Overview

overview

10

Static

static

10

2026-07-01...op.exe

windows10-2004-x64

9

2026-07-01...op.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    01/07/2026, 07:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-01_cc8791d946fc80de9442ec4a06fb9e19_darkgate_elex_glassworm_remcos_stop.exe
  • Size 6.3MB
  • Sample260701-jf7bmsg14n
  • SHA256 89ccd69dab4df59c9f25bbf1dae18a299f77182604173e7c8df704a54ee90928
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwaredefense_evasiondiscoverypersistencephishingransomwarespywarestealertrojan

Malware Config

Signatures

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 2 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 2 IoCs
  • A potential corporate email address has been identified in the URL: [email protected]
    phishing
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 34 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Drops desktop.ini file(s) 3 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Control Panel 1 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 22 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: EnumeratesProcesses 42 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 49 IoCs
  • Suspicious use of FindShellTrayWindow 9 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-01_cc8791d946fc80de9442ec4a06fb9e19_darkgate_elex_glassworm_remcos_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-01_cc8791d946fc80de9442ec4a06fb9e19_darkgate_elex_glassworm_remcos_stop.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Installs/modifies Browser Helper Object
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3896
    • C:\Windows\SysWOW64\regsvr32.exe
      regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1636
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4524
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Drops desktop.ini file(s)
        • Checks processor information in registry
        • Modifies Control Panel
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4584
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2060 -prefsLen 27099 -prefMapHandle 2064 -prefMapSize 270279 -ipcHandle 2148 -initialChannelId {bffb86a7-fec3-47ac-a3f9-0c810fc6c6c8} -parentPid 4584 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4584" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
          4⤵
          • Executes dropped EXE
          PID:1528
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2548 -prefsLen 27135 -prefMapHandle 2552 -prefMapSize 270279 -ipcHandle 2560 -initialChannelId {8af1404e-6e3a-4822-8fe8-b4d815a10b18} -parentPid 4584 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4584" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
          4⤵
          • Executes dropped EXE
          PID:4676
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3820 -prefsLen 25164 -prefMapHandle 3824 -prefMapSize 270279 -jsInitHandle 3828 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3836 -initialChannelId {239c84b9-5fc5-439a-a02c-c123f9d47f5d} -parentPid 4584 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4584" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
          4⤵
          • Executes dropped EXE
          • Checks processor information in registry
          PID:5152
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4012 -prefsLen 27276 -prefMapHandle 4016 -prefMapSize 270279 -ipcHandle 4084 -initialChannelId {0a27752b-bdf5-4f73-afd3-901434e88fdc} -parentPid 4584 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4584" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
          4⤵
          • Executes dropped EXE
          PID:5192
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3256 -prefsLen 34775 -prefMapHandle 3292 -prefMapSize 270279 -jsInitHandle 2720 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3024 -initialChannelId {3472819b-8abd-474e-9a47-8f3e5c9a8f38} -parentPid 4584 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4584" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
          4⤵
          • Executes dropped EXE
          • Checks processor information in registry
          PID:5448
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4956 -prefsLen 35012 -prefMapHandle 4960 -prefMapSize 270279 -ipcHandle 4936 -initialChannelId {e41f02b2-4761-4ea7-9dd3-67619fda30c8} -parentPid 4584 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4584" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
          4⤵
          • Executes dropped EXE
          • Checks processor information in registry
          PID:6412
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4648 -prefsLen 32900 -prefMapHandle 5124 -prefMapSize 270279 -jsInitHandle 5116 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4944 -initialChannelId {111d0cc5-1aea-4756-b40b-8770d77baea6} -parentPid 4584 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4584" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Checks processor information in registry
          PID:6496
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5376 -prefsLen 32952 -prefMapHandle 5380 -prefMapSize 270279 -jsInitHandle 5384 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5392 -initialChannelId {fbcab163-18d0-41ad-a9f7-1925b3cd67b9} -parentPid 4584 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4584" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
          4⤵
          • Executes dropped EXE
          • Checks processor information in registry
          PID:6508
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5568 -prefsLen 32952 -prefMapHandle 5572 -prefMapSize 270279 -jsInitHandle 5576 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5580 -initialChannelId {4263c511-6170-4520-a4f0-62b67e42d85d} -parentPid 4584 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4584" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
          4⤵
          • Executes dropped EXE
          • Checks processor information in registry
          PID:6516
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5888 -prefsLen 32952 -prefMapHandle 5892 -prefMapSize 270279 -jsInitHandle 5896 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4912 -initialChannelId {29844781-c5e2-45f4-a53f-4459c96469df} -parentPid 4584 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4584" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
          4⤵
          • Executes dropped EXE
          • Checks processor information in registry
          PID:7112
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5380
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4660
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5128
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3000
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" http://www.internetdownloadmanager.com/download2.html
      2⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      • Modifies registry class
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:5700
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d4,0x7ff92ebac188,0x7ff92ebac194,0x7ff92ebac1a0
        3⤵
          PID:6224
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,6149405152581763270,5669858707677720585,524288 --field-trial-handle=2340,i,7235552409281435168,16934782181933794124,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:3
          3⤵
          • System Time Discovery
          PID:6612
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,13356548825019010634,11362070942149911220,262144 --field-trial-handle=2340,i,7235552409281435168,16934782181933794124,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:2
          3⤵
            PID:6276
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2612,i,8929804113080383912,14227184001615912537,524288 --field-trial-handle=2340,i,7235552409281435168,16934782181933794124,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:8
            3⤵
              PID:6820
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,7036602838791773684,9110883079463597058,2097152 --field-trial-handle=2340,i,7235552409281435168,16934782181933794124,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
              3⤵
                PID:6204
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,5002398311963683699,9051017962074370291,2097152 --field-trial-handle=2340,i,7235552409281435168,16934782181933794124,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
                3⤵
                  PID:6504
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4108,i,4175148961463557323,9646149544035076056,2097152 --field-trial-handle=2340,i,7235552409281435168,16934782181933794124,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
                  3⤵
                    PID:5628
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,9948364939967495162,12806575165393088594,2097152 --field-trial-handle=2340,i,7235552409281435168,16934782181933794124,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:2
                    3⤵
                      PID:5676
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,9894948384424696615,17183815160654694782,524288 --field-trial-handle=2340,i,7235552409281435168,16934782181933794124,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:8
                      3⤵
                        PID:2200
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3524,i,2532269866400005982,7677806149709901583,524288 --field-trial-handle=2340,i,7235552409281435168,16934782181933794124,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:8
                        3⤵
                          PID:6016
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5232,i,7035712374723066635,10161561417493092365,2097152 --field-trial-handle=2340,i,7235552409281435168,16934782181933794124,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:1
                          3⤵
                            PID:1656
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,18012467872414645918,11304389503103640357,524288 --field-trial-handle=2340,i,7235552409281435168,16934782181933794124,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:8
                            3⤵
                              PID:6680
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,1779672926279788952,1379401600324485212,524288 --field-trial-handle=2340,i,7235552409281435168,16934782181933794124,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
                              3⤵
                                PID:6672
                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,14807733854896851658,5755894897543577655,524288 --field-trial-handle=2340,i,7235552409281435168,16934782181933794124,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
                                3⤵
                                  PID:4016
                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,14807733854896851658,5755894897543577655,524288 --field-trial-handle=2340,i,7235552409281435168,16934782181933794124,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
                                  3⤵
                                    PID:5228
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,2432603067737880218,4054107957822774651,524288 --field-trial-handle=2340,i,7235552409281435168,16934782181933794124,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:8
                                    3⤵
                                      PID:5188
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,3369708281051648070,6887103442679067589,524288 --field-trial-handle=2340,i,7235552409281435168,16934782181933794124,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:8
                                      3⤵
                                        PID:6404
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,10598305013465497513,15418347645664751485,524288 --field-trial-handle=2340,i,7235552409281435168,16934782181933794124,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:8
                                        3⤵
                                          PID:4372
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,14499311336212231364,9093231005134198109,524288 --field-trial-handle=2340,i,7235552409281435168,16934782181933794124,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:8
                                          3⤵
                                            PID:5356
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,14644748872969257467,15341908799562673456,524288 --field-trial-handle=2340,i,7235552409281435168,16934782181933794124,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:8
                                            3⤵
                                              PID:6104
