Overview

overview

10

Static

static

10

2026-05-23...op.exe

windows10-2004-x64

9

2026-05-23...op.exe

windows11-21h2-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    23/05/2026, 16:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-23_b9b8c896d4d84babc03ba5ef7dc98c1d_darkgate_elex_glassworm_remcos_stop.exe
  • Size 6.3MB
  • Sample260523-tpps3acz2j
  • SHA256 1dd797f2b6e8cf3315840d93c63de811aac02548e4d202a89b2f3f08b1086a08
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwaredefense_evasiondiscoverypersistencephishingransomwarespywarestealertrojan

Malware Config

Signatures

  • Custom signature
    Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 3 IoCs
  • Custom signature
    Detects executables containing SQL queries to confidential data stores. Observed in infostealers 3 IoCs
  • A potential corporate email address has been identified in the URL: [email protected]
    phishing
  • Executes dropped EXE 34 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Drops desktop.ini file(s) 3 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in System32 directory 42 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 7 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 22 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Control Panel 1 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 22 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 18 IoCs
  • Suspicious behavior: EnumeratesProcesses 42 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-23_b9b8c896d4d84babc03ba5ef7dc98c1d_darkgate_elex_glassworm_remcos_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-23_b9b8c896d4d84babc03ba5ef7dc98c1d_darkgate_elex_glassworm_remcos_stop.exe"
    1⤵
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Installs/modifies Browser Helper Object
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2424
    • C:\Windows\system32\regsvr32.exe
      C:\Windows\Sysnative\regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
      2⤵
        PID:5896
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:6008
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
          3⤵
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Drops desktop.ini file(s)
          • Checks processor information in registry
          • Modifies Control Panel
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3276
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2028 -prefsLen 27097 -prefMapHandle 2032 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {76b98ec9-c207-4414-b282-11b10d12b3aa} -parentPid 3276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3276" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
            4⤵
            • Executes dropped EXE
            PID:4564
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2484 -prefsLen 27133 -prefMapHandle 2488 -prefMapSize 270279 -ipcHandle 2496 -initialChannelId {7a18622a-2519-4683-acbc-faa2ed22bddc} -parentPid 3276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3276" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
            4⤵
            • Executes dropped EXE
            PID:4832
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3836 -prefsLen 25164 -prefMapHandle 3840 -prefMapSize 270279 -jsInitHandle 3844 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3796 -initialChannelId {c24e89a5-0c24-488c-a9ca-a3048f14c11f} -parentPid 3276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3276" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:2028
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4028 -prefsLen 27274 -prefMapHandle 4032 -prefMapSize 270279 -ipcHandle 3884 -initialChannelId {f4b1a635-fc04-4c91-945f-11db61e30acc} -parentPid 3276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3276" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
            4⤵
            • Executes dropped EXE
            PID:3792
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2784 -prefsLen 34773 -prefMapHandle 3008 -prefMapSize 270279 -jsInitHandle 2756 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3168 -initialChannelId {2fd0bb7f-7202-4bf7-ba66-b490b03f013e} -parentPid 3276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3276" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:1524
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4964 -prefsLen 35010 -prefMapHandle 4968 -prefMapSize 270279 -ipcHandle 4976 -initialChannelId {75a4b3be-c105-404c-a654-ca9de750c328} -parentPid 3276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3276" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:6320
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5344 -prefsLen 35062 -prefMapHandle 5348 -prefMapSize 270279 -jsInitHandle 5352 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5328 -initialChannelId {f1a227ed-ae57-47be-8cbd-fd9dc8a41547} -parentPid 3276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3276" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:6448
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3928 -prefsLen 32952 -prefMapHandle 3912 -prefMapSize 270279 -jsInitHandle 3916 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5696 -initialChannelId {60f5177b-3e4d-4398-94a6-86a6d5ded2df} -parentPid 3276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3276" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:6904
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5812 -prefsLen 32952 -prefMapHandle 5816 -prefMapSize 270279 -jsInitHandle 5820 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4148 -initialChannelId {36ed99f7-8c05-4a0b-b4bf-2269659a80f2} -parentPid 3276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3276" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:6912
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5624 -prefsLen 32952 -prefMapHandle 4312 -prefMapSize 270279 -jsInitHandle 5896 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5968 -initialChannelId {f34b428b-6dba-46a3-a0ad-ef848e2ac6be} -parentPid 3276 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3276" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:6924
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:4672
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:5596
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:4420
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:980
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.internetdownloadmanager.com/welcome.html?v=642b63
        2⤵
        • Drops file in Windows directory
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:3484
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e8,0x2ec,0x2f0,0x2e4,0x2dc,0x7ffdca7ec188,0x7ffdca7ec194,0x7ffdca7ec1a0
          3⤵
            PID:5108
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1664,i,9972027124712063294,11459844063078467537,524288 --field-trial-handle=2072,i,11228316790495248226,18256731577951597591,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:11
            3⤵
            • System Time Discovery
            PID:4232
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1536,i,14053228550512788920,8109374186498160099,262144 --field-trial-handle=2072,i,11228316790495248226,18256731577951597591,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:2
            3⤵
              PID:4016
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2428,i,4219636550212828621,16329789325635949046,524288 --field-trial-handle=2072,i,11228316790495248226,18256731577951597591,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:13
              3⤵
                PID:6168
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3524,i,11712478104161954293,17641524512492340594,2097152 --field-trial-handle=2072,i,11228316790495248226,18256731577951597591,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
                3⤵
                  PID:6296
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3520,i,9413645466142342942,15213895210845849536,2097152 --field-trial-handle=2072,i,11228316790495248226,18256731577951597591,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
                  3⤵
                    PID:6304
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,1805956296263652680,6019574567630994008,524288 --field-trial-handle=2072,i,11228316790495248226,18256731577951597591,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:14
                    3⤵
                      PID:2300
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,7380660487326790129,2917414158628980544,524288 --field-trial-handle=2072,i,11228316790495248226,18256731577951597591,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:14
                      3⤵
                        PID:2380
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,3319189841949908574,13198843922729655368,524288 --field-trial-handle=2072,i,11228316790495248226,18256731577951597591,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:14
                        3⤵
                          PID:4992
                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                            cookie_exporter.exe --cookie-json=1128
                            4⤵
                              PID:864
                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,4021328164383793687,12995602464386635926,524288 --field-trial-handle=2072,i,11228316790495248226,18256731577951597591,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:14
                            3⤵
                              PID:1444
                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,4021328164383793687,12995602464386635926,524288 --field-trial-handle=2072,i,11228316790495248226,18256731577951597591,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:14
                              3⤵
                                PID:1764
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,6749081473515111192,13365464249846305421,524288 --field-trial-handle=2072,i,11228316790495248226,18256731577951597591,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
                                3⤵
                                  PID:3408
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,7485809162344966874,3425880975758404479,524288 --field-trial-handle=2072,i,11228316790495248226,18256731577951597591,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
                                  3⤵
                                    PID:4364
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,6073524403141574606,6123691332748546045,524288 --field-trial-handle=2072,i,11228316790495248226,18256731577951597591,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:14
                                    3⤵
                                      PID:7156
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,4879404233223824331,11960629060684231827,524288 --field-trial-handle=2072,i,11228316790495248226,18256731577951597591,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:14
