x0000016753D20000-memory.dmp
                Download

                memory/1592-826-0x0000000000400000-0x000000000041B000-memory.dmp
                Download

                memory/2296-820-0x0000000000400000-0x000000000041B000-memory.dmp
                Download

                memory/2440-991-0x00007FF860650000-0x00007FF860651000-memory.dmp
                Download

                memory/3300-764-0x000001AEAE960000-0x000001AEAF960000-memory.dmp
                Download

                memory/3436-738-0x000001AA15CD0000-0x000001AA16CD0000-memory.dmp
                Download

                memory/3436-256-0x00007FF860650000-0x00007FF860651000-memory.dmp
                Download

                memory/3444-864-0x0000019513300000-0x0000019514300000-memory.dmp
                Download

                memory/3548-13-0x0000000010000000-0x0000000010030000-memory.dmp
                Download

                memory/3548-849-0x0000000010000000-0x0000000010030000-memory.dmp
                Download

                memory/3548-1097-0x00000000002F0000-0x000000000092B000-memory.dmp
                Download

                memory/3548-848-0x00000000002F0000-0x000000000092B000-memory.dmp
                Download

                memory/3548-249-0x0000000010000000-0x0000000010030000-memory.dmp
                Download

                memory/3548-903-0x00000000002F0000-0x000000000092B000-memory.dmp
                Download

                memory/3548-699-0x0000000010000000-0x0000000010030000-memory.dmp
                Download

                memory/3548-247-0x00000000002F0000-0x000000000092B000-memory.dmp
                Download

                memory/3616-865-0x0000025112540000-0x0000025113540000-memory.dmp
                Download

                memory/4188-696-0x0000000000400000-0x000000000041B000-memory.dmp
                Download

                memory/4188-1420-0x0000000000400000-0x000000000041B000-memory.dmp
                Download

                memory/4188-246-0x0000000000400000-0x000000000041B000-memory.dmp
                Download

                memory/4188-902-0x0000000000400000-0x000000000041B000-memory.dmp
                Download

                memory/4188-1707-0x0000000000400000-0x000000000041B000-memory.dmp
                Download

                memory/4188-1152-0x0000000000400000-0x000000000041B000-memory.dmp
                Download

                memory/4188-840-0x0000000000400000-0x000000000041B000-memory.dmp
                Download

                memory/4288-739-0x000001D8C1690000-0x000001D8C2690000-memory.dmp
                Download

                memory/4404-659-0x000001AF28CD0000-0x000001AF29CD0000-memory.dmp
                Download

                memory/4524-863-0x0000020B68580000-0x0000020B69580000-memory.dmp
                Download

                memory/4564-813-0x0000000000400000-0x000000000041B000-memory.dmp
                Download

                memory/5048-1098-0x00000175367F0000-0x00000175368E2000-memory.dmp
                Download

                memory/5048-1935-0x00000175367F0000-0x00000175368E2000-memory.dmp
                Download

                memory/5048-1405-0x00000175367F0000-0x00000175368E2000-memory.dmp
                Download

                memory/5048-1807-0x00000175367F0000-0x00000175368E2000-memory.dmp
                Download

                memory/5048-647-0x00000175367F0000-0x00000175368E2000-memory.dmp
                Download

                memory/5048-2139-0x00000175367F0000-0x00000175368E2000-memory.dmp
                Download

                memory/5048-874-0x00000175367F0000-0x00000175368E2000-memory.dmp
                Download

                memory/5048-771-0x00000175455F0000-0x0000017545600000-memory.dmp
                Download

                memory/5048-2128-0x00000175367F0000-0x00000175368E2000-memory.dmp
                Download

                memory/5048-2061-0x00000175367F0000-0x00000175368E2000-memory.dmp
                Download

                memory/5048-828-0x00000175367F0000-0x00000175368E2000-memory.dmp
                Download

                memory/5048-648-0x0000017536C70000-0x0000017537C70000-memory.dmp
                Download

                memory/5048-2009-0x00000175367F0000-0x00000175368E2000-memory.dmp
                Download

                memory/5048-1996-0x00000175367F0000-0x00000175368E2000-memory.dmp
                Download

                memory/5048-2091-0x00000175367F0000-0x00000175368E2000-memory.dmp
                Download

                memory/5048-2034-0x00000175367F0000-0x00000175368E2000-memory.dmp
                Download

                memory/5340-759-0x0000000000400000-0x000000000041B000-memory.dmp
                Download

                memory/5412-827-0x0000000000400000-0x000000000041B000-memory.dmp
                Download

                memory/5412-646-0x0000000000400000-0x000000000041B000-memory.dmp
                Download

                memory/5412-1708-0x0000000000400000-0x000000000041B000-memory.dmp
                Download

                memory/5412-1096-0x0000000000400000-0x000000000041B000-memory.dmp
                Download

                memory/5412-873-0x0000000000400000-0x000000000041B000-memory.dmp
                Download

                memory/5412-1404-0x0000000000400000-0x000000000041B000-memory.dmp
                Download

                memory/6252-807-0x000002718CD50000-0x000002718DD50000-memory.dmp
                Download

                memory/6608-939-0x0000000000400000-0x000000000041B000-memory.dmp
                Download

                memory/7060-989-0x00007FF860650000-0x00007FF860651000-memory.dmp
                Download