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4252,i,15214045243312311326,14221656673834820031,524288 --field-trial-handle=2340,i,7235552409281435168,16934782181933794124,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:8
                                              3⤵
                                                PID:6004
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,8552978195489204072,6633476616830222710,524288 --field-trial-handle=2340,i,7235552409281435168,16934782181933794124,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:8
                                                3⤵
                                                  PID:5352
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,2362312446102451150,5585584980638686019,524288 --field-trial-handle=2340,i,7235552409281435168,16934782181933794124,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
                                                  3⤵
                                                    PID:6428
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,16795331634795745150,13720685717443843184,524288 --field-trial-handle=2340,i,7235552409281435168,16934782181933794124,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:8
                                                    3⤵
                                                      PID:5724
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4568,i,6451773885690679496,10741063903714705072,524288 --field-trial-handle=2340,i,7235552409281435168,16934782181933794124,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
                                                      3⤵
                                                        PID:4592
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,4829791629536202707,10100215056417044581,524288 --field-trial-handle=2340,i,7235552409281435168,16934782181933794124,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:8
                                                        3⤵
                                                          PID:6576
                                                    • C:\Windows\System32\alg.exe
                                                      C:\Windows\System32\alg.exe
                                                      1⤵
                                                      • Executes dropped EXE
                                                      PID:4244
                                                    • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                                                      C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                                                      1⤵
                                                      • Executes dropped EXE
                                                      • Drops file in System32 directory
                                                      • Drops file in Program Files directory
                                                      • Drops file in Windows directory
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:5032
                                                    • C:\Windows\System32\svchost.exe
                                                      C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
                                                      1⤵
                                                        PID:3584
                                                      • C:\Windows\system32\fxssvc.exe
                                                        C:\Windows\system32\fxssvc.exe
                                                        1⤵
                                                        • Executes dropped EXE
                                                        • Modifies data under HKEY_USERS
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:3800
                                                      • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                        1⤵
                                                        • Executes dropped EXE
                                                        PID:2128
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                        1⤵
                                                        • Executes dropped EXE
                                                        PID:4108
                                                      • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                        "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                                                        1⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Program Files directory
                                                        PID:1416
                                                      • C:\Windows\System32\msdtc.exe
                                                        C:\Windows\System32\msdtc.exe
                                                        1⤵
                                                        • Executes dropped EXE
                                                        • Drops file in System32 directory
                                                        • Drops file in Windows directory
                                                        PID:4284
                                                      • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                                                        "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                                                        1⤵
                                                        • Executes dropped EXE
                                                        PID:2808
                                                      • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                                                        C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                                                        1⤵
                                                        • Executes dropped EXE
                                                        PID:3024
                                                      • C:\Windows\SysWow64\perfhost.exe
                                                        C:\Windows\SysWow64\perfhost.exe
                                                        1⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        PID:1212
                                                      • C:\Windows\system32\locator.exe
                                                        C:\Windows\system32\locator.exe
                                                        1⤵
                                                        • Executes dropped EXE
                                                        PID:4228
                                                      • C:\Windows\System32\SensorDataService.exe
                                                        C:\Windows\System32\SensorDataService.exe
                                                        1⤵
                                                        • Executes dropped EXE
                                                        • Checks SCSI registry key(s)
                                                        PID:212
                                                      • C:\Windows\System32\snmptrap.exe
                                                        C:\Windows\System32\snmptrap.exe
                                                        1⤵
                                                        • Executes dropped EXE
                                                        PID:1732
                                                      • C:\Windows\system32\spectrum.exe
                                                        C:\Windows\system32\spectrum.exe
                                                        1⤵
                                                        • Executes dropped EXE
                                                        • Checks SCSI registry key(s)
                                                        PID:5040
                                                      • C:\Windows\System32\OpenSSH\ssh-agent.exe
                                                        C:\Windows\System32\OpenSSH\ssh-agent.exe
                                                        1⤵
                                                        • Executes dropped EXE
                                                        PID:1244
                                                      • C:\Windows\system32\TieringEngineService.exe
                                                        C:\Windows\system32\TieringEngineService.exe
                                                        1⤵
                                                        • Executes dropped EXE
                                                        • Checks processor information in registry
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:5060
                                                      • C:\Windows\system32\svchost.exe
                                                        C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
                                                        1⤵
                                                          PID:3636
                                                        • C:\Windows\system32\AgentService.exe
                                                          C:\Windows\system32\AgentService.exe
                                                          1⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:3524
                                                        • C:\Windows\System32\vds.exe
                                                          C:\Windows\System32\vds.exe
                                                          1⤵
                                                          • Executes dropped EXE
                                                          PID:3872
                                                        • C:\Windows\system32\vssvc.exe
                                                          C:\Windows\system32\vssvc.exe
                                                          1⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:1872
                                                        • C:\Windows\system32\wbengine.exe
                                                          "C:\Windows\system32\wbengine.exe"
                                                          1⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:1956
                                                        • C:\Windows\system32\wbem\WmiApSrv.exe
                                                          C:\Windows\system32\wbem\WmiApSrv.exe
                                                          1⤵
                                                          • Executes dropped EXE
                                                          PID:3736
                                                        • C:\Windows\system32\SearchIndexer.exe
                                                          C:\Windows\system32\SearchIndexer.exe /Embedding
                                                          1⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:3404
                                                          • C:\Windows\system32\SearchProtocolHost.exe
                                                            "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                                            2⤵
                                                            • Modifies data under HKEY_USERS
                                                            PID:4992
                                                          • C:\Windows\system32\SearchFilterHost.exe
                                                            "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
                                                            2⤵
                                                            • Modifies data under HKEY_USERS
                                                            PID:3268
                                                          • C:\Windows\system32\SearchProtocolHost.exe
                                                            "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1788976790-1541110888-1636651838-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1788976790-1541110888-1636651838-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
                                                            2⤵
                                                              PID:1320

