Overview

overview

9

Static

static

3

Wireshark-...64.exe

windows11-21h2-x64

9

$PLUGINSDI...ns.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDI...gs.dll

windows11-21h2-x64

3

Qt6Core.dll

windows11-21h2-x64

1

Qt6Core5Compat.dll

windows11-21h2-x64

1

Qt6Gui.dll

windows11-21h2-x64

1

Qt6Multimedia.dll

windows11-21h2-x64

1

Qt6Network.dll

windows11-21h2-x64

1

Qt6PrintSupport.dll

windows11-21h2-x64

1

Qt6Svg.dll

windows11-21h2-x64

1

Qt6Widgets.dll

windows11-21h2-x64

1

USBPcapSet....0.exe

windows11-21h2-x64

8

WinSparkle.dll

windows11-21h2-x64

1

Wireshark ...s.html

windows11-21h2-x64

7

Wireshark.exe

windows11-21h2-x64

1

avcodec-61.dll

windows11-21h2-x64

1

avformat-61.dll

windows11-21h2-x64

1

avutil-59.dll

windows11-21h2-x64

1

brotlicommon.dll

windows11-21h2-x64

1

brotlidec.dll

windows11-21h2-x64

1

bz2.dll

windows11-21h2-x64

1

cares.dll

windows11-21h2-x64

1

charset-1.dll

windows11-21h2-x64

1

comerr64.dll

windows11-21h2-x64

1

dumpcap.exe

windows11-21h2-x64

1

dumpcap.html

windows11-21h2-x64

7

dxcompiler.dll

windows11-21h2-x64

1

dxil.dll

windows11-21h2-x64

1

extcap.html

windows11-21h2-x64

7

generic/qt...in.dll

windows11-21h2-x64

1

glib-2.0-0.dll

windows11-21h2-x64

1

Analysis

  • user interaction
    yes
  • max time kernel
    434s
  • max time network
    433s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    05/05/2026, 03:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Wireshark-4.6.5-x64.exe
  • Size 100.1MB
  • Sample260505-dmaclabw8j
  • SHA256 3c3a2f020d5e053514eefa30dde49e596b857edef6971b655bdfd09af504b0f6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecutionpersistenceransomware

Malware Config

Signatures

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

    defense_evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell and hide display window.