                                      3⤵
                                        PID:6216
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,3853867402773688621,6280950723788020632,524288 --field-trial-handle=2072,i,11228316790495248226,18256731577951597591,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:14
                                        3⤵
                                          PID:4980
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 2532
                                        2⤵
                                        • Program crash
                                        PID:1684
                                    • C:\Windows\System32\alg.exe
                                      C:\Windows\System32\alg.exe
                                      1⤵
                                      • Executes dropped EXE
                                      • Drops file in System32 directory
                                      • Drops file in Program Files directory
                                      • Drops file in Windows directory
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:3592
                                    • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                                      C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                                      1⤵
                                      • Executes dropped EXE
                                      • Drops file in System32 directory
                                      • Drops file in Program Files directory
                                      • Drops file in Windows directory
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1048
                                    • C:\Windows\System32\svchost.exe
                                      C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
                                      1⤵
                                        PID:5388
                                      • C:\Windows\system32\fxssvc.exe
                                        C:\Windows\system32\fxssvc.exe
                                        1⤵
                                        • Executes dropped EXE
                                        • Modifies data under HKEY_USERS
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:896
                                      • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                        1⤵
                                        • Executes dropped EXE
                                        PID:3772
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                        1⤵
                                        • Executes dropped EXE
                                        PID:1516
                                      • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                        "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                                        1⤵
                                        • Executes dropped EXE
                                        PID:3780
                                      • C:\Windows\System32\msdtc.exe
                                        C:\Windows\System32\msdtc.exe
                                        1⤵
                                        • Executes dropped EXE
                                        • Drops file in System32 directory
                                        • Drops file in Windows directory
                                        PID:1204
                                      • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                                        "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                                        1⤵
                                        • Executes dropped EXE
                                        PID:2032
                                      • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                                        C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                                        1⤵
                                        • Executes dropped EXE
                                        PID:5540
                                      • C:\Windows\SysWow64\perfhost.exe
                                        C:\Windows\SysWow64\perfhost.exe
                                        1⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        PID:4716
                                      • C:\Windows\system32\locator.exe
                                        C:\Windows\system32\locator.exe
                                        1⤵
                                        • Executes dropped EXE
                                        PID:5556
                                      • C:\Windows\System32\SensorDataService.exe
                                        C:\Windows\System32\SensorDataService.exe
                                        1⤵
                                        • Executes dropped EXE
                                        • Drops file in System32 directory
                                        • Checks SCSI registry key(s)
                                        PID:5680
                                      • C:\Windows\System32\snmptrap.exe
                                        C:\Windows\System32\snmptrap.exe
                                        1⤵
                                        • Executes dropped EXE
                                        PID:3392
                                      • C:\Windows\system32\spectrum.exe
                                        C:\Windows\system32\spectrum.exe
                                        1⤵
                                        • Executes dropped EXE
                                        • Drops file in System32 directory
                                        • Checks SCSI registry key(s)
                                        PID:3528
                                      • C:\Windows\System32\OpenSSH\ssh-agent.exe
                                        C:\Windows\System32\OpenSSH\ssh-agent.exe
                                        1⤵
                                        • Executes dropped EXE
                                        PID:1552
                                      • C:\Windows\system32\TieringEngineService.exe
                                        C:\Windows\system32\TieringEngineService.exe
                                        1⤵
                                        • Executes dropped EXE
                                        • Checks processor information in registry
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:5808
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
                                        1⤵
                                          PID:4664
                                        • C:\Windows\system32\AgentService.exe
                                          C:\Windows\system32\AgentService.exe
                                          1⤵
                                          • Executes dropped EXE
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:4964
                                        • C:\Windows\System32\vds.exe
                                          C:\Windows\System32\vds.exe
                                          1⤵
                                          • Executes dropped EXE
                                          PID:3508
                                        • C:\Windows\system32\vssvc.exe
                                          C:\Windows\system32\vssvc.exe
                                          1⤵
                                          • Executes dropped EXE
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:4720
                                        • C:\Windows\system32\wbengine.exe
                                          "C:\Windows\system32\wbengine.exe"
                                          1⤵
                                          • Executes dropped EXE
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1580
                                        • C:\Windows\system32\wbem\WmiApSrv.exe
                                          C:\Windows\system32\wbem\WmiApSrv.exe
                                          1⤵
                                          • Executes dropped EXE
                                          PID:996
                                        • C:\Windows\system32\SearchIndexer.exe
                                          C:\Windows\system32\SearchIndexer.exe /Embedding
                                          1⤵
                                          • Executes dropped EXE
                                          • Enumerates connected drives
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of WriteProcessMemory
                                          PID:1176
                                          • C:\Windows\System32\SearchProtocolHost.exe
                                            "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                            2⤵
                                            • Modifies data under HKEY_USERS
                                            PID:2260
                                          • C:\Windows\system32\SearchFilterHost.exe
                                            "C:\Windows\system32\SearchFilterHost.exe" 940 1904 1800 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
                                            2⤵
                                            • Modifies data under HKEY_USERS
                                            PID:4008
                                          • C:\Windows\system32\SearchFilterHost.exe
                                            "C:\Windows\system32\SearchFilterHost.exe" 940 1812 1896 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
                                            2⤵
                                            • Modifies data under HKEY_USERS
                                            PID:2156
                                          • C:\Windows\System32\SearchProtocolHost.exe
                                            "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-226940941-599731907-2645636698-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-226940941-599731907-2645636698-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
                                            2⤵
                                              PID:3188
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                            1⤵
                                              PID:2464
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2424 -ip 2424
                                              1⤵
                                                PID:6604

