Overview

overview

10

Static

static

10

2026-11-13...op.exe

windows10-2004-x64

10

2026-11-13...op.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    14/11/2026, 12:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-13_66a9b488f26eebb5ea7379a4755f506f_darkgate_elex_floxif_glassworm_remcos_stop.exe
  • Size 6.3MB
  • Sample261114-n75pcadv5q
  • SHA256 34dbba0e56e1b08e00b2e12b2de8792ad598c2445ccae92a33e12cb735905acc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarebackdoordefense_evasiondiscoveryfloxifpersistencespywarestealertrojanupx

Malware Config

Signatures

  • Family: Floxif, Floodfix

    Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

    backdoortrojanfloxif
  • Detects Floxif payload 1 IoCs
    backdoor
  • Custom signature
    Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 4 IoCs
  • Custom signature
    Detects executables containing SQL queries to confidential data stores. Observed in infostealers 4 IoCs
  • Custom signature
    UPX dump on OEP (original entry point) 7 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 21 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 22 IoCs
    adwarespyware
  • Modifies registry class 18 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-13_66a9b488f26eebb5ea7379a4755f506f_darkgate_elex_floxif_glassworm_remcos_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-13_66a9b488f26eebb5ea7379a4755f506f_darkgate_elex_floxif_glassworm_remcos_stop.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Enumerates connected drives
    • Installs/modifies Browser Helper Object
    • Drops file in Program Files directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3508
    • C:\Windows\system32\regsvr32.exe
      C:\Windows\Sysnative\regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
      2⤵
        PID:1940
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1004
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
          3⤵
          • Checks processor information in registry
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:5328
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1936 -prefsLen 27097 -prefMapHandle 1940 -prefMapSize 270279 -ipcHandle 2020 -initialChannelId {83900ecb-fc47-4c71-a2c0-6676bdce79fe} -parentPid 5328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5328" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
            4⤵
              PID:1604
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2384 -prefsLen 27133 -prefMapHandle 2388 -prefMapSize 270279 -ipcHandle 2396 -initialChannelId {2f49faff-6a69-40cd-833b-43b95219676a} -parentPid 5328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5328" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
              4⤵
                PID:624
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3856 -prefsLen 25213 -prefMapHandle 3860 -prefMapSize 270279 -jsInitHandle 3864 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3872 -initialChannelId {edabc23e-8d54-4e9a-a30a-e8cc70c0fae0} -parentPid 5328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5328" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
                4⤵
                • Checks processor information in registry
                PID:2672
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4028 -prefsLen 27323 -prefMapHandle 4032 -prefMapSize 270279 -ipcHandle 3832 -initialChannelId {66f716c0-fbb0-41c9-97ab-10fdc316be60} -parentPid 5328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5328" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
                4⤵
                  PID:2700
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3100 -prefsLen 34822 -prefMapHandle 3088 -prefMapSize 270279 -jsInitHandle 3144 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3096 -initialChannelId {31edc1cd-8d77-468c-9ec1-b9fc33baf4d8} -parentPid 5328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5328" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                  4⤵
                  • Checks processor information in registry
                  PID:2068
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5076 -prefsLen 35010 -prefMapHandle 5080 -prefMapSize 270279 -ipcHandle 5052 -initialChannelId {657bbf49-3980-4bab-81c0-f4471811553c} -parentPid 5328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5328" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
                  4⤵
                  • Checks processor information in registry
                  PID:4256
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5404 -prefsLen 35062 -prefMapHandle 5408 -prefMapSize 270279 -jsInitHandle 5412 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5420 -initialChannelId {85e15617-40b3-4da9-b27d-0ecbf1fcf559} -parentPid 5328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5328" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
                  4⤵
                  • Checks processor information in registry
                  PID:3568
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5564 -prefsLen 32952 -prefMapHandle 1624 -prefMapSize 270279 -jsInitHandle 5616 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3112 -initialChannelId {018b31e5-fd56-4a3f-a311-e87a16f7d8cf} -parentPid 5328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5328" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                  4⤵
                  • Checks processor information in registry
                  PID:5472
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5700 -prefsLen 32952 -prefMapHandle 5704 -prefMapSize 270279 -jsInitHandle 5708 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5692 -initialChannelId {121a88fd-118b-4f4c-9e24-390be44644a7} -parentPid 5328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5328" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                  4⤵
                  • Checks processor information in registry
                  PID:5272
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5880 -prefsLen 32952 -prefMapHandle 5884 -prefMapSize 270279 -jsInitHandle 5888 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5896 -initialChannelId {ff70f944-6daf-4643-96c0-5554934b879f} -parentPid 5328 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5328" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
                  4⤵
                  • Checks processor information in registry
                  PID:5000
            • C:\Windows\SysWOW64\regsvr32.exe
              "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:4420
            • C:\Windows\SysWOW64\regsvr32.exe
              "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:4312
            • C:\Windows\SysWOW64\regsvr32.exe
              "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:2392
            • C:\Windows\SysWOW64\regsvr32.exe
              "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:2880
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.internetdownloadmanager.com/welcome.html?v=643b16
              2⤵
              • Drops file in Windows directory
              • Enumerates system info in registry
              • Modifies registry class
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:5816
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffc810cc188,0x7ffc810cc194,0x7ffc810cc1a0
                3⤵
                  PID:252