    execution
  • Drops file in Drivers directory 3 IoCs
  • Manipulates Digital Signatures 1 TTPs 5 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 30 IoCs
  • Executes dropped EXE 24 IoCs
  • Loads dropped DLL 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 47 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 64 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 59 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Wireshark-4.6.5-x64.exe
    "C:\Users\Admin\AppData\Local\Temp\Wireshark-4.6.5-x64.exe"
    1⤵
    • Drops file in Program Files directory
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1016
    • C:\Program Files\Wireshark\vc_redist.x64.exe
      "C:\Program Files\Wireshark\vc_redist.x64.exe" /install /quiet /norestart
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4404
      • C:\Windows\Temp\{D526453C-6DB1-4128-BC0B-C3E571372103}\.cr\vc_redist.x64.exe
        "C:\Windows\Temp\{D526453C-6DB1-4128-BC0B-C3E571372103}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Program Files\Wireshark\vc_redist.x64.exe" -burn.filehandle.attached=568 -burn.filehandle.self=728 /install /quiet /norestart
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3124
        • C:\Windows\Temp\{F003D072-5E13-4F24-A9F6-A2760187CEA5}\.be\VC_redist.x64.exe
          "C:\Windows\Temp\{F003D072-5E13-4F24-A9F6-A2760187CEA5}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{9EC3194C-44B5-409B-B8F8-079D09AAB19E} {26DA20B8-7E88-4CE3-8B0D-CA26CA1BAC9B} 3124
          4⤵
          • Adds Run key to start application
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:836
          • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
            "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=916 -burn.embedded BurnPipe.{DBD35468-7F0B-4EC3-B130-AEBBACB32795} {9251E147-4CF9-4F2B-9B5F-CAB4649856CB} 836
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4180
            • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
              "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=544 -burn.filehandle.self=560 -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=916 -burn.embedded BurnPipe.{DBD35468-7F0B-4EC3-B130-AEBBACB32795} {9251E147-4CF9-4F2B-9B5F-CAB4649856CB} 836
              6⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3940
              • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{1C6978B9-0A6A-4924-8296-BD9DD6A76381} {67EACB1E-6375-4422-ADF5-7C4C860F5285} 3940
                7⤵
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                PID:1044
    • C:\Program Files\Wireshark\npcap-1.87.exe
      "C:\Program Files\Wireshark\npcap-1.87.exe" /winpcap_mode=no /loopback_support=no
      2⤵
      • Drops file in System32 directory
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2380
      • C:\Users\Admin\AppData\Local\Temp\nsfB0FF.tmp\NPFInstall.exe
        "C:\Users\Admin\AppData\Local\Temp\nsfB0FF.tmp\NPFInstall.exe" -n -check_dll
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:3164
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "Get-ChildItem Cert:\LocalMachine\Root | Where-Object {$_.Thumbprint -eq 'DDFB16CD4931C973A2037D3FC83A4D7D775D05E4'} | Sort-Object -Descending -Property FriendlyName | Select-Object -Skip 1 | Remove-Item"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3468
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "If (Get-ChildItem Cert:\LocalMachine\Root\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4){certutil.exe -verifystore 'Root' 'DDFB16CD4931C973A2037D3FC83A4D7D775D05E4';If($LASTEXITCODE -ne 0){Remove-Item Cert:\LocalMachine\Root\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4}}"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:5000
      • C:\Windows\SysWOW64\certutil.exe
        certutil.exe -verifystore "Root" "DDFB16CD4931C973A2037D3FC83A4D7D775D05E4"
        3⤵
        • Manipulates Digital Signatures
        • System Location Discovery: System Language Discovery
        PID:1116
      • C:\Windows\SysWOW64\certutil.exe
        certutil.exe -addstore -f "Root" "C:\Users\Admin\AppData\Local\Temp\nsfB0FF.tmp\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4.sst"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2864
      • C:\Windows\SysWOW64\certutil.exe
        certutil.exe -addstore -f "TrustedPublisher" "C:\Users\Admin\AppData\Local\Temp\nsfB0FF.tmp\signing.p7b"
        3⤵
        • Manipulates Digital Signatures
        • System Location Discovery: System Language Discovery
        PID:2912
      • C:\Windows\SysWOW64\certutil.exe
        certutil.exe -addstore -f "AddressBook" "C:\Users\Admin\AppData\Local\Temp\nsfB0FF.tmp\digi-ts-2023.p7b"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4824
      • C:\Program Files\Npcap\NPFInstall.exe
        "C:\Program Files\Npcap\NPFInstall.exe" -n -c
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2784
        • C:\Windows\SYSTEM32\pnputil.exe
          pnputil.exe -e
          4⤵
            PID:2012
        • C:\Program Files\Npcap\NPFInstall.exe
          "C:\Program Files\Npcap\NPFInstall.exe" -n -iw
          3⤵
          • Executes dropped EXE
          PID:424
        • C:\Program Files\Npcap\NPFInstall.exe
          "C:\Program Files\Npcap\NPFInstall.exe" -n -i
          3⤵
          • Drops file in Drivers directory
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          PID:1836
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "Microsoft.PowerShell.Management\Start-Service -Name npcap -PassThru | Microsoft.PowerShell.Management\Stop-Service -PassThru | Microsoft.PowerShell.Management\Start-Service"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:1120
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -WindowStyle Hidden -NonInteractive -Command "ScheduledTasks\Register-ScheduledTask -Force -TaskName 'npcapwatchdog' -Description 'Ensure Npcap service is configured to start at boot' -Action (ScheduledTasks\New-ScheduledTaskAction -Execute 'C:\Program Files\Npcap\CheckStatus.bat') -Principal (ScheduledTasks\New-ScheduledTaskPrincipal -UserId 'SYSTEM' -LogonType ServiceAccount) -Trigger (ScheduledTasks\New-ScheduledTaskTrigger -AtStartup) -Settings (ScheduledTasks\New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Compatibility Win8)"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:4700
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:1472
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      1⤵
        PID:440
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Badlisted process makes network request
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1188
      • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
        "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /burn.runonce
        1⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3796
        • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
          "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260505041539.log" /install
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5032
          • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
            "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.filehandle.attached=548 -burn.filehandle.self=564 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260505041539.log" /install
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2868
            • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
              "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{AA845A57-C524-4807-90E1-199D84B859DF} {1DAF494E-8907-472B-A97F-8230D41284BD} 2868
              4⤵
              • Adds Run key to start application
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:1660
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
        1⤵
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Suspicious use of WriteProcessMemory
        PID:1044
        • C:\Windows\system32\DrvInst.exe
          DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{9082b761-3c9e-494a-a229-103e54bdbe52}\NPCAP.inf" "9" "405306be3" "0000000000000150" "WinSta0\Default" "0000000000000160" "208" "C:\Program Files\Npcap"
          2⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Modifies data under HKEY_USERS
          PID:4780
      • C:\Program Files\Wireshark\Wireshark.exe
        "C:\Program Files\Wireshark\Wireshark.exe"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks processor information in registry
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of WriteProcessMemory
        PID:3084
        • C:\Program Files\Wireshark\extcap\etwdump.exe
          "C:\Program Files\Wireshark\extcap\etwdump.exe" --extcap-interfaces --extcap-version=4.6
          2⤵
          • Executes dropped EXE
          PID:1120
        • C:\Program Files\Wireshark\extcap\etwdump.exe