                                              Network

                                                    MITRE ATT&CK Enterprise v16

                                                    Reconnaissance

                                                    Resource Development

                                                    Initial Access

                                                    Execution

                                                    Persistence

                                                    Boot or Logon Autostart Execution

                                                    1
                                                    T1547

                                                    Registry Run Keys / Startup Folder

                                                    1
                                                    T1547.001

                                                    Browser Extensions

                                                    1
                                                    T1176

                                                    Privilege Escalation

                                                    Boot or Logon Autostart Execution

                                                    1
                                                    T1547

                                                    Registry Run Keys / Startup Folder

                                                    1
                                                    T1547.001

                                                    Defense Evasion

                                                    Modify Registry

                                                    3
                                                    T1112

                                                    Credential Access

                                                    Credentials from Password Stores

                                                    1
                                                    T1555

                                                    Credentials from Web Browsers

                                                    1
                                                    T1555.003

                                                    Unsecured Credentials

                                                    1
                                                    T1552

                                                    Credentials In Files

                                                    1
                                                    T1552.001

                                                    Discovery

                                                    Browser Information Discovery

                                                    1
                                                    T1217

                                                    Peripheral Device Discovery

                                                    2
                                                    T1120

                                                    Query Registry

                                                    5
                                                    T1012

                                                    System Information Discovery

                                                    6
                                                    T1082

                                                    System Location Discovery

                                                    1
                                                    T1614

                                                    System Language Discovery

                                                    1
                                                    T1614.001

                                                    System Time Discovery

                                                    1
                                                    T1124

                                                    Lateral Movement

                                                    Collection

                                                    Data from Local System

                                                    1
                                                    T1005

                                                    Command and Control

                                                    Exfiltration

                                                    Impact

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    elevation_service.exe
                                                    • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                    • Size 2.7MB
                                                    • SHA256 c42ed51f27888ebc95af45c3ecf119ae5cd482a0ac118202b0f22fe6caa841b3
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    maintenanceservice.exe
                                                    • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                    • Size 1.4MB
                                                    • SHA256 9f35872fc45f1fc1729f73e898b3b51a83ee66188b429655bb7de6501052560e
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    7z.exe
                                                    • Path C:\Program Files\7-Zip\7z.exe
                                                    • Size 1.7MB
                                                    • SHA256 ae98ec5641883b0eb515a030c122040e78bce82c1f13964995b03fa17177df7d
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    7zFM.exe
                                                    • Path C:\Program Files\7-Zip\7zFM.exe
                                                    • Size 1.5MB
                                                    • SHA256 c45cec265005cf579b07b5cf7b404c3c593c389a65b4dcfa8c534fd535d4a7f0
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    7zG.exe
                                                    • Path C:\Program Files\7-Zip\7zG.exe
                                                    • Size 1.2MB
                                                    • SHA256 b8e75da5d37d30776356d37bcfadbd324808e17354662c60fd8b2d86cbf18d44
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Uninstall.exe
                                                    • Path C:\Program Files\7-Zip\Uninstall.exe
                                                    • Size 1.2MB
                                                    • SHA256 debd39535b079dbd4ff6301cd706c09068228ecbb1e139d28f20370229103e82
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    AppVShNotify.exe
                                                    • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
                                                    • Size 1.4MB
                                                    • SHA256 e4d51155f7a56c30c80aab914b37e235fd23ee2fd719504956e503fec6861fd6
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    IntegratedOffice.exe
                                                    • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
                                                    • Size 4.6MB
                                                    • SHA256 96fb7ca99de837bddd8650ce63a13725902345f44ca2a139f8ccde0e7464e649
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    MavInject32.exe
                                                    • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
                                                    • Size 1.5MB
                                                    • SHA256 71f0fdecc84b52eb12a09f3e88f140a3671441ee2e514d4268af63bf3c8c288d
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    appvcleaner.exe
                                                    • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
                                                    • Size 2.7MB
                                                    • SHA256 bcd8bd95d14eaf13f24541dc232734cc4a6719c4848c21fb1397335ceae4b1a8
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    OSE.EXE
                                                    • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                                                    • Size 1.4MB
                                                    • SHA256 6c5148b1b7e76ca5d0b66132e93922e9d4d0ecc38c514f90ae989730fb123c19
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    elevation_service.exe
                                                    • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                    • Size 2.8MB
                                                    • SHA256 51fde21dd2b432b5c53416edf1ba7b5c2184876c1fd418520d5e2ec27d7ac1d0
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    firefox.exe
                                                    • Path C:\Program Files\Mozilla Firefox\firefox.exe
                                                    • Size 1.2MB
                                                    • SHA256 4666edc2c3df3ecf12864b7c2c0749bbea9f9027478504d123c6307339cef326
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    wmpnetwk.exe
                                                    • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
                                                    • Size 1.5MB
                                                    • SHA256 1fd9a84611b4a0d1c58e1149b27d02071e4470a1ac21b6082f6a562be320074d
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    settings.dat
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                    • Size 280B
                                                    • SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    settings.dat
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                    • Size 280B
                                                    • SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    BookmarkMergedSurfaceOrdering
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                    • Size 6B
                                                    • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    BrowsingTopicsState
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
                                                    • Size 649B
                                                    • SHA256 5c6991d66df4df6f9f2d2c7370feb8e56460e50ef71c6a637f37bd394c5c22bf
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    the-real-index
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                    • Size 3KB
                                                    • SHA256 bbdac1f2d41a0ea47e43a34db78ced3c4b9f96588f40c2ec2b7b5f6c8dc57f13
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    SiteList-Enterprise.json
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                    • Size 2B