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,4928845183391905581,10089137030501565539,262144 --field-trial-handle=2536,i,9128671149311752384,17210736285763776543,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:2
                  3⤵
                    PID:5048
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1740,i,10108045095807152225,13493750369121775694,524288 --field-trial-handle=2536,i,9128671149311752384,17210736285763776543,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:11
                    3⤵
                    • System Time Discovery
                    PID:2920
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2332,i,8518940275241023992,3999927838387341562,524288 --field-trial-handle=2536,i,9128671149311752384,17210736285763776543,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:13
                    3⤵
                      PID:4672
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3196,i,2983493914362226302,12558648509517731391,2097152 --field-trial-handle=2536,i,9128671149311752384,17210736285763776543,262144 --variations-seed-version --mojo-platform-channel-handle=2848 /prefetch:1
                      3⤵
                        PID:2616
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3192,i,12785023134648734477,3327150789932537334,2097152 --field-trial-handle=2536,i,9128671149311752384,17210736285763776543,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
                        3⤵
                          PID:2356
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,12485734216855444048,16246742270261443985,2097152 --field-trial-handle=2536,i,9128671149311752384,17210736285763776543,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
                          3⤵
                            PID:4276
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,6725646492523377464,14404562756142102651,2097152 --field-trial-handle=2536,i,9128671149311752384,17210736285763776543,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:9
                            3⤵
                              PID:5612
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,12932023743139821119,17188238689009384975,524288 --field-trial-handle=2536,i,9128671149311752384,17210736285763776543,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:14
                              3⤵
                                PID:3424
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,13475774230851829900,14635215817340539382,524288 --field-trial-handle=2536,i,9128671149311752384,17210736285763776543,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
                                3⤵
                                  PID:6532
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,5759963848564349233,9926247204386709779,524288 --field-trial-handle=2536,i,9128671149311752384,17210736285763776543,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
                                  3⤵
                                    PID:6548
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,9473105362688385277,16829477777039211442,524288 --field-trial-handle=2536,i,9128671149311752384,17210736285763776543,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
                                    3⤵
                                      PID:6872
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,9473105362688385277,16829477777039211442,524288 --field-trial-handle=2536,i,9128671149311752384,17210736285763776543,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
                                      3⤵
                                        PID:6900
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,18415845362689404657,9736594802865192263,524288 --field-trial-handle=2536,i,9128671149311752384,17210736285763776543,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
                                        3⤵
                                          PID:4336
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,12412223608688936414,17526729954295199988,524288 --field-trial-handle=2536,i,9128671149311752384,17210736285763776543,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:14
                                          3⤵
                                            PID:6752
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,3302319087989113952,9738100127561238474,524288 --field-trial-handle=2536,i,9128671149311752384,17210736285763776543,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:14
                                            3⤵
                                              PID:6204
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,5648603285056895311,14146864102433744227,524288 --field-trial-handle=2536,i,9128671149311752384,17210736285763776543,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:14
                                              3⤵
                                                PID:6228
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,6575330906031546233,1993196557365206428,524288 --field-trial-handle=2536,i,9128671149311752384,17210736285763776543,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
                                                3⤵
                                                  PID:6216
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2288,i,940635601547534164,17402345840073778932,524288 --field-trial-handle=2536,i,9128671149311752384,17210736285763776543,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
                                                  3⤵
                                                    PID:7012
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,17826606318155504356,15428401356047407941,524288 --field-trial-handle=2536,i,9128671149311752384,17210736285763776543,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:14
                                                    3⤵
                                                      PID:7164
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,2932620880298804205,11023015228896151447,524288 --field-trial-handle=2536,i,9128671149311752384,17210736285763776543,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:14
                                                      3⤵
                                                        PID:6808
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,18129291490344161441,12991914950884683656,524288 --field-trial-handle=2536,i,9128671149311752384,17210736285763776543,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
                                                        3⤵
                                                          PID:4972
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,2982129849642724016,12635653960232216614,524288 --field-trial-handle=2536,i,9128671149311752384,17210736285763776543,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
                                                          3⤵
                                                            PID:6728
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                        1⤵
                                                          PID:2336
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                          1⤵
                                                            PID:6440
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                            1⤵
                                                              PID:6768