          "C:\Program Files\Wireshark\extcap\etwdump.exe" --extcap-config --extcap-interface etwdump
          2⤵
          • Executes dropped EXE
          PID:5176
        • C:\Program Files\Wireshark\dumpcap.exe
          "C:\Program Files\Wireshark\dumpcap.exe" --log-level MESSAGE --application-flavor wireshark -S -D -L --signal-pipe 3084.dummy -Z 1696
          2⤵
          • Executes dropped EXE
          • Checks processor information in registry
          PID:5336
        • C:\Program Files\Wireshark\extcap\etwdump.exe
          "C:\Program Files\Wireshark\extcap\etwdump.exe" --extcap-dlts --extcap-interface etwdump
          2⤵
          • Executes dropped EXE
          PID:5388
        • C:\Program Files\Wireshark\dumpcap.exe
          "C:\Program Files\Wireshark\dumpcap.exe" --log-level MESSAGE --application-flavor wireshark -S --signal-pipe 3084.dummy -Z 3852
          2⤵
          • Executes dropped EXE
          • Checks processor information in registry
          PID:5512
        • C:\Program Files\Wireshark\dumpcap.exe
          "C:\Program Files\Wireshark\dumpcap.exe" --log-level MESSAGE --application-flavor wireshark -F pcapng -i \Device\NPF_Loopback --ifdescr "Adapter for loopback traffic capture" --signal-pipe 3084 -Z 3852
          2⤵
          • Executes dropped EXE
          • Checks processor information in registry
          PID:5588
        • C:\Program Files\Wireshark\dumpcap.exe
          "C:\Program Files\Wireshark\dumpcap.exe" --log-level MESSAGE --application-flavor wireshark -S --signal-pipe 3084.dummy -Z 4032
          2⤵
          • Executes dropped EXE
          • Checks processor information in registry
          PID:5708
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://wiresharkfoundation.org/donate/
          2⤵
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Enumerates system info in registry
          • Modifies registry class
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:5916
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2dc,0x2e0,0x2e4,0x2d8,0x300,0x7fff3af9c188,0x7fff3af9c194,0x7fff3af9c1a0
            3⤵
              PID:5944
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,15337774706955469464,17681817219608695025,524288 --field-trial-handle=2188,i,12418953529610962111,4437060573971094839,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:11
              3⤵
              • System Time Discovery
              PID:2072
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,12148677092349776563,17405029370638108097,262144 --field-trial-handle=2188,i,12418953529610962111,4437060573971094839,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:2
              3⤵
                PID:3636
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2576,i,16167763142129139842,35461695673288221,524288 --field-trial-handle=2188,i,12418953529610962111,4437060573971094839,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:13
                3⤵
                  PID:3988
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,14684146107380185354,7292697232181156661,2097152 --field-trial-handle=2188,i,12418953529610962111,4437060573971094839,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
                  3⤵
                    PID:3792
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,16971670206649578091,16230294965942293339,2097152 --field-trial-handle=2188,i,12418953529610962111,4437060573971094839,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
                    3⤵
                      PID:3200
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4156,i,16005254511848321745,15924819685582209141,2097152 --field-trial-handle=2188,i,12418953529610962111,4437060573971094839,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:1
                      3⤵
                        PID:6276
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4168,i,14702648396527584991,3067813780152790222,2097152 --field-trial-handle=2188,i,12418953529610962111,4437060573971094839,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:9
                        3⤵
                          PID:6284
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4252,i,8749466757723903175,12402472989545629338,2097152 --field-trial-handle=2188,i,12418953529610962111,4437060573971094839,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:1
                          3⤵
                            PID:6292
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4404,i,6371752802256121807,3436935501360032171,2097152 --field-trial-handle=2188,i,12418953529610962111,4437060573971094839,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:9
                            3⤵
                              PID:6308
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3696,i,4899198909437748150,7662092369185262430,524288 --field-trial-handle=2188,i,12418953529610962111,4437060573971094839,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
                              3⤵
                                PID:6696
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4140,i,16512398404111411862,2264454169409801965,2097152 --field-trial-handle=2188,i,12418953529610962111,4437060573971094839,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:1
                                3⤵
                                  PID:6820
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,5395659476694171249,12689775441655441202,524288 --field-trial-handle=2188,i,12418953529610962111,4437060573971094839,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
                                  3⤵
                                    PID:6852
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3568,i,4294900757322114990,7303955665497614934,2097152 --field-trial-handle=2188,i,12418953529610962111,4437060573971094839,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:1
                                    3⤵
                                      PID:7080
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4448,i,7317154983108725320,16862336142311498009,2097152 --field-trial-handle=2188,i,12418953529610962111,4437060573971094839,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
                                      3⤵
                                        PID:4372
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,2875420935159693623,3488848887681830753,524288 --field-trial-handle=2188,i,12418953529610962111,4437060573971094839,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:14
                                        3⤵
                                          PID:2012
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,7878177937193910444,4666008750203115832,524288 --field-trial-handle=2188,i,12418953529610962111,4437060573971094839,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:14
                                          3⤵
                                            PID:4084
                                        • C:\Program Files\Wireshark\extcap\etwdump.exe
                                          "C:\Program Files\Wireshark\extcap\etwdump.exe" --extcap-config --extcap-interface etwdump
                                          2⤵
                                          • Executes dropped EXE
                                          PID:7980
                                        • C:\Program Files\Wireshark\extcap\etwdump.exe
                                          "C:\Program Files\Wireshark\extcap\etwdump.exe" --extcap-config --extcap-interface etwdump
                                          2⤵
                                          • Executes dropped EXE
                                          PID:8132
                                        • C:\Program Files\Wireshark\extcap\etwdump.exe
                                          "C:\Program Files\Wireshark\extcap\etwdump.exe" --extcap-config --extcap-interface etwdump
                                          2⤵
                                          • Executes dropped EXE
                                          PID:8036
                                        • C:\Program Files\Wireshark\extcap\etwdump.exe
                                          "C:\Program Files\Wireshark\extcap\etwdump.exe" --extcap-config --extcap-interface etwdump
                                          2⤵
                                          • Executes dropped EXE
                                          PID:3684
                                      • C:\Windows\system32\AUDIODG.EXE
                                        C:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004CC
                                        1⤵
                                          PID:5652
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                          1⤵
                                            PID:6248