                                                    • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    HubApps
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
                                                    • Size 106KB
                                                    • SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Network Persistent State
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                    • Size 2KB
                                                    • SHA256 854462c5012042f893ace7ddb91eaa1860973da1d1a99a55d91434b9fcd69435
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    SCT Auditing Pending Reports
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                    • Size 2B
                                                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    Sdch Dictionaries
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                    • Size 40B
                                                    • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    Preferences
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                    • Size 15KB
                                                    • SHA256 21666e02458b1719b7cfcaf22c10c0f4439805e810d8443a3aaa4a2504c1d3fe
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Secure Preferences
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                    • Size 36KB
                                                    • SHA256 3c512948b38c66463ccc384556c507011a74b7a9480527e8dff111256f902e69
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    sync_diagnostic.log
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                    • Size 22KB
                                                    • SHA256 600ada0a56fc97af96ca5e9b7a229ed07ddbb19a6b0e4c46c46fa06ed983831d
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Local State
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                    • Size 28KB
                                                    • SHA256 4efb0df0f4221d5e92c26308c0df9356e979a616ee49d1e7df904e6cabb25c4f
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Local State
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                    • Size 33KB
                                                    • SHA256 8ba0bfc34031376c8de698ad3ce0b9c64fea9e3eb9ba95e3234fd406a91e4ff2
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Local State
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                    • Size 25KB
                                                    • SHA256 05486131a82dab89b08e439a30f60a8bbbfb8bee3dc474f88b81f794bc160d71
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Local State
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                    • Size 28KB
                                                    • SHA256 706d02d746cb737acdbcdf55e078b96d9438d47d4b5d9dec7e43e1c8f19e8056
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    metadata.json
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                    • Size 2KB
                                                    • SHA256 027fe62a6e8fe12e40cd4fbd4bc6b095501a3f95b673d88e3a43e21ad1346560
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    C5643FFFEA92A5665EA3F3F42C97FA8CC3904334
                                                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pccbfso0.default-release\cache2\entries\C5643FFFEA92A5665EA3F3F42C97FA8CC3904334
                                                    • Size 13KB
                                                    • SHA256 f48ca82b6a44e8ab623930342d3a10ba3ecaafdcc6ab00cfbe67d2b8c6fda446
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    F58F0605C722D0D848D03D88AC8E3E50223F57B0
                                                    • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pccbfso0.default-release\cache2\entries\F58F0605C722D0D848D03D88AC8E3E50223F57B0
                                                    • Size 13KB
                                                    • SHA256 ccb5054b800a155b92f1080c9f893c2d13ba777463ab37e2902c69da24d4243d
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    tmpaddon
                                                    • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                    • Size 502KB
                                                    • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    tmpaddon
                                                    • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                    • Size 11KB
                                                    • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    9af0deb7ccebd5c8.bin
                                                    • Path C:\Users\Admin\AppData\Roaming\9af0deb7ccebd5c8.bin
                                                    • Size 12KB
                                                    • SHA256 85c7ce79cc022b186852e32a5869c177467ef5e1cf425625f90a4da1e26c9ebe
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    compatibility.ini
                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\compatibility.ini
                                                    • Size 198B
                                                    • SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    data.safe.tmp
                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\db\data.safe.tmp
                                                    • Size 7KB
                                                    • SHA256 b1e6fcc0cf202e936ca111714cd2a8e10127d9173525f1810b181ec40d4eacf9
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    data.safe.tmp
                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\db\data.safe.tmp
                                                    • Size 5KB
                                                    • SHA256 06a9afb6d18916f529a0cdb1a3aeeb841ba9fc19fc55a3b19d97e6bfce47f2e6
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    data.safe.tmp
                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\db\data.safe.tmp
                                                    • Size 30KB
                                                    • SHA256 239237a3901b94fa1203d4e94a8dc419f961381c2e0f10c9c57e222ebb66a601
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    data.safe.tmp
                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\db\data.safe.tmp
                                                    • Size 30KB
                                                    • SHA256 96557e0af61a4c278098e511003d430556078b706e0da0b69270be97320bb85d
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    data.safe.tmp
                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\db\data.safe.tmp
                                                    • Size 30KB
                                                    • SHA256 0b268a8b1ebd11963f0d3cd8170db89ca4a9f844192211cb714a1447338b722a
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    events
                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\events\events
                                                    • Size 1KB
                                                    • SHA256 b7937f47cfa317ba5cb1d3c2f8b1d3a8167633c4f19c80a3f1203d0e1c58adec
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    013bf7f4-9e81-467c-865a-89eab57e3c66
                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\pending_pings\013bf7f4-9e81-467c-865a-89eab57e3c66
                                                    • Size 2KB
                                                    • SHA256 9f482a9ba19a359470ec53306e365bdac1578712209692e8ab5c050bf5f1f0f0
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    2c3b7f44-6259-4fc6-869f-5e1717d2438a
                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\pending_pings\2c3b7f44-6259-4fc6-869f-5e1717d2438a
                                                    • Size 235B
                                                    • SHA256 04cfe3a39f7d5385a341303beff64d47e6b6373eed1109440fcdd7c13d39c58a
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    4ba62f96-652b-4126-9b0d-23fd0b9718c2
                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\pending_pings\4ba62f96-652b-4126-9b0d-23fd0b9718c2
                                                    • Size 886B
                                                    • SHA256 6ce012995cd60088404820e79d7d1ddd37a50443e3711fad60f1f4fc0662bed5
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    682da94a-1831-4221-ba9d-dbc30391cad2
                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\pending_pings\682da94a-1831-4221-ba9d-dbc30391cad2
                                                    • Size 883B
                                                    • SHA256 44c36b3aecf553aafa6fe0ee2b12e310342bda0a20339200908bf37daa8e6197
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    9dcabde7-cae5-48c2-b7a1-0e389db5f1e2
                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\pending_pings\9dcabde7-cae5-48c2-b7a1-0e389db5f1e2
                                                    • Size 235B
                                                    • SHA256 23dfd28f1b11229971dcae75c24651958adfcb226033346d0437cadc256bbec7
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    f3e57eb7-27ca-46dc-86b3-13558e824c8f
                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\datareporting\glean\pending_pings\f3e57eb7-27ca-46dc-86b3-13558e824c8f
                                                    • Size 2KB
                                                    • SHA256 60048160a339f2fce311e551cf6830dd2aee78dd156dcbd51332347290883436
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    extensions.json
                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\extensions.json
                                                    • Size 16KB
                                                    • SHA256 6d073f7300d13076a8d7eb7b7818370a4bdebe284b4ef42ea47cec1ab1cca574
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    gmpopenh264.dll
                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                                                    • Size 1.1MB
                                                    • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    gmpopenh264.info
                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                                                    • Size 116B
                                                    • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    manifest.json
                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