                                                            Network

                                                                  MITRE ATT&CK Enterprise v16

                                                                  Reconnaissance

                                                                  Resource Development

                                                                  Initial Access

                                                                  Execution

                                                                  Persistence

                                                                  Boot or Logon Autostart Execution

                                                                  1
                                                                  T1547

                                                                  Registry Run Keys / Startup Folder

                                                                  1
                                                                  T1547.001

                                                                  Browser Extensions

                                                                  1
                                                                  T1176

                                                                  Privilege Escalation

                                                                  Boot or Logon Autostart Execution

                                                                  1
                                                                  T1547

                                                                  Registry Run Keys / Startup Folder

                                                                  1
                                                                  T1547.001

                                                                  Defense Evasion

                                                                  Modify Registry

                                                                  3
                                                                  T1112

                                                                  Credential Access

                                                                  Credentials from Password Stores

                                                                  1
                                                                  T1555

                                                                  Credentials from Web Browsers

                                                                  1
                                                                  T1555.003

                                                                  Unsecured Credentials

                                                                  1
                                                                  T1552

                                                                  Credentials In Files

                                                                  1
                                                                  T1552.001

                                                                  Discovery

                                                                  Browser Information Discovery

                                                                  1
                                                                  T1217

                                                                  Peripheral Device Discovery

                                                                  1
                                                                  T1120

                                                                  Query Registry

                                                                  4
                                                                  T1012

                                                                  System Information Discovery

                                                                  5
                                                                  T1082

                                                                  System Location Discovery

                                                                  1
                                                                  T1614

                                                                  System Language Discovery

                                                                  1
                                                                  T1614.001

                                                                  System Network Configuration Discovery

                                                                  1
                                                                  T1016

                                                                  System Time Discovery

                                                                  1
                                                                  T1124

                                                                  Lateral Movement

                                                                  Collection

                                                                  Data from Local System

                                                                  1
                                                                  T1005

                                                                  Command and Control

                                                                  Exfiltration

                                                                  Impact

                                                                  Replay Monitor

                                                                  Loading Replay Monitor...