                                                          Network

                                                                MITRE ATT&CK Enterprise v16

                                                                Reconnaissance

                                                                Resource Development

                                                                Initial Access

                                                                Execution

                                                                Persistence

                                                                Boot or Logon Autostart Execution

                                                                1
                                                                T1547

                                                                Registry Run Keys / Startup Folder

                                                                1
                                                                T1547.001

                                                                Browser Extensions

                                                                1
                                                                T1176

                                                                Privilege Escalation

                                                                Boot or Logon Autostart Execution

                                                                1
                                                                T1547

                                                                Registry Run Keys / Startup Folder

                                                                1
                                                                T1547.001

                                                                Defense Evasion

                                                                Modify Registry

                                                                3
                                                                T1112

                                                                Credential Access

                                                                Credentials from Password Stores

                                                                1
                                                                T1555

                                                                Credentials from Web Browsers

                                                                1
                                                                T1555.003

                                                                Unsecured Credentials

                                                                1
                                                                T1552

                                                                Credentials In Files

                                                                1
                                                                T1552.001

                                                                Discovery

                                                                Browser Information Discovery

                                                                1
                                                                T1217

                                                                Peripheral Device Discovery

                                                                1
                                                                T1120

                                                                Query Registry

                                                                5
                                                                T1012

                                                                System Information Discovery

                                                                6
                                                                T1082

                                                                System Location Discovery

                                                                1
                                                                T1614

                                                                System Language Discovery

                                                                1
                                                                T1614.001

                                                                System Time Discovery

                                                                1
                                                                T1124

                                                                Lateral Movement

                                                                Collection

                                                                Data from Local System

                                                                1
                                                                T1005

                                                                Command and Control

                                                                Exfiltration

                                                                Impact

                                                                Replay Monitor

                                                                Loading Replay Monitor...