                                                    • Size 1001B
                                                    • SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    widevinecdm.dll
                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
                                                    • Size 18.9MB
                                                    • SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    prefs-1.js
                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\prefs-1.js
                                                    • Size 8KB
                                                    • SHA256 4429d186087df48ddc3719de99a06d45e30668ee57e225f36531ec7411d801f6
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    prefs.js
                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\prefs.js
                                                    • Size 6KB
                                                    • SHA256 ddad8f1658944fef3f7bb542d9e40f363d526cf298140aa9a89e933b2a4cbb5d
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    prefs.js
                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\prefs.js
                                                    • Size 6KB
                                                    • SHA256 e4a34b484e2349094d2754a53105b8f6c2ada96d101dd0f6420ab262ee206885
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    recovery.baklz4
                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\sessionstore-backups\recovery.baklz4
                                                    • Size 4KB
                                                    • SHA256 a1431e5bf5994e1054c87ac543d50a0b5ebf5c23e079c372d22c4202f0afcc47
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    recovery.jsonlz4
                                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pccbfso0.default-release\sessionstore-backups\recovery.jsonlz4
                                                    • Size 4KB
                                                    • SHA256 b9a1dd87ae0acd0e61d91818d08ae56218e098c6afd42d582cf9bacba235bff4
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    perfhost.exe
                                                    • Path C:\Windows\SysWOW64\perfhost.exe
                                                    • Size 1.2MB
                                                    • SHA256 4ad55480a2b37468c3ac33df7ffae50c6f26b24ee39bf41a8187f3a5732345e5
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    AgentService.exe
                                                    • Path C:\Windows\System32\AgentService.exe
                                                    • Size 1.7MB
                                                    • SHA256 679a2c230323ee2600e4454f9cf5718f3c1f2f752fc4701de0167497d44dcf85
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    DiagnosticsHub.StandardCollector.Service.exe
                                                    • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                                                    • Size 1.3MB
                                                    • SHA256 d0a9c827b13e644184712a0e4970df0e6980e4e1d776bc6cd6f4d0ede59dd508
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    FXSSVC.exe
                                                    • Path C:\Windows\System32\FXSSVC.exe
                                                    • Size 1.2MB
                                                    • SHA256 b5cfd7f10a095365eb8f2c5899c9bc834a2cd513d30f7688e14ac6640758cd15
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Locator.exe
                                                    • Path C:\Windows\System32\Locator.exe
                                                    • Size 1.2MB
                                                    • SHA256 d2df5b7b4cf8a8e58678c33b6656d32b7d3488267b151d3f1d02c93f1c5d16ff
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    ssh-agent.exe
                                                    • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                                                    • Size 1.5MB
                                                    • SHA256 72773bc76641364f568d5746567dc83693b7b832476eda115b080c1b7d7e2bee
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    PerceptionSimulationService.exe
                                                    • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                                                    • Size 1.4MB
                                                    • SHA256 c00f7612e4bd27a83a16e2a34e0daa3fffc49d15273aab69806e7ccc79bb167a
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    SearchIndexer.exe
                                                    • Path C:\Windows\System32\SearchIndexer.exe
                                                    • Size 1.4MB
                                                    • SHA256 1929e9eba33ed5ec4d9b067231b5c14afa3baaa278af14cc5fb632d83b3623c5
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    SensorDataService.exe
                                                    • Path C:\Windows\System32\SensorDataService.exe
                                                    • Size 1.7MB
                                                    • SHA256 bcddbce163d7783654ad4028972ed219d2302ce1eec9be72ca0db10b4ed16e6a
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Spectrum.exe
                                                    • Path C:\Windows\System32\Spectrum.exe
                                                    • Size 1.3MB
                                                    • SHA256 d9915b0297a79faf43fe8be9ef5eefa94938ce1e223851de14686402e65db579
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    TieringEngineService.exe
                                                    • Path C:\Windows\System32\TieringEngineService.exe
                                                    • Size 1.5MB
                                                    • SHA256 66b3294b1b3e974f8f0fd31e022850721a8cd44d2d8fff2cac9d9ba6e81dc9ee
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    VSSVC.exe
                                                    • Path C:\Windows\System32\VSSVC.exe
                                                    • Size 2.0MB
                                                    • SHA256 e6842fc3ddc85478d3ab657b48523980edda69f3784e590c45a828a1dfa32b50
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    alg.exe
                                                    • Path C:\Windows\System32\alg.exe
                                                    • Size 1.3MB
                                                    • SHA256 b6fe5e509f87b2f7c809d6a938d26c196d4c7f49028d7bc5de31fc370b9c9c4e
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    msdtc.exe
                                                    • Path C:\Windows\System32\msdtc.exe
                                                    • Size 1.3MB
                                                    • SHA256 15b05ff22b0d2a392e6ae458d09d19131d26ad15d0ee8469cd94a3c45b8ef7ed
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    snmptrap.exe
                                                    • Path C:\Windows\System32\snmptrap.exe
                                                    • Size 1.2MB
                                                    • SHA256 86bc7abce4ac3ff2ff910de8c7d62ca27b0607d3676ac882f0155b6f593d125b
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    vds.exe
                                                    • Path C:\Windows\System32\vds.exe
                                                    • Size 1.3MB
                                                    • SHA256 a29796cbcb873c2a3dbe0ff96bafb7b0b986a1c156b478297fd8789ba44d4406
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    WmiApSrv.exe
                                                    • Path C:\Windows\System32\wbem\WmiApSrv.exe
                                                    • Size 1.4MB
                                                    • SHA256 929afa37ac03af5f0ce6986d91ccc1462ee5673cdc44e19407cc4592682fae27
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    wbengine.exe
                                                    • Path C:\Windows\System32\wbengine.exe
                                                    • Size 2.1MB
                                                    • SHA256 a04ba4d08e9b123abac4830cf00402b969988b5e093809681b68eb2f792c7bad
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    data.txt
                                                    • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1587302073\data.txt
                                                    • Size 146KB
                                                    • SHA256 4d3b611b8b664c9b2e4503f41eabf3833860e521447c1dc921f0849e0c8633de
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    manifest.json
                                                    • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3484_1587302073\manifest.json
                                                    • Size 52B
                                                    • SHA256 98fd5d8bd64136534587ef4cd3f9151defa2a6dae9f0b269a2cbb06433c50336
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    AppVClient.exe
                                                    • Path C:\Windows\system32\AppVClient.exe
                                                    • Size 1.3MB
                                                    • SHA256 bdff54e2ada381333151179563c6a1f0f7d444fbc6e3e10f952fd34069136102
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    SgrmBroker.exe
                                                    • Path C:\Windows\system32\SgrmBroker.exe
                                                    • Size 1.6MB
                                                    • SHA256 65fd27306e45ac3ee97e860b97e74e55811fbe251c5695d58a39a43e79f4d967
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    StructuredQuerySchema.bin
                                                    • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
                                                    • Size 414KB
                                                    • SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    msiexec.exe
                                                    • Path C:\Windows\system32\msiexec.exe
                                                    • Size 1.4MB
                                                    • SHA256 3b0a3858a87065d0b5e849357c3f98c4a03b820e344c3dbc477636c5673931aa
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    memory/896-46-0x0000000000DF0000-0x0000000000E50000-memory.dmp
                                                    Download