                                                                  Downloads

                                                                  symsrv.dll
                                                                  • Path C:\Program Files\Common Files\System\symsrv.dll
                                                                  • Size 67KB
                                                                  • SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  symsrv.dll.000
                                                                  • Path C:\Program Files\Common Files\System\symsrv.dll.000
                                                                  • Size 114B
                                                                  • SHA256 aefc503b1ed462d7b6280228a7b5b710792273b78934426f88325341ac5b5a92
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  6fbfd1d8-bb8f-4326-91bf-6d35301f9203.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6fbfd1d8-bb8f-4326-91bf-6d35301f9203.tmp
                                                                  • Size 34KB
                                                                  • SHA256 b20a074f03e19d0add7b606542e179a69708c31cc80eecc27c1d7b8e87d99891
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  89b00514-01e9-4605-8ffc-8aa1531101cd.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\89b00514-01e9-4605-8ffc-8aa1531101cd.tmp
                                                                  • Size 42KB
                                                                  • SHA256 a46fd6911e2a0260b1bde2f57961b682a03546895271545eba5a499b83c1af22
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  manifest.json
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
                                                                  • Size 135B
                                                                  • SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  settings.dat
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                  • Size 280B
                                                                  • SHA256 e1837ee53009f9b691f7aee3be45ffb945d4894bf04ccaf875b9947114bb5224
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  38bad225-241b-4d50-9d51-82f789c429e7.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\38bad225-241b-4d50-9d51-82f789c429e7.tmp
                                                                  • Size 11KB
                                                                  • SHA256 c8e2c41aa4057452b91ed938a9fc1222d8a5abf356f1d5bf64d84c1fb2baa5ba
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  3ce3c31e-3497-43e3-b66b-1788096cd240.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3ce3c31e-3497-43e3-b66b-1788096cd240.tmp
                                                                  • Size 12KB
                                                                  • SHA256 827fdc81c82e506af80882e530d715e72485156e48f1b40f68bc633781b832e5
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  40319853-4b1d-4fcd-9fd3-0fc622bd5ab3.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\40319853-4b1d-4fcd-9fd3-0fc622bd5ab3.tmp
                                                                  • Size 29KB
                                                                  • SHA256 6ff50cd6bfc7181b726c198841315c4b9fa26395df49153c6e2865e0b08e37ca
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  76e08289-0f45-430c-bfde-615a45e8878e.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\76e08289-0f45-430c-bfde-615a45e8878e.tmp
                                                                  • Size 70KB
                                                                  • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  LOG.old
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                  • Size 334B
                                                                  • SHA256 91cf3828d0afc4914b8ce1ca49e9ab220b85bf70744de3ad796a4851fb0bc803
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  LOG.old
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                  • Size 334B
                                                                  • SHA256 f597d0576a4d3a4a5100fc8428bfb5547ae35e3a2db052a758b7b1bba2781257
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  temp-index
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                  • Size 3KB
                                                                  • SHA256 96a9b2c1f60b23a6d7e4a196acdc5e7053f50f8f4e8564cd0c46d7d9201040fa
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  the-real-index
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                  • Size 3KB
                                                                  • SHA256 e36181adb80785904d906cf05cb489f357ab18f398b15c3323d3559363c3d993
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  5dbfe276-1aac-4ec7-b605-f449cc84aa6a.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\5dbfe276-1aac-4ec7-b605-f449cc84aa6a.tmp
                                                                  • Size 2B
                                                                  • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  18972aaa-e505-42d7-9b5b-dfb969024b1a.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\18972aaa-e505-42d7-9b5b-dfb969024b1a.tmp
                                                                  • Size 2KB
                                                                  • SHA256 3eeaf8c99a4f997eec56a76d34a833cb7319abbb6089068b7027c55cc023d8f9
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  64c00a25-0681-4af6-874c-69055d696752.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\64c00a25-0681-4af6-874c-69055d696752.tmp
                                                                  • Size 40B
                                                                  • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  bb15eef4-9fbe-41a4-8025-9afc7763d4ea.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\bb15eef4-9fbe-41a4-8025-9afc7763d4ea.tmp
                                                                  • Size 2B
                                                                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  c8f5cb50-e260-477b-abc8-fd4b5f2bec07.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c8f5cb50-e260-477b-abc8-fd4b5f2bec07.tmp