                                                                Downloads

                                                                elevation_service.exe
                                                                • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                • Size 2.7MB
                                                                • SHA256 222221d83c641e9fe632cf43fc747dbde8b5169eef107607b69870f7777859fe
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                maintenanceservice.exe
                                                                • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                • Size 1.6MB
                                                                • SHA256 51f6a4ba69f645af141fda854775c8dfaf1f3ff2ec0d9c81337ec19829b76d3f
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                OSE.EXE
                                                                • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                                                                • Size 1.6MB
                                                                • SHA256 bbfff7469b2764246290ed2a3bb3294921610956cddcd7949cdc00f9dd0aa716
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                elevation_service.exe
                                                                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                • Size 2.8MB
                                                                • SHA256 5f516be37b4bc15b4798c0c7387d7a29d08785e12de0c30306c5adf52d0e256d
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                firefox.exe
                                                                • Path C:\Program Files\Mozilla Firefox\firefox.exe
                                                                • Size 1.2MB
                                                                • SHA256 c9838a6d4f6262218623676c2c02a60249a0a92f9589921971f63594d62e8ae2
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                manifest.json
                                                                • Path C:\Program Files\chrome_Unpacker_BeginUnzipping5700_112835492\manifest.json
                                                                • Size 43B
                                                                • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                manifest.json
                                                                • Path C:\Program Files\chrome_Unpacker_BeginUnzipping5700_1725483706\manifest.json
                                                                • Size 135B
                                                                • SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                blocklist
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                                • Size 105KB
                                                                • SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                protocols.json
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
                                                                • Size 3KB
                                                                • SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                settings.dat
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                • Size 280B
                                                                • SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                settings.dat
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                • Size 280B
                                                                • SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                BookmarkMergedSurfaceOrdering
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                • Size 6B
                                                                • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                the-real-index
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                • Size 3KB
                                                                • SHA256 6045499ddeaf556819d619a619282c877ba5cc8b5f37cdb1d0e0e96870c17a47
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                the-real-index~RFe5919e7.TMP
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5919e7.TMP
                                                                • Size 3KB
                                                                • SHA256 a2042c5c4825e8d0180f1e0e7653edf81ad4e254605b9ccadd2eb3f88cfbf38e
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                SiteList-Enterprise.json
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                • Size 2B
                                                                • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                Edge Profile.ico
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                • Size 70KB
                                                                • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                HubApps
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
                                                                • Size 106KB
                                                                • SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Network Persistent State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                • Size 2KB
                                                                • SHA256 38a14c6fd1fe0aa1fd8e45c89aa819b37f926461528aa27bc79e4a97d4ac9533
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                Network Persistent State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                • Size 111B
                                                                • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                SCT Auditing Pending Reports
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                • Size 2B
                                                                • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                Preferences
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                • Size 13KB
                                                                • SHA256 f586b2140b5647da1fd70ba4fe33873641b28e2df6a3e49ee80a8b78795db431
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Secure Preferences
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                • Size 35KB
                                                                • SHA256 6a28d4f4bc513b638807a2e15bd96cad2bd40796f6131d8c5c8e8080ec7c246f
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                sync_diagnostic.log
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                • Size 4KB
                                                                • SHA256 04ea6f172efa3180c437d45245cac3fe252180514acd6158283b4ce12f0ca2f9
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                OperationConfig
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                • Size 22KB
                                                                • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                OperationConfig~RFe59b01c.TMP
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59b01c.TMP
                                                                • Size 3KB
                                                                • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                Local State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                • Size 15KB
                                                                • SHA256 90879a4dc4f78cf87f82a58373ceeaf7052ee82db25c947e463f2aaa779c6047
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Local State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                • Size 25KB
                                                                • SHA256 19a4d84469572783d3f41fc5042e004e09aeccc7ee1a36ee1b47f9a665da5159
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Local State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                • Size 15KB
                                                                • SHA256 1a91fa4566c3176ed20fd6d109d7d3367432d693aa7af273b14968d07a958994
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Local State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                • Size 8KB
                                                                • SHA256 d85883e479c9a8a7418ffecae7eee9ec739742029fcf01d1d5e6d4254228d23a
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Local State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                • Size 9KB
                                                                • SHA256 0f57a323e8ee2e20715c9b14df252eb369b897e699a423af2fada12e3df020a2
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                metadata.json
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                • Size 132B
                                                                • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                metadata.json
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                • Size 13B
                                                                • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                • Size 2KB
                                                                • SHA256 ffc1b0613aa3c8151b8d41b3a456fa0ccc1d20f628c741c381af5afd6c303125
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                03100235E7AEBB25C597DD91664A8F544DDFC529
                                                                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nxqdpovk.default-release\cache2\entries\03100235E7AEBB25C597DD91664A8F544DDFC529
                                                                • Size 13KB
                                                                • SHA256 3709e5a3ff7db17505a57140edec7646a9f17240f0a5bdb44c15648d1ded16e2
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                9512A4488B00CC053350DAC32D417B4A35C11513