                                          Network

                                                MITRE ATT&CK Enterprise v16

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                e5b9c51.rbs
                                                • Path C:\Config.Msi\e5b9c51.rbs
                                                • Size 19KB
                                                • SHA256 df315cc9b35e207ecefb80395966298eb1acae474c3341deec35c7df4257f89d
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                e5b9c5d.rbs
                                                • Path C:\Config.Msi\e5b9c5d.rbs
                                                • Size 19KB
                                                • SHA256 27b54488f054870127ae7ead9414466df9699eb2cb3dfa9163e1e5dc75196d38
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                e5b9c64.rbs
                                                • Path C:\Config.Msi\e5b9c64.rbs
                                                • Size 21KB
                                                • SHA256 b5125940e29a854a203b29c7ab26828a9cfca065bc775c8ed8ed3fb35b0ca740
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                e5b9c73.rbs
                                                • Path C:\Config.Msi\e5b9c73.rbs
                                                • Size 21KB
                                                • SHA256 36665231cd3c2e8fa9db2b48f6b54200b33fa313eb4ece64fa5bc9f7109fe9a4
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                npcap.cat
                                                • Path C:\PROGRA~1\Npcap\npcap.cat
                                                • Size 12KB
                                                • SHA256 e6f8677b774950d703132105a9469352df66e0cc84a2001b657f67f1a9b1a584
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                npcap.sys
                                                • Path C:\PROGRA~1\Npcap\npcap.sys
                                                • Size 80KB
                                                • SHA256 f7fea1f98e297916ab8cfd01801c226e1841f6acaf3035341020cf4de23a9f8f
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                NPCAP.inf
                                                • Path C:\Program Files\Npcap\NPCAP.inf
                                                • Size 8KB
                                                • SHA256 a2fb7b495a758d75eea505291b676c8e2ad41e33526a6ac76605a22b0b47b946
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                NPCAP_wfp.inf
                                                • Path C:\Program Files\Npcap\NPCAP_wfp.inf
                                                • Size 2KB
                                                • SHA256 a7349b34dfbef2362b46584ae631de8992803f9f466b6fe2eeb739fc7a4a5267
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                NPFInstall.log
                                                • Path C:\Program Files\Npcap\NPFInstall.log
                                                • Size 791B
                                                • SHA256 a107ac20b4cd55c9dea02a1d9cf1745341d68e9d6d4fbb48903e4f710522248a
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                NPFInstall.log
                                                • Path C:\Program Files\Npcap\NPFInstall.log
                                                • Size 1KB
                                                • SHA256 3c93d673ee051a5919fbb568a07169e1e96f71b5713b87ba7c1a87a323556c7d
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                NPFInstall.log
                                                • Path C:\Program Files\Npcap\NPFInstall.log
                                                • Size 2KB
                                                • SHA256 8ec97cc95bad83405711a7db0dd7150302c251825a0b35771622f6645c55c6e7
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                NPFInstall.log
                                                • Path C:\Program Files\Npcap\NPFInstall.log
                                                • Size 3KB
                                                • SHA256 5ec17dcdadf2b85227e19e6cb0bd1c1c96a09a70e2918957e1c50ce53069ca56
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                NPFInstall.log
                                                • Path C:\Program Files\Npcap\NPFInstall.log
                                                • Size 3KB
                                                • SHA256 3f422b0a4a07603ad50523165d9b655d37873aee63ea7710d7818aeaac548ce9
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                NPFInstall.log
                                                • Path C:\Program Files\Npcap\NPFInstall.log
                                                • Size 4KB
                                                • SHA256 f7bd6a1f44250b9326e4afce1e601b0ae4776bc9446bc3ee8428df925a795535
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                dumpcap.exe
                                                • Path C:\Program Files\Wireshark\dumpcap.exe
                                                • Size 549KB
                                                • SHA256 daaaa71f6d72f5b8ee7801df3d5db6d10e1260a9042cf0454c21afc5e1754e8b
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                etwdump.exe
                                                • Path C:\Program Files\Wireshark\extcap\etwdump.exe
                                                • Size 350KB
                                                • SHA256 9365656607382f70040fd92373373850e52f7ae71de71653c4b8e41cffe85687
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                npcap-1.87.exe
                                                • Path C:\Program Files\Wireshark\npcap-1.87.exe
                                                • Size 1.3MB
                                                • SHA256 142c234f09a9618d7cdc2c37f607d6fc06615fad5581f728b60d4ad659f906bd
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                vc_redist.x64.exe
                                                • Path C:\Program Files\Wireshark\vc_redist.x64.exe
                                                • Size 24.4MB
                                                • SHA256 cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                state.rsm
                                                • Path C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\state.rsm
                                                • Size 900B
                                                • SHA256 67d4e16380c480041e8d7c31faa72e6fe7352f0d235428ae73981459aea7fc3a
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                powershell.exe.log
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                • Size 2KB
                                                • SHA256 8f2c523d6b851d6a91ebad962f18f005e8ab564efc5a2c3325a2d7ddd469f0a0
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                settings.dat
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                • Size 280B
                                                • SHA256 7173f2853e3b591f142ed047bb6a2ea62d5d817f9016fdd31efbebd88f820e91
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                settings.dat
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                • Size 280B