                                                                  • Size 11KB
                                                                  • SHA256 c1af7b8e54510c166ddec1fcc2f67db785a7cde20f69453f27997fce67a6e149
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  OperationConfig
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                  • Size 3KB
                                                                  • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  b09a1f63-e9c0-47fc-b7a4-8604ebad3e7c.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b09a1f63-e9c0-47fc-b7a4-8604ebad3e7c.tmp
                                                                  • Size 22KB
                                                                  • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  manifest.json
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\OriginTrials\0.0.1.7\manifest.json
                                                                  • Size 43B
                                                                  • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  c5e501aa-82b4-497d-ad7d-d606e736f735.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c5e501aa-82b4-497d-ad7d-d606e736f735.tmp
                                                                  • Size 37KB
                                                                  • SHA256 3f82529613166e9cd4f084498de356e569a662ad854c2db3e20d6137bc8e9222
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  879d61fb-d1ba-49ad-85b8-d5c863e2e7c7.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\879d61fb-d1ba-49ad-85b8-d5c863e2e7c7.tmp
                                                                  • Size 132B
                                                                  • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  b8ebdf88-005a-49be-8cdb-56c83d7e0888.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\b8ebdf88-005a-49be-8cdb-56c83d7e0888.tmp
                                                                  • Size 252B
                                                                  • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  d1485593-6173-4cc7-b21c-706762040a01.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d1485593-6173-4cc7-b21c-706762040a01.tmp
                                                                  • Size 40KB
                                                                  • SHA256 5148c0777fde4840c2dfde23a93e7b708fd1279b80c40c861ac6e9108a8017e0
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  d3587730-ea8f-4be0-a9d2-058431ec0749.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d3587730-ea8f-4be0-a9d2-058431ec0749.tmp
                                                                  • Size 38KB
                                                                  • SHA256 c1975d0af8881969d50fa647290821eb94a2ee08951efbb03e357f9005ec3e73
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  3bbbb003-e418-4b8c-875a-217b9ee45292.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3bbbb003-e418-4b8c-875a-217b9ee45292.tmp
                                                                  • Size 13B
                                                                  • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  fb7c03ab-cda7-4b51-b39f-5a807dd65a17.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fb7c03ab-cda7-4b51-b39f-5a807dd65a17.tmp
                                                                  • Size 34KB
                                                                  • SHA256 03680645409e5efc715e314c466847033dd3aeff688fe41e67819bc561d12a22
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  activity-stream.contile.json
                                                                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\activity-stream.contile.json
                                                                  • Size 4KB
                                                                  • SHA256 e731291f40cf1fbf3cc363c5e2e2e23a0490700fead89d3700ba9a091cac73c0
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  activity-stream.discovery_stream.json
                                                                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\activity-stream.discovery_stream.json
                                                                  • Size 75KB
                                                                  • SHA256 dd107326111cd7719f1f4864aeca2cb26921f1cdd532900d7acad8cd430c9b6a
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  06A6D86B39A0E3DCE68006525D21C3AAB6C8E0B4
                                                                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\cache2\entries\06A6D86B39A0E3DCE68006525D21C3AAB6C8E0B4
                                                                  • Size 16KB
                                                                  • SHA256 aba80cebb10ad979aec1f20aef42890a51fc9c2e9fa14e454190fd009699563d
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  webext.sc.lz4
                                                                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\startupCache\webext.sc.lz4
                                                                  • Size 105KB
                                                                  • SHA256 619deda6b945dd089c9b53e83824251455e69df42b0df02b24483bc1623f1da6
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  webext.sc.lz4
                                                                  • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\startupCache\webext.sc.lz4
                                                                  • Size 106KB
                                                                  • SHA256 bd789b6939c91055527e3f0183d5e381975303bdb4e9d02fcc9eaa6cd15ed79c
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  d1ce7b98-426b-45a7-bea8-a6e07d0bb303.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\d1ce7b98-426b-45a7-bea8-a6e07d0bb303.tmp
                                                                  • Size 1B
                                                                  • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                  • MD5 SHA1 SHA512
                                                                  Submit Download