                                                    memory/896-48-0x0000000140000000-0x0000000140136000-memory.dmp
                                                    Download

                                                    memory/896-37-0x0000000140000000-0x0000000140136000-memory.dmp
                                                    Download

                                                    memory/896-38-0x0000000000DF0000-0x0000000000E50000-memory.dmp
                                                    Download

                                                    memory/896-44-0x0000000000DF0000-0x0000000000E50000-memory.dmp
                                                    Download

                                                    memory/996-499-0x0000000140000000-0x0000000140162000-memory.dmp
                                                    Download

                                                    memory/996-267-0x0000000000760000-0x00000000007C0000-memory.dmp
                                                    Download

                                                    memory/996-271-0x0000000140000000-0x0000000140162000-memory.dmp
                                                    Download

                                                    memory/1048-33-0x0000000000760000-0x00000000007C0000-memory.dmp
                                                    Download

                                                    memory/1048-25-0x0000000000760000-0x00000000007C0000-memory.dmp
                                                    Download

                                                    memory/1048-145-0x0000000140000000-0x000000014014A000-memory.dmp
                                                    Download

                                                    memory/1048-31-0x0000000140000000-0x000000014014A000-memory.dmp
                                                    Download

                                                    memory/1048-32-0x0000000000760000-0x00000000007C0000-memory.dmp
                                                    Download

                                                    memory/1176-516-0x0000000140000000-0x0000000140172000-memory.dmp
                                                    Download