                                                • SHA256 eacd218daf22fcefbc23ae70ce919d8ac95b89c3f7d038f647296c47a218fc46
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                settings.dat
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                • Size 280B
                                                • SHA256 4f75650872d26a46dd5be1c73298a9c211c43393a9c0b309aeceec6e217486de
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                BookmarkMergedSurfaceOrdering
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                • Size 6B
                                                • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                the-real-index
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                • Size 3KB
                                                • SHA256 5580f8efc6afbabc776be6ab0fc79a723d71c590fe30b11d0787c28493911a5f
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                the-real-index~RFe5e2be0.TMP
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5e2be0.TMP
                                                • Size 3KB
                                                • SHA256 e65602db32639f7426728227d126a132547cd941c82e892a85990e515e575559
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                SiteList-Enterprise.json
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                • Size 2B
                                                • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                Edge Profile.ico
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                • Size 70KB
                                                • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                Network Persistent State
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                • Size 2KB
                                                • SHA256 5dc26578238d75b6da9437782af6303aa5fb23fbb48d8a62c1971e92c739fe03
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                SCT Auditing Pending Reports
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                • Size 2B
                                                • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                Preferences
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                • Size 13KB
                                                • SHA256 455a1fca9199d6f57904e7089508356ca783295fc75c67b663a06a769d5ca8da
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                Secure Preferences
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                • Size 32KB
                                                • SHA256 cb38bf0fe167a3a818ad8668ef8f809ee76791c2cad78076e7a323c221ed620f
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                sync_diagnostic.log
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                • Size 6KB
                                                • SHA256 99ebe3cee0cb358d47a0f0afbabacbe778653eaa9a0743aecb7e59abd0858ff1
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                Local State
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                • Size 18KB
                                                • SHA256 ccf5687c8c96327b3300564b66c33d4b952d3567bf4604daa633abc5215cc20a
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                Local State
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                • Size 8KB
                                                • SHA256 913f60fcee9e5cfeb306980d28500749234280077656b21f1f9fcaeccf193d4f
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                Local State
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                • Size 8KB
                                                • SHA256 5d323f23cf1080c08df677f0783a52db3bf7ba25c0386d21cf02584f41e3d270
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                data_1
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
                                                • Size 264KB
                                                • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                4c16f2be-2670-403e-9e9e-b92c198d3c11.tmp
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4c16f2be-2670-403e-9e9e-b92c198d3c11.tmp
                                                • Size 13B
                                                • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                StartupProfileData-NonInteractive
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                • Size 17KB
                                                • SHA256 e123802a304b3d35175e6f35f4804eebae37b86706738a65b21fc73ce37bbea0
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                __PSScriptPolicyTest_wz4faw4t.swa.ps1
                                                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wz4faw4t.swa.ps1
                                                • Size 60B
                                                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                dd_vcredist_amd64_20260505041539.log
                                                • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260505041539.log
                                                • Size 18KB
                                                • SHA256 eb8667b13769b518571ef03ad844ac6341dc93bc3de03e63c80d5571952513f4
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                dd_vcredist_amd64_20260505041539_000_vcRuntimeMinimum_x64.log
                                                • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260505041539_000_vcRuntimeMinimum_x64.log
                                                • Size 4KB
                                                • SHA256 6031b0c3ee68aacabebb907bfc0d4636d032c389038a150b74fec4d869ba9e3d
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                dd_vcredist_amd64_20260505041539_001_vcRuntimeAdditional_x64.log
                                                • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260505041539_001_vcRuntimeAdditional_x64.log
                                                • Size 2KB
                                                • SHA256 5c8a0ee082dbbda385b5557ed4cdaaf89ee45aeeeccd71a9f45de0fd78432208
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                CertificationPage.ini
                                                • Path C:\Users\Admin\AppData\Local\Temp\nsf5205.tmp\CertificationPage.ini
                                                • Size 968B
                                                • SHA256 6b5942d3f027696de961406ecb24e2a99a7eef2595460fd794c4c5768d978e32
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                InstallOptions.dll
                                                • Path C:\Users\Admin\AppData\Local\Temp\nsf5205.tmp\InstallOptions.dll
                                                • Size 15KB
                                                • SHA256 44b1d70219f88564d94da9fc8a7ca4d25d103575519c84a44df3057b8af98f71
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                NpcapPage.ini
                                                • Path C:\Users\Admin\AppData\Local\Temp\nsf5205.tmp\NpcapPage.ini
                                                • Size 2KB
                                                • SHA256 6c4ecacec96842aef1829e4655446749f77706c9b961f1de3af6472bb19ac285