                                                                  verified_contents.json
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5816_1823837625\CRX_INSTALL\_metadata\verified_contents.json
                                                                  • Size 1KB
                                                                  • SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  content.js
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5816_1823837625\CRX_INSTALL\content.js
                                                                  • Size 9KB
                                                                  • SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  manifest.json
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5816_1823837625\CRX_INSTALL\manifest.json
                                                                  • Size 962B
                                                                  • SHA256 5694c91f7d165c6f25daf0825c18b373b0a81ea122c89da60438cd487455fd6a
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  f61f6def-dd8c-4e3d-bfdf-6b7dd33fcc67.tmp
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5816_1823837625\f61f6def-dd8c-4e3d-bfdf-6b7dd33fcc67.tmp
                                                                  • Size 10KB
                                                                  • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  tmpaddon
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                                  • Size 11KB
                                                                  • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  tmpaddon
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                                  • Size 21.6MB
                                                                  • SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  tmpaddon-1
                                                                  • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                                                                  • Size 502KB
                                                                  • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  addonStartup.json.lz4
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\addonStartup.json.lz4
                                                                  • Size 4KB
                                                                  • SHA256 b700862ff3523453ac17cb14efbd23590d55cafe633a546d8f8f5ad3011970af
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  broadcast-listeners.json
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\broadcast-listeners.json
                                                                  • Size 221B
                                                                  • SHA256 03af3b4c01fca0594d0cb0c937d63a0a2ff7e5bd35d8bbabf29563276bcb21a4
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  compatibility.ini
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\compatibility.ini
                                                                  • Size 198B
                                                                  • SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  store.json.mozlz4
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\crashes\store.json.mozlz4
                                                                  • Size 66B
                                                                  • SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  data.safe.tmp
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\datareporting\glean\db\data.safe.tmp
                                                                  • Size 35KB
                                                                  • SHA256 0ae073188ab62ea1dde183de7a7fe75d18a2362852c403bc4b74774ec6f422fe
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  data.safe.tmp
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\datareporting\glean\db\data.safe.tmp
                                                                  • Size 35KB
                                                                  • SHA256 faf76c9e011789e58e2168ae52f18c621eeebaca1df7d4cb26de03e8cd96d83e
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  data.safe.tmp
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\datareporting\glean\db\data.safe.tmp
                                                                  • Size 7KB
                                                                  • SHA256 179fdcf09d53ec3406efd1999110a5f32b8f908fac981b51f3901d261456c59c
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  events
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\datareporting\glean\events\events
                                                                  • Size 1KB
                                                                  • SHA256 68be13223f17f52f13ad24a8f11e5b49b72b9ecc2c51b92c6133b0f2b694894a
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  14695be2-c6a2-40df-adaf-40950a1366ab
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\datareporting\glean\pending_pings\14695be2-c6a2-40df-adaf-40950a1366ab
                                                                  • Size 2KB
                                                                  • SHA256 1a7f0624b9e049bbdbe6569af88019fbf3230359e8a35055f9fb4bf2f0858e86
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  2a545b67-91e3-4a3a-8e31-a4a26ca57342
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\datareporting\glean\pending_pings\2a545b67-91e3-4a3a-8e31-a4a26ca57342
                                                                  • Size 2KB
                                                                  • SHA256 1118d211cb845845ee60bb78bb4a3c68a1adbecd31163fc9d6efbeeb25791f45
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  5a68c317-cf1e-4b98-8aa2-680e9041a61c
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\datareporting\glean\pending_pings\5a68c317-cf1e-4b98-8aa2-680e9041a61c
                                                                  • Size 235B
                                                                  • SHA256 5e1adf751cac73457d1dad4bc8b91b460563d06c33c76d15cb68cf3ea2c6286b
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  600dca2a-f36d-427b-bf1b-f151dc28f946
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\datareporting\glean\pending_pings\600dca2a-f36d-427b-bf1b-f151dc28f946
                                                                  • Size 235B
                                                                  • SHA256 d975244fe0ccd4f1368063bbe4c1a1534699f493f22f254dca16b1056fe17d8f
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  7bf7b59a-33a0-4292-8461-57f570bcecac
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\datareporting\glean\pending_pings\7bf7b59a-33a0-4292-8461-57f570bcecac
                                                                  • Size 883B
                                                                  • SHA256 a9324f75b192649da0d9c027c45585e31d7313e1f64643992c5af4cff30295da
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  b18764b1-913b-407f-a9b3-400d58d8eeee
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\datareporting\glean\pending_pings\b18764b1-913b-407f-a9b3-400d58d8eeee
                                                                  • Size 886B
                                                                  • SHA256 96712ed5e633453beab208e44eee98defcf5e143648fe1040d8492e81f9618c3
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  extension-preferences.json
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\extension-preferences.json
                                                                  • Size 942B
                                                                  • SHA256 4c5205b8a6ededa40bb0a92f8d937b29124e7a0d4d05a58da84e689b48bd4c36
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  extensions.json
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\extensions.json