                                                    memory/1176-291-0x0000000001C30000-0x0000000001C40000-memory.dmp
                                                    Download

                                                    memory/1176-307-0x0000000001EE0000-0x0000000001EF0000-memory.dmp
                                                    Download

                                                    memory/1176-279-0x0000000000910000-0x0000000000970000-memory.dmp
                                                    Download

                                                    memory/1176-323-0x000000000A520000-0x000000000A528000-memory.dmp
                                                    Download

                                                    memory/1176-282-0x0000000140000000-0x0000000140172000-memory.dmp
                                                    Download

                                                    memory/1176-273-0x0000000000910000-0x0000000000970000-memory.dmp
                                                    Download

                                                    memory/1176-481-0x000000000BE60000-0x000000000BE68000-memory.dmp
                                                    Download

                                                    memory/1204-90-0x0000000000770000-0x00000000007D0000-memory.dmp
                                                    Download

                                                    memory/1204-96-0x0000000000770000-0x00000000007D0000-memory.dmp
                                                    Download

                                                    memory/1204-89-0x0000000140000000-0x000000014015A000-memory.dmp
                                                    Download

                                                    memory/1204-218-0x0000000140000000-0x000000014015A000-memory.dmp
                                                    Download

                                                    memory/1516-972-0x0000000140000000-0x00000001402D4000-memory.dmp
                                                    Download

                                                    memory/1516-68-0x00000000008F0000-0x0000000000950000-memory.dmp
                                                    Download

                                                    memory/1516-62-0x00000000008F0000-0x0000000000950000-memory.dmp
                                                    Download

                                                    memory/1516-71-0x0000000140000000-0x00000001402D4000-memory.dmp
                                                    Download

                                                    memory/1516-194-0x0000000140000000-0x00000001402D4000-memory.dmp
                                                    Download

                                                    memory/1552-185-0x0000000000CC0000-0x0000000000D20000-memory.dmp
                                                    Download

                                                    memory/1552-191-0x0000000000CC0000-0x0000000000D20000-memory.dmp
                                                    Download

                                                    memory/1552-195-0x0000000140000000-0x00000001401A2000-memory.dmp
                                                    Download

                                                    memory/1580-255-0x0000000000BF0000-0x0000000000C50000-memory.dmp
                                                    Download

                                                    memory/1580-477-0x0000000140000000-0x0000000140216000-memory.dmp
                                                    Download

                                                    memory/1580-259-0x0000000140000000-0x0000000140216000-memory.dmp
                                                    Download

                                                    memory/1580-249-0x0000000000BF0000-0x0000000000C50000-memory.dmp
                                                    Download

                                                    memory/2032-110-0x0000000140000000-0x000000014016F000-memory.dmp
                                                    Download

                                                    memory/2032-104-0x0000000000870000-0x00000000008D0000-memory.dmp
                                                    Download

                                                    memory/2032-111-0x0000000000870000-0x00000000008D0000-memory.dmp
                                                    Download

                                                    memory/2032-234-0x0000000140000000-0x000000014016F000-memory.dmp
                                                    Download

                                                    memory/2424-81-0x0000000000400000-0x0000000000A5F000-memory.dmp
                                                    Download

                                                    memory/2424-5-0x00000000031D0000-0x0000000003237000-memory.dmp
                                                    Download

                                                    memory/2424-1293-0x0000000000400000-0x0000000000A5F000-memory.dmp
                                                    Download

                                                    memory/2424-8-0x0000000000400000-0x0000000000A5F000-memory.dmp
                                                    Download

                                                    memory/2424-0-0x00000000031D0000-0x0000000003237000-memory.dmp
                                                    Download

                                                    memory/3392-170-0x0000000140000000-0x0000000140138000-memory.dmp
                                                    Download

                                                    memory/3392-325-0x0000000140000000-0x0000000140138000-memory.dmp
                                                    Download

                                                    memory/3392-161-0x00000000006B0000-0x0000000000710000-memory.dmp
                                                    Download

                                                    memory/3392-167-0x00000000006B0000-0x0000000000710000-memory.dmp
                                                    Download

                                                    memory/3508-225-0x0000000000C00000-0x0000000000C60000-memory.dmp
                                                    Download

                                                    memory/3508-471-0x0000000140000000-0x0000000140147000-memory.dmp
                                                    Download

                                                    memory/3508-231-0x0000000000C00000-0x0000000000C60000-memory.dmp
                                                    Download

                                                    memory/3508-235-0x0000000140000000-0x0000000140147000-memory.dmp
                                                    Download

                                                    memory/3528-172-0x0000000000740000-0x00000000007A0000-memory.dmp
                                                    Download

                                                    memory/3528-181-0x0000000140000000-0x0000000140149000-memory.dmp
                                                    Download

                                                    memory/3528-178-0x0000000000740000-0x00000000007A0000-memory.dmp
                                                    Download

                                                    memory/3528-374-0x0000000140000000-0x0000000140149000-memory.dmp
                                                    Download

                                                    memory/3592-20-0x00000000007C0000-0x0000000000820000-memory.dmp
                                                    Download

                                                    memory/3592-19-0x0000000140000000-0x000000014014A000-memory.dmp
                                                    Download

                                                    memory/3592-12-0x00000000007C0000-0x0000000000820000-memory.dmp
                                                    Download

                                                    memory/3592-123-0x0000000140000000-0x000000014014A000-memory.dmp
                                                    Download

                                                    memory/3772-180-0x0000000140000000-0x00000001402E9000-memory.dmp
                                                    Download

                                                    memory/3772-59-0x0000000140000000-0x00000001402E9000-memory.dmp
                                                    Download