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                System.dll
                                                • Path C:\Users\Admin\AppData\Local\Temp\nsf5205.tmp\System.dll
                                                • Size 12KB
                                                • SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                USBPcapPage.ini
                                                • Path C:\Users\Admin\AppData\Local\Temp\nsf5205.tmp\USBPcapPage.ini
                                                • Size 2KB
                                                • SHA256 acc3e73e3c8f20bffb3af259a0d7a1a15ca324f9be4b1f507904444f6334dd28
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                USBPcapPage.ini
                                                • Path C:\Users\Admin\AppData\Local\Temp\nsf5205.tmp\USBPcapPage.ini
                                                • Size 2KB
                                                • SHA256 6b61c26ae67a95d542cfd354ee57d21e0ffd827702d1daefbb06b39221b7f022
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                modern-wizard.bmp
                                                • Path C:\Users\Admin\AppData\Local\Temp\nsf5205.tmp\modern-wizard.bmp
                                                • Size 25KB
                                                • SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                nsDialogs.dll
                                                • Path C:\Users\Admin\AppData\Local\Temp\nsf5205.tmp\nsDialogs.dll
                                                • Size 9KB
                                                • SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                DDFB16CD4931C973A2037D3FC83A4D7D775D05E4.sst
                                                • Path C:\Users\Admin\AppData\Local\Temp\nsfB0FF.tmp\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4.sst
                                                • Size 1KB
                                                • SHA256 98280770b3d1e577754a07b6d3e5790f988bae9b905c2b30c0e646d0fb619b03
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                NPFInstall.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\nsfB0FF.tmp\NPFInstall.exe
                                                • Size 316KB
                                                • SHA256 02ea5160ebd66ec27508883ba804a3c2c8c4ab3315dbf2669442506742b44762
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                digi-ts-2023.p7b
                                                • Path C:\Users\Admin\AppData\Local\Temp\nsfB0FF.tmp\digi-ts-2023.p7b
                                                • Size 3KB
                                                • SHA256 0594d1899bf9f738ef4c1b9049372ca66059c1343b4d8dd7ecbda465ad04deea
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                final.ini
                                                • Path C:\Users\Admin\AppData\Local\Temp\nsfB0FF.tmp\final.ini
                                                • Size 614B
                                                • SHA256 9795f96826a74b07a35367a9cf948588b1ffc4fc82357c2c2a20bed1732c20bf
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                nsExec.dll
                                                • Path C:\Users\Admin\AppData\Local\Temp\nsfB0FF.tmp\nsExec.dll
                                                • Size 7KB
                                                • SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                options.ini
                                                • Path C:\Users\Admin\AppData\Local\Temp\nsfB0FF.tmp\options.ini
                                                • Size 2KB
                                                • SHA256 e3707c82f4117deedf70550146bbd320e41b3dc8db8041c1a04c777553e8f12f
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                options.ini
                                                • Path C:\Users\Admin\AppData\Local\Temp\nsfB0FF.tmp\options.ini
                                                • Size 2KB
                                                • SHA256 6c4fd23d6f512b3d4f288814f417c5ccb8df2667816571f39e3aa4925eebc066
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                options.ini
                                                • Path C:\Users\Admin\AppData\Local\Temp\nsfB0FF.tmp\options.ini
                                                • Size 2KB
                                                • SHA256 79fa559860ff4bace0417d9206814352f4c821744b527f4425cbb979529afb0d
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                options.ini
                                                • Path C:\Users\Admin\AppData\Local\Temp\nsfB0FF.tmp\options.ini
                                                • Size 2KB
                                                • SHA256 0b428871cbd7ce9c79928fd0aeb83ee64de1a989b3d4b0ff7f2fbb3c84069c0c
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                signing.p7b
                                                • Path C:\Users\Admin\AppData\Local\Temp\nsfB0FF.tmp\signing.p7b
                                                • Size 3KB
                                                • SHA256 dfa30b3667f5d98f267c52078846db6649532a8f877cec6d3e4f8b83a7f1f80a
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                license.rtf
                                                • Path C:\Windows\Temp\{29E61442-EBAA-485A-9929-43DA3EBE4649}\.ba\license.rtf
                                                • Size 9KB
                                                • SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                thm.wxl
                                                • Path C:\Windows\Temp\{29E61442-EBAA-485A-9929-43DA3EBE4649}\.ba\thm.wxl
                                                • Size 2KB
                                                • SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                thm.xml
                                                • Path C:\Windows\Temp\{29E61442-EBAA-485A-9929-43DA3EBE4649}\.ba\thm.xml
                                                • Size 8KB
                                                • SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                wixstdba.dll
                                                • Path C:\Windows\Temp\{29E61442-EBAA-485A-9929-43DA3EBE4649}\.ba\wixstdba.dll
                                                • Size 191KB
                                                • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                vc_redist.x64.exe
                                                • Path C:\Windows\Temp\{D526453C-6DB1-4128-BC0B-C3E571372103}\.cr\vc_redist.x64.exe
                                                • Size 670KB
                                                • SHA256 568c9ba533624084ea18f7a562b4aa2249ed4e41281524a061a0d0b1008cf6bd
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                logo.png
                                                • Path C:\Windows\Temp\{F003D072-5E13-4F24-A9F6-A2760187CEA5}\.ba\logo.png
                                                • Size 1KB
                                                • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
                                                • MD5 SHA1 SHA512 TLSH
                                                Submit Download