                                                                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nxqdpovk.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
                                                                • Size 13KB
                                                                • SHA256 f055337781e5c7a75e37f6d976b36ab541c876949d2cf456fb7c5039b964d5c3
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                a7ff657a-3005-4e88-803f-46b1b48ca713.tmp
                                                                • Path C:\Users\Admin\AppData\Local\Temp\a7ff657a-3005-4e88-803f-46b1b48ca713.tmp
                                                                • Size 1B
                                                                • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                e5752937-21ac-4b01-bc5c-a214876b3c09.tmp
                                                                • Path C:\Users\Admin\AppData\Local\Temp\e5752937-21ac-4b01-bc5c-a214876b3c09.tmp
                                                                • Size 10KB
                                                                • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                762f1382-6f79-495c-b798-1d3b74564b7e.tmp
                                                                • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5700_513311862\762f1382-6f79-495c-b798-1d3b74564b7e.tmp
                                                                • Size 152KB
                                                                • SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                content_new.js
                                                                • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5700_779314301\CRX_INSTALL\content_new.js
                                                                • Size 10KB
                                                                • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                tmpaddon
                                                                • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                                • Size 502KB
                                                                • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                tmpaddon
                                                                • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                                • Size 11KB
                                                                • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                compatibility.ini
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\compatibility.ini
                                                                • Size 198B
                                                                • SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                data.safe.tmp
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
                                                                • Size 5KB
                                                                • SHA256 2aa230a03642e287b4eda6346856fbde6e6e55d4df60f9a13fe1c3adee6f9f58
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                data.safe.tmp
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
                                                                • Size 29KB
                                                                • SHA256 840c5094466e2b29821276f53d28f722363a2bca4c72333549d974e8a05d7d8e
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                data.safe.tmp
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
                                                                • Size 6KB
                                                                • SHA256 8d9547722ab4f0dc2d5b00d3eade5f8f2a93b105a0eb6dd85c4df8edd7cca151
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                data.safe.tmp
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
                                                                • Size 29KB
                                                                • SHA256 6185ed19a75b39a3f36cd4a018976cabb498ef319baccd92e824b77b23735909
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                data.safe.tmp
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
                                                                • Size 29KB
                                                                • SHA256 d74ef09139ae71252e551a1272dcb628cbb08cd7b4dbea390d42b79f8ae21cda
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                events
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\events\events
                                                                • Size 1KB
                                                                • SHA256 f31945c71cf505de132a820d51a179ab567e5d3c0bcbcaed986a03e3e1099345
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                00723132-e634-4b5b-b307-5b920ddcfeef
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\00723132-e634-4b5b-b307-5b920ddcfeef
                                                                • Size 235B
                                                                • SHA256 d8dca23f9fa142f497c140c9f51b7ef234eb1ffbb7c7caef1a5eb2cd8389b058
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                8c1fe401-e339-4db3-b4ce-013cfd64bf7e
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\8c1fe401-e339-4db3-b4ce-013cfd64bf7e
                                                                • Size 235B
                                                                • SHA256 5553fad6e3a8cbff4fe30bc470361dd53b24e0ce77f1ab042eadb263c24d07de
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                c5769d92-cb33-4bad-ac5f-0fea249f549d
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\c5769d92-cb33-4bad-ac5f-0fea249f549d
                                                                • Size 15KB
                                                                • SHA256 ccd6342fec5751ef5731856c4bf5b7d9a1f6c143926cb586aedae7a1140fd377
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                c9e8b46e-7392-4953-82e6-7661c4eadb17
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\c9e8b46e-7392-4953-82e6-7661c4eadb17
                                                                • Size 2KB
                                                                • SHA256 91f5e23be0c1ed3cb97491a3f465fde6f14bd58562b30e9999853610ea9cb46d
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                ca35e95d-9594-450a-a28c-deb6a46c28d6
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\ca35e95d-9594-450a-a28c-deb6a46c28d6
                                                                • Size 886B
                                                                • SHA256 19fbf0afc8451d974ad8d6516f596bf90bed418dfe7420c676d051cdc00a0d60
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                e792b634-4b21-4d73-ab61-af4de202fc63
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\e792b634-4b21-4d73-ab61-af4de202fc63
                                                                • Size 883B
                                                                • SHA256 5407b5d5d72c5e26eae239aaab356f26858716c4f608cfbd4dea7423cd791103
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                extensions.json
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\extensions.json
                                                                • Size 16KB
                                                                • SHA256 ea8f84e75031004836720f911c968e33bd771e6e1d261698b79f8f54b97bae57
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                gmpopenh264.dll
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                                                                • Size 1.1MB
                                                                • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                gmpopenh264.info
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                                                                • Size 116B
                                                                • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                manifest.json
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
                                                                • Size 1002B
                                                                • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                widevinecdm.dll
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
                                                                • Size 21.6MB
                                                                • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                prefs-1.js
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs-1.js
                                                                • Size 6KB
                                                                • SHA256 7d57ad0769e15463890e4ea9bd6f5c7e4c8c17ec567b0d94f24856f8632c7123
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                prefs-1.js
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs-1.js
                                                                • Size 7KB
                                                                • SHA256 8bec59803439a1443d4ddf0eb6749b1344c16816f30fc9c7e80b7695ea9896e1
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                prefs-1.js
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs-1.js
                                                                • Size 12KB
                                                                • SHA256 780b706266a98212467e9c56d49603114997707e9243efb98315497d2b029ed7
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                prefs.js
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs.js
                                                                • Size 6KB