                                                    memory/3772-57-0x0000000000E00000-0x0000000000E60000-memory.dmp
                                                    Download

                                                    memory/3772-51-0x0000000000E00000-0x0000000000E60000-memory.dmp
                                                    Download

                                                    memory/3780-79-0x0000000001740000-0x00000000017A0000-memory.dmp
                                                    Download

                                                    memory/3780-73-0x0000000001740000-0x00000000017A0000-memory.dmp
                                                    Download

                                                    memory/3780-84-0x0000000140000000-0x0000000140175000-memory.dmp
                                                    Download

                                                    memory/3780-85-0x0000000001740000-0x00000000017A0000-memory.dmp
                                                    Download

                                                    memory/3780-87-0x0000000140000000-0x0000000140175000-memory.dmp
                                                    Download

                                                    memory/4008-494-0x0000027CE1CA0000-0x0000027CE1CB0000-memory.dmp
                                                    Download

                                                    memory/4008-488-0x0000027CE1CA0000-0x0000027CE1CB0000-memory.dmp
                                                    Download

                                                    memory/4008-485-0x0000027CE1CA0000-0x0000027CE1CB0000-memory.dmp
                                                    Download

                                                    memory/4008-484-0x0000027CE1CA0000-0x0000027CE1CB0000-memory.dmp
                                                    Download

                                                    memory/4008-496-0x0000027CE1CA0000-0x0000027CE1CB0000-memory.dmp
                                                    Download

                                                    memory/4008-495-0x0000027CE1CA0000-0x0000027CE1CB0000-memory.dmp
                                                    Download

                                                    memory/4008-493-0x0000027CE1CA0000-0x0000027CE1CB0000-memory.dmp
                                                    Download

                                                    memory/4008-492-0x0000027CE1CA0000-0x0000027CE1CB0000-memory.dmp
                                                    Download

                                                    memory/4008-491-0x0000027CE1CA0000-0x0000027CE1CB0000-memory.dmp
                                                    Download

                                                    memory/4008-483-0x0000027CE1CA0000-0x0000027CE1CB0000-memory.dmp
                                                    Download

                                                    memory/4008-486-0x0000027CE1CA0000-0x0000027CE1CB0000-memory.dmp
                                                    Download

                                                    memory/4008-490-0x0000027CE1CA0000-0x0000027CE1CB0000-memory.dmp
                                                    Download

                                                    memory/4008-489-0x0000027CE1CA0000-0x0000027CE1CB0000-memory.dmp
                                                    Download

                                                    memory/4008-487-0x0000027CE1CA0000-0x0000027CE1CB0000-memory.dmp
                                                    Download

                                                    memory/4716-135-0x0000000000400000-0x0000000000537000-memory.dmp
                                                    Download

                                                    memory/4716-258-0x0000000000400000-0x0000000000537000-memory.dmp
                                                    Download

                                                    memory/4716-132-0x0000000000700000-0x0000000000767000-memory.dmp
                                                    Download

                                                    memory/4716-127-0x0000000000700000-0x0000000000767000-memory.dmp
                                                    Download

                                                    memory/4720-476-0x0000000140000000-0x00000001401F6000-memory.dmp
                                                    Download

                                                    memory/4720-243-0x00000000007C0000-0x0000000000820000-memory.dmp
                                                    Download

                                                    memory/4720-247-0x0000000140000000-0x00000001401F6000-memory.dmp
                                                    Download

                                                    memory/4964-219-0x0000000140000000-0x00000001401AD000-memory.dmp
                                                    Download

                                                    memory/4964-215-0x00000000006B0000-0x0000000000710000-memory.dmp
                                                    Download

                                                    memory/4964-221-0x00000000006B0000-0x0000000000710000-memory.dmp
                                                    Download

                                                    memory/4964-223-0x0000000140000000-0x00000001401AD000-memory.dmp
                                                    Download

                                                    memory/5540-121-0x0000000000C30000-0x0000000000C90000-memory.dmp
                                                    Download

                                                    memory/5540-115-0x0000000000C30000-0x0000000000C90000-memory.dmp
                                                    Download

                                                    memory/5540-246-0x0000000140000000-0x000000014016A000-memory.dmp
                                                    Download

                                                    memory/5540-124-0x0000000140000000-0x000000014016A000-memory.dmp
                                                    Download

                                                    memory/5556-137-0x00000000006C0000-0x0000000000720000-memory.dmp
                                                    Download

                                                    memory/5556-147-0x0000000140000000-0x0000000140136000-memory.dmp
                                                    Download

                                                    memory/5556-143-0x00000000006C0000-0x0000000000720000-memory.dmp
                                                    Download

                                                    memory/5680-158-0x0000000140000000-0x00000001401C1000-memory.dmp
                                                    Download

                                                    memory/5680-155-0x0000000000750000-0x00000000007B0000-memory.dmp
                                                    Download

                                                    memory/5680-149-0x0000000000750000-0x00000000007B0000-memory.dmp
                                                    Download

                                                    memory/5680-281-0x0000000140000000-0x00000001401C1000-memory.dmp
                                                    Download

                                                    memory/5680-479-0x0000000000750000-0x00000000007B0000-memory.dmp
                                                    Download

                                                    memory/5680-480-0x0000000140000000-0x00000001401C1000-memory.dmp
                                                    Download

                                                    memory/5808-198-0x0000000000880000-0x00000000008E0000-memory.dmp
                                                    Download

                                                    memory/5808-207-0x0000000140000000-0x0000000140183000-memory.dmp
                                                    Download

                                                    memory/5808-204-0x0000000000880000-0x00000000008E0000-memory.dmp
                                                    Download

                                                    memory/5808-456-0x0000000140000000-0x0000000140183000-memory.dmp
                                                    Download