                                                                  • Size 14KB
                                                                  • SHA256 b148eb2ed6584f2e68c37891337dbddf90bc5b90ad1239084a035de2d547af1b
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  gmpopenh264.dll
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                                                                  • Size 1.1MB
                                                                  • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  gmpopenh264.info
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                                                                  • Size 116B
                                                                  • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  LICENSE
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE
                                                                  • Size 473B
                                                                  • SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  manifest.json
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
                                                                  • Size 1002B
                                                                  • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  widevinecdm.dll
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
                                                                  • Size 21.6MB
                                                                  • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  widevinecdm.dll.sig
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll.sig
                                                                  • Size 1KB
                                                                  • SHA256 c5f50bed6afd38490baca2ce8e8fdd1a39849c9f0dc06478a8a2e9226526607b
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  prefs-1.js
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\prefs-1.js
                                                                  • Size 6KB
                                                                  • SHA256 db50a66295ae38196a4b38992752fee60ea4548b791312ea8c904e0cdffa1cc8
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  prefs-1.js
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\prefs-1.js
                                                                  • Size 7KB
                                                                  • SHA256 6703eaa4c12742598f078414caf1845c6fe071a3b01607dc26a7d8dbb0b8ce72
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  prefs.js
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\prefs.js
                                                                  • Size 6KB
                                                                  • SHA256 507063ebac81192d44fc6f3579a45155198ac735980789ec538d1069db15b663
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  prefs.js
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\prefs.js
                                                                  • Size 6KB
                                                                  • SHA256 8ce22089b6f288a94d9006f7e3bb708ada4ba4608cd7de469911896c842e5a9e
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  sessionCheckpoints.json
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\sessionCheckpoints.json
                                                                  • Size 53B
                                                                  • SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  sessionCheckpoints.json
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\sessionCheckpoints.json
                                                                  • Size 90B
                                                                  • SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  recovery.jsonlz4
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\sessionstore-backups\recovery.jsonlz4
                                                                  • Size 4KB
                                                                  • SHA256 17738adb1a12f31775b1a0c1d45cd46c5966811ae4e0759f2f944b9b2b2f3a28
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  recovery.jsonlz4
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\sessionstore-backups\recovery.jsonlz4
                                                                  • Size 4KB
                                                                  • SHA256 cb27094ece4a4a872c78883659edf4012ed3ec4e676fb1e02e117872ca7f7d1e
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  3870112724rsegmnoittet-es.sqlite
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                  • Size 5.6MB
                                                                  • SHA256 ab03862180110768132ffa8572582d83ba0c218a7a8a562b8d27312ddec5e8ff
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  3870112724rsegmnoittet-es.sqlite
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                  • Size 5.6MB
                                                                  • SHA256 2642304f7422d2c30fcbdbe767dea3a947e44445d0e979eb94657479cafe01bd
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  3870112724rsegmnoittet-es.sqlite
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                  • Size 5.8MB
                                                                  • SHA256 83f03ae56b61c2cd6dcec958786c1ff2ca70b0d6c3d19cf1ad6c54c01d8bcc77
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  3870112724rsegmnoittet-es.sqlite
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                  • Size 7.6MB
                                                                  • SHA256 24771da616f3c28e840a58925049c0a1e42460eb1db0940409aa40621c77eb66
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  3870112724rsegmnoittet-es.sqlite
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                  • Size 7.7MB
                                                                  • SHA256 e099dbf4602b728124f1c684ae98aef6b9d886dd9e9e021dec44a57741378e0c
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  3870112724rsegmnoittet-es.sqlite
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                  • Size 7.7MB
                                                                  • SHA256 3e763cb332e33c604ee91c593a857951da42bccf0dbe801d06f7108ee3952f46
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  3870112724rsegmnoittet-es.sqlite
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                  • Size 7.7MB
                                                                  • SHA256 7f283e194516f47a5743b5568d9ff17d5afafa82f3d74c8f4791d944df95de5b
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  3870112724rsegmnoittet-es.sqlite
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                  • Size 7.7MB
                                                                  • SHA256 7839a3a09ccf7dc2b56b84d54f8421c2bb1c29784adaf947ee467e66ce80c79c
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  3870112724rsegmnoittet-es.sqlite
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                  • Size 7.7MB
                                                                  • SHA256 8a03c0390b6c394bc8b3866e3b29afac130b31042f752d061ffafa6a241c454e
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  3870112724rsegmnoittet-es.sqlite
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                  • Size 7.7MB
                                                                  • SHA256 eab118f996ffa6617f5a02af81cc34342ea897e0893a4a0eb84e60c269ec4b3c
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  3870112724rsegmnoittet-es.sqlite
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                  • Size 7.7MB
                                                                  • SHA256 b06f534e9dca377a8e8acb6e48e83612d372dc3287bd270e769afb528e0fbec1
                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                  Submit Download