                                                                • SHA256 574930d86eb44c0d6d5baed4a626887a5c153d97b48ec2282528670003705c0c
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                prefs.js
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs.js
                                                                • Size 6KB
                                                                • SHA256 2577cd2af180d4cd3832b1055747acb15e876c2bd12e477635d09611e6984123
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                recovery.baklz4
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\sessionstore-backups\recovery.baklz4
                                                                • Size 4KB
                                                                • SHA256 9e0c647f752b68e0308a6798f60a3e1581ef532121ea8a67515454ad806432e1
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                recovery.jsonlz4
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\sessionstore-backups\recovery.jsonlz4
                                                                • Size 4KB
                                                                • SHA256 c61a0216765125ba2d9e2d41759f6986cab036f76d3200371ef50dc51099939d
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                3870112724rsegmnoittet-es.sqlite
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                • Size 6.4MB
                                                                • SHA256 e0db5c3433fb918668a65e3445388b193c783a6c19cd7225bd6c1cead48f4820
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                perfhost.exe
                                                                • Path C:\Windows\SysWOW64\perfhost.exe
                                                                • Size 1.4MB
                                                                • SHA256 31f1a7c2c1670cb9c9c100d7536e5cb8c43b785ced82165e99f4efa7c7f971fa
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                AgentService.exe
                                                                • Path C:\Windows\System32\AgentService.exe
                                                                • Size 1.7MB
                                                                • SHA256 448b99936cf7ee5c0cc7234136b103adc59bde5e1e3c97719a45c8da271c3648
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                DiagnosticsHub.StandardCollector.Service.exe
                                                                • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                                                                • Size 1.4MB
                                                                • SHA256 5c28be7737be0e274e739f97554301afb4aaf58f3729f8855dc8c8385912113b
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                FXSSVC.exe
                                                                • Path C:\Windows\System32\FXSSVC.exe
                                                                • Size 1.2MB
                                                                • SHA256 35b364fc2ec85b5217b8bc25069b0d42e5c7b99fb910ce505aa3b66cf653ba19
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Locator.exe
                                                                • Path C:\Windows\System32\Locator.exe
                                                                • Size 1.4MB
                                                                • SHA256 5fded27830f6dbaac027d0b645f14e6edde0193cb903f26f0178520e0dc30645
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                ssh-agent.exe
                                                                • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                                                                • Size 1.7MB
                                                                • SHA256 04449b3783a4a9d345d837e0b08ac4dc1ff2277c24f5ad5a2b600106dd0399db
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                PerceptionSimulationService.exe
                                                                • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                                                                • Size 1.5MB
                                                                • SHA256 ef3e5b276ec3fff1cf65c4df1285269b83061a108fae4e0180305017b00c40c6
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                SearchIndexer.exe
                                                                • Path C:\Windows\System32\SearchIndexer.exe
                                                                • Size 1.4MB
                                                                • SHA256 24bcf69afa241233bd6c51d19298d58e0a81d0e20061a6ed77ff0df8f692ec30
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                SensorDataService.exe
                                                                • Path C:\Windows\System32\SensorDataService.exe
                                                                • Size 1.8MB
                                                                • SHA256 4b24d420c34eb6aa05a6e11c970becf4318c882a196b4ee2901f4989309635cc
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Spectrum.exe
                                                                • Path C:\Windows\System32\Spectrum.exe
                                                                • Size 1.4MB
                                                                • SHA256 8c0c73b5643967bdddbe20c8ed9a2ebf1fa3ed57cd3756f62d8db9376b20e29d
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                TieringEngineService.exe
                                                                • Path C:\Windows\System32\TieringEngineService.exe
                                                                • Size 1.7MB
                                                                • SHA256 85721a7711b1fd112ee9e21e8e04ad287eb26ab9502b69ee06a0bab5aeaa16ba
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                VSSVC.exe
                                                                • Path C:\Windows\System32\VSSVC.exe
                                                                • Size 2.0MB
                                                                • SHA256 f0f6d7f960c215ebb12c7b5f7c25f29c64cd243c43a6eab85024c4712f6a87fa
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                alg.exe
                                                                • Path C:\Windows\System32\alg.exe
                                                                • Size 1.4MB
                                                                • SHA256 894d2528839a000279d760031f8c0c57c024c7864478ca0f14d9317e73bae2bc
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                msdtc.exe
                                                                • Path C:\Windows\System32\msdtc.exe
                                                                • Size 1.5MB
                                                                • SHA256 61992babb8b6014e656b46672c2c58975447c65211b32442da31179e727138f4
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                snmptrap.exe
                                                                • Path C:\Windows\System32\snmptrap.exe
                                                                • Size 1.4MB
                                                                • SHA256 c817242163d858e324b5afa28e45becc42a41db43a53d0483e6712ad07f242d9
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                vds.exe
                                                                • Path C:\Windows\System32\vds.exe
                                                                • Size 1.3MB
                                                                • SHA256 be78f93d3361375ec8f6e2a283c2d164a77e9c8345bb7d5556adeb1ba5c599f8
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                WmiApSrv.exe
                                                                • Path C:\Windows\System32\wbem\WmiApSrv.exe
                                                                • Size 1.6MB
                                                                • SHA256 c0e312352535c845861a9a1d899994eafa748f0bf6544ab9eb8285f7a15d0bcb
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                wbengine.exe
                                                                • Path C:\Windows\System32\wbengine.exe
                                                                • Size 2.1MB
                                                                • SHA256 39aa577518aed885c0d16e690070ba90acae2acf3f4cab20c1e9a803a50edeae
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                AppVClient.exe
                                                                • Path C:\Windows\system32\AppVClient.exe
                                                                • Size 1.3MB
                                                                • SHA256 d70e6b340675249e303a8ea5b29b81f15365493f7c15598de311ca0a8312451d
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                SgrmBroker.exe
                                                                • Path C:\Windows\system32\SgrmBroker.exe
                                                                • Size 1.7MB
                                                                • SHA256 2232cd7605d676b878a4474dcc390aa5e45db3f547005ba06408524b174bd739
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                msiexec.exe
                                                                • Path C:\Windows\system32\msiexec.exe
                                                                • Size 1.4MB
                                                                • SHA256 5e0439a3388c79735ef78b0f8962a89e0612becb0b433bffda9acc9819e60805
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                memory/212-114-0x0000000140000000-0x00000001401D7000-memory.dmp
                                                                Download