                                                wixstdba.dll
                                                • Path C:\Windows\Temp\{F003D072-5E13-4F24-A9F6-A2760187CEA5}\.ba\wixstdba.dll
                                                • Size 215KB
                                                • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                cab2C04DDC374BD96EB5C8EB8208F2C7C92
                                                • Path C:\Windows\Temp\{F003D072-5E13-4F24-A9F6-A2760187CEA5}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
                                                • Size 5.4MB
                                                • SHA256 7dee5b77719fb6a6627145357c5a93bf8af2a9de54d34c79ffc1ae71d52c79f5
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                cab5046A8AB272BF37297BB7928664C9503
                                                • Path C:\Windows\Temp\{F003D072-5E13-4F24-A9F6-A2760187CEA5}\cab5046A8AB272BF37297BB7928664C9503
                                                • Size 964KB
                                                • SHA256 640aa6c516c72444523b8fbe034db46ff4e118ed02705340e3ccb62d426ff040
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                vcRuntimeAdditional_x64
                                                • Path C:\Windows\Temp\{F003D072-5E13-4F24-A9F6-A2760187CEA5}\vcRuntimeAdditional_x64
                                                • Size 208KB
                                                • SHA256 7df26ee2169ef6c61c17675e1a2edbaf01bca2ed1a0bdc0f8396d029a336c1f7
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                vcRuntimeMinimum_x64
                                                • Path C:\Windows\Temp\{F003D072-5E13-4F24-A9F6-A2760187CEA5}\vcRuntimeMinimum_x64
                                                • Size 208KB
                                                • SHA256 fe5af8f2efc9bbdd2c23f22f2d3daf480a4047acf3b1edc6ecda81147c1ec14f
                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                Submit Download