                                                                  targeting.snapshot.json
                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ybnhgq9.default-release\targeting.snapshot.json
                                                                  • Size 3KB
                                                                  • SHA256 341620e52bf0c93a7cf1078789c09265601a4ec64eb505d3684e26c1321c6bb9
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  protocols.json
                                                                  • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5816_1191598642\protocols.json
                                                                  • Size 3KB
                                                                  • SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
                                                                  • MD5 SHA1 SHA512 TLSH
                                                                  Submit Download

                                                                  memory/3508-870-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                  Download

                                                                  memory/3508-422-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                  Download

                                                                  memory/3508-449-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                  Download

                                                                  memory/3508-448-0x0000000000C10000-0x000000000124B000-memory.dmp
                                                                  Download

                                                                  memory/3508-25-0x0000000000C10000-0x000000000124B000-memory.dmp
                                                                  Download

                                                                  memory/3508-26-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                  Download

                                                                  memory/3508-457-0x0000000000C10000-0x000000000124B000-memory.dmp
                                                                  Download

                                                                  memory/3508-869-0x0000000000C10000-0x000000000124B000-memory.dmp
                                                                  Download

                                                                  memory/3508-16-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                  Download

                                                                  memory/3508-9-0x0000000000C11000-0x0000000000C12000-memory.dmp
                                                                  Download

                                                                  memory/3508-3-0x0000000010000000-0x0000000010030000-memory.dmp
                                                                  Download