                                                                memory/212-171-0x0000000140000000-0x00000001401D7000-memory.dmp
                                                                Download

                                                                memory/212-369-0x0000000140000000-0x00000001401D7000-memory.dmp
                                                                Download

                                                                memory/1212-108-0x0000000000400000-0x0000000000563000-memory.dmp
                                                                Download

                                                                memory/1212-99-0x0000000000710000-0x0000000000776000-memory.dmp
                                                                Download

                                                                memory/1212-104-0x0000000000710000-0x0000000000776000-memory.dmp
                                                                Download

                                                                memory/1212-163-0x0000000000400000-0x0000000000563000-memory.dmp
                                                                Download

                                                                memory/1244-134-0x0000000000720000-0x0000000000780000-memory.dmp
                                                                Download

                                                                memory/1244-144-0x0000000140000000-0x00000001401CE000-memory.dmp
                                                                Download

                                                                memory/1244-360-0x0000000140000000-0x00000001401CE000-memory.dmp
                                                                Download

                                                                memory/1244-140-0x0000000000720000-0x0000000000780000-memory.dmp
                                                                Download

                                                                memory/1416-53-0x0000000001510000-0x0000000001570000-memory.dmp
                                                                Download

                                                                memory/1416-59-0x0000000001510000-0x0000000001570000-memory.dmp
                                                                Download

                                                                memory/1416-67-0x0000000140000000-0x00000001401A1000-memory.dmp
                                                                Download

                                                                memory/1416-64-0x0000000140000000-0x00000001401A1000-memory.dmp
                                                                Download

                                                                memory/1416-65-0x0000000001510000-0x0000000001570000-memory.dmp
                                                                Download

                                                                memory/1732-119-0x0000000140000000-0x0000000140162000-memory.dmp
                                                                Download

                                                                memory/1732-276-0x0000000140000000-0x0000000140162000-memory.dmp
                                                                Download

                                                                memory/1872-159-0x0000000140000000-0x00000001401FC000-memory.dmp
                                                                Download

                                                                memory/1872-412-0x0000000140000000-0x00000001401FC000-memory.dmp
                                                                Download

                                                                memory/1956-417-0x0000000140000000-0x0000000140216000-memory.dmp
                                                                Download

                                                                memory/1956-164-0x0000000140000000-0x0000000140216000-memory.dmp
                                                                Download

                                                                memory/2128-118-0x0000000140000000-0x00000001402E9000-memory.dmp
                                                                Download

                                                                memory/2128-37-0x0000000000540000-0x00000000005A0000-memory.dmp
                                                                Download

                                                                memory/2128-31-0x0000000000540000-0x00000000005A0000-memory.dmp
                                                                Download

                                                                memory/2128-50-0x0000000140000000-0x00000001402E9000-memory.dmp
                                                                Download

                                                                memory/2808-80-0x0000000000420000-0x0000000000480000-memory.dmp
                                                                Download

                                                                memory/2808-74-0x0000000000420000-0x0000000000480000-memory.dmp
                                                                Download

                                                                memory/2808-83-0x0000000140000000-0x000000014019C000-memory.dmp
                                                                Download

                                                                memory/2808-155-0x0000000140000000-0x000000014019C000-memory.dmp
                                                                Download

                                                                memory/3024-158-0x0000000140000000-0x0000000140177000-memory.dmp
                                                                Download

                                                                memory/3024-88-0x0000000000B40000-0x0000000000BA0000-memory.dmp
                                                                Download

                                                                memory/3024-94-0x0000000000B40000-0x0000000000BA0000-memory.dmp
                                                                Download

                                                                memory/3024-97-0x0000000140000000-0x0000000140177000-memory.dmp
                                                                Download

                                                                memory/3268-380-0x00000228217A0000-0x00000228217B0000-memory.dmp
                                                                Download

                                                                memory/3268-382-0x00000228217A0000-0x00000228217B0000-memory.dmp
                                                                Download

                                                                memory/3268-374-0x00000228217A0000-0x00000228217B0000-memory.dmp
                                                                Download

                                                                memory/3268-373-0x00000228217A0000-0x00000228217B0000-memory.dmp
                                                                Download

                                                                memory/3268-371-0x00000228217A0000-0x00000228217B0000-memory.dmp
                                                                Download

                                                                memory/3268-370-0x00000228217A0000-0x00000228217B0000-memory.dmp
                                                                Download

                                                                memory/3268-378-0x00000228217A0000-0x00000228217B0000-memory.dmp
                                                                Download

                                                                memory/3268-377-0x00000228217A0000-0x00000228217B0000-memory.dmp
                                                                Download

                                                                memory/3268-375-0x00000228217A0000-0x00000228217B0000-memory.dmp
                                                                Download