                                                memory/836-735-0x0000000000870000-0x000000000090C000-memory.dmp
                                                Download

                                                memory/836-649-0x0000000000870000-0x000000000090C000-memory.dmp
                                                Download

                                                memory/1016-4012-0x0000000000AB0000-0x0000000000B4C000-memory.dmp
                                                Download

                                                memory/1016-39-0x0000000000AB0000-0x0000000000B4C000-memory.dmp
                                                Download

                                                memory/1044-727-0x00000000007E0000-0x0000000000857000-memory.dmp
                                                Download

                                                memory/1044-728-0x00000000012D0000-0x000000000136C000-memory.dmp
                                                Download

                                                memory/1116-1377-0x0000000003280000-0x0000000003287000-memory.dmp
                                                Download

                                                memory/1116-1376-0x00000000015C0000-0x000000000165C000-memory.dmp
                                                Download

                                                memory/1188-1251-0x0000013602570000-0x000001360257C000-memory.dmp
                                                Download

                                                memory/1660-1087-0x0000000000DD0000-0x0000000000E6C000-memory.dmp
                                                Download

                                                memory/2380-1677-0x0000000002510000-0x00000000025AC000-memory.dmp
                                                Download

                                                memory/2380-1369-0x0000000002510000-0x00000000025AC000-memory.dmp
                                                Download

                                                memory/2864-1382-0x0000000000840000-0x00000000008DC000-memory.dmp
                                                Download

                                                memory/2868-1088-0x00000000017A0000-0x000000000183C000-memory.dmp
                                                Download

                                                memory/2912-1388-0x0000000000CB0000-0x0000000000D4C000-memory.dmp
                                                Download

                                                memory/3084-4018-0x00007FFF3E5E0000-0x00007FFF3EC27000-memory.dmp
                                                Download

                                                memory/3084-4019-0x00007FF7E84D0000-0x00007FF7E9912000-memory.dmp
                                                Download

                                                memory/3124-647-0x0000000001360000-0x00000000013FC000-memory.dmp
                                                Download

                                                memory/3124-737-0x0000000001360000-0x00000000013FC000-memory.dmp
                                                Download

                                                memory/3468-1345-0x0000000006BE0000-0x0000000006C2C000-memory.dmp
                                                Download

                                                memory/3468-1333-0x0000000005AD0000-0x00000000060FA000-memory.dmp
                                                Download

                                                memory/3468-1332-0x0000000003340000-0x0000000003376000-memory.dmp
                                                Download

                                                memory/3468-1334-0x0000000005930000-0x0000000005952000-memory.dmp
                                                Download

                                                memory/3468-1335-0x00000000059D0000-0x0000000005A36000-memory.dmp
                                                Download

                                                memory/3468-1336-0x00000000062B0000-0x0000000006316000-memory.dmp
                                                Download

                                                memory/3468-1343-0x0000000006680000-0x00000000069D7000-memory.dmp
                                                Download

                                                memory/3468-1344-0x0000000006B30000-0x0000000006B4E000-memory.dmp
                                                Download

                                                memory/3468-1347-0x0000000007B80000-0x0000000007C16000-memory.dmp
                                                Download

                                                memory/3468-1348-0x0000000007050000-0x000000000706A000-memory.dmp
                                                Download

                                                memory/3468-1349-0x00000000070D0000-0x00000000070F2000-memory.dmp
                                                Download

                                                memory/3468-1350-0x00000000081D0000-0x0000000008776000-memory.dmp
                                                Download

                                                memory/3468-1351-0x0000000008E00000-0x000000000947A000-memory.dmp
                                                Download

                                                memory/3468-1355-0x0000000005920000-0x000000000592A000-memory.dmp
                                                Download

                                                memory/3468-1352-0x0000000007FB0000-0x0000000007FED000-memory.dmp
                                                Download

                                                memory/3796-580-0x0000000001380000-0x000000000141C000-memory.dmp
                                                Download

                                                memory/3940-730-0x00000000007E0000-0x0000000000857000-memory.dmp
                                                Download

                                                memory/3940-731-0x0000000000AA0000-0x0000000000B3C000-memory.dmp
                                                Download

                                                memory/4180-733-0x00000000015F0000-0x000000000168C000-memory.dmp
                                                Download

                                                memory/4180-732-0x00000000007E0000-0x0000000000857000-memory.dmp
                                                Download

                                                memory/4404-558-0x0000000000E10000-0x0000000000EAC000-memory.dmp
                                                Download

                                                memory/4404-738-0x0000000000E10000-0x0000000000EAC000-memory.dmp
                                                Download

                                                memory/4700-1616-0x0000000005290000-0x000000000529A000-memory.dmp
                                                Download

                                                memory/4700-1614-0x00000000070D0000-0x0000000007104000-memory.dmp
                                                Download

                                                memory/4780-1570-0x0000026793580000-0x000002679358C000-memory.dmp
                                                Download

                                                memory/4824-1394-0x00000000014C0000-0x000000000155C000-memory.dmp
                                                Download

                                                memory/4824-1397-0x0000000001380000-0x0000000001399000-memory.dmp
                                                Download

                                                memory/4824-1395-0x0000000001350000-0x000000000136C000-memory.dmp
                                                Download

                                                memory/4824-1396-0x0000000001370000-0x000000000137A000-memory.dmp
                                                Download

                                                memory/4824-1398-0x00000000013A0000-0x00000000013AB000-memory.dmp
                                                Download

                                                memory/5000-1366-0x00000000057D0000-0x0000000005B27000-memory.dmp
                                                Download

                                                memory/5000-1372-0x0000000006FF0000-0x0000000007012000-memory.dmp
                                                Download

                                                memory/5000-1370-0x0000000006E20000-0x0000000006E5D000-memory.dmp
                                                Download

                                                memory/5000-1368-0x0000000006120000-0x000000000616C000-memory.dmp
                                                Download

                                                memory/5032-1089-0x00000000016E0000-0x000000000177C000-memory.dmp
                                                Download