                                                                memory/3268-381-0x00000228217A0000-0x00000228217B0000-memory.dmp
                                                                Download

                                                                memory/3268-376-0x00000228217A0000-0x00000228217B0000-memory.dmp
                                                                Download

                                                                memory/3268-384-0x00000228217A0000-0x00000228217B0000-memory.dmp
                                                                Download

                                                                memory/3268-372-0x00000228217A0000-0x00000228217B0000-memory.dmp
                                                                Download

                                                                memory/3268-368-0x00000228217A0000-0x00000228217B0000-memory.dmp
                                                                Download

                                                                memory/3268-365-0x00000228217A0000-0x00000228217B0000-memory.dmp
                                                                Download

                                                                memory/3268-366-0x00000228217A0000-0x00000228217B0000-memory.dmp
                                                                Download

                                                                memory/3268-367-0x00000228217A0000-0x00000228217B0000-memory.dmp
                                                                Download

                                                                memory/3268-364-0x00000228217A0000-0x00000228217B0000-memory.dmp
                                                                Download

                                                                memory/3268-363-0x00000228217A0000-0x00000228217B0000-memory.dmp
                                                                Download

                                                                memory/3268-362-0x00000228217A0000-0x00000228217B0000-memory.dmp
                                                                Download

                                                                memory/3268-390-0x00000228217A0000-0x00000228217B0000-memory.dmp
                                                                Download

                                                                memory/3268-397-0x00000228217A0000-0x00000228217B0000-memory.dmp
                                                                Download

                                                                memory/3268-394-0x00000228217A0000-0x00000228217B0000-memory.dmp
                                                                Download

                                                                memory/3268-393-0x00000228217A0000-0x00000228217B0000-memory.dmp
                                                                Download

                                                                memory/3268-383-0x00000228217A0000-0x00000228217B0000-memory.dmp
                                                                Download

                                                                memory/3268-400-0x00000228217A0000-0x00000228217B0000-memory.dmp
                                                                Download

                                                                memory/3268-385-0x00000228217A0000-0x00000228217B0000-memory.dmp
                                                                Download

                                                                memory/3268-379-0x00000228217A0000-0x00000228217B0000-memory.dmp
                                                                Download

                                                                memory/3268-386-0x00000228217A0000-0x00000228217B0000-memory.dmp
                                                                Download

                                                                memory/3268-387-0x00000228217A0000-0x00000228217B0000-memory.dmp
                                                                Download

                                                                memory/3268-403-0x00000228217A0000-0x00000228217B0000-memory.dmp
                                                                Download

                                                                memory/3268-402-0x00000228217A0000-0x00000228217B0000-memory.dmp
                                                                Download

                                                                memory/3268-388-0x00000228217A0000-0x00000228217B0000-memory.dmp
                                                                Download

                                                                memory/3268-389-0x00000228217A0000-0x00000228217B0000-memory.dmp
                                                                Download

                                                                memory/3268-391-0x00000228217A0000-0x00000228217B0000-memory.dmp
                                                                Download

                                                                memory/3268-392-0x00000228217A0000-0x00000228217B0000-memory.dmp
                                                                Download

                                                                memory/3268-395-0x00000228217A0000-0x00000228217B0000-memory.dmp
                                                                Download

                                                                memory/3268-396-0x00000228217A0000-0x00000228217B0000-memory.dmp
                                                                Download

                                                                memory/3268-401-0x00000228217A0000-0x00000228217B0000-memory.dmp
                                                                Download

                                                                memory/3268-399-0x00000228217A0000-0x00000228217B0000-memory.dmp
                                                                Download

                                                                memory/3268-398-0x00000228217A0000-0x00000228217B0000-memory.dmp
                                                                Download

                                                                memory/3404-172-0x0000000140000000-0x0000000140179000-memory.dmp
                                                                Download

                                                                memory/3404-451-0x0000000140000000-0x0000000140179000-memory.dmp
                                                                Download

                                                                memory/3404-205-0x0000000001A30000-0x0000000001A40000-memory.dmp
                                                                Download

                                                                memory/3404-189-0x0000000001780000-0x0000000001790000-memory.dmp
                                                                Download

                                                                memory/3404-269-0x0000000009E70000-0x0000000009E78000-memory.dmp
                                                                Download

                                                                memory/3524-150-0x0000000140000000-0x00000001401C0000-memory.dmp
                                                                Download

                                                                memory/3524-152-0x0000000140000000-0x00000001401C0000-memory.dmp
                                                                Download

                                                                memory/3736-418-0x0000000140000000-0x0000000140192000-memory.dmp
                                                                Download

                                                                memory/3736-168-0x0000000140000000-0x0000000140192000-memory.dmp
                                                                Download

                                                                memory/3800-29-0x0000000140000000-0x0000000140135000-memory.dmp
                                                                Download

                                                                memory/3800-68-0x0000000140000000-0x0000000140135000-memory.dmp
                                                                Download

                                                                memory/3872-411-0x0000000140000000-0x0000000140147000-memory.dmp
                                                                Download

                                                                memory/3872-156-0x0000000140000000-0x0000000140147000-memory.dmp
                                                                Download

                                                                memory/3896-0-0x0000000003120000-0x0000000003186000-memory.dmp
                                                                Download

                                                                memory/3896-5-0x0000000003120000-0x0000000003186000-memory.dmp
                                                                Download

                                                                memory/3896-63-0x0000000000400000-0x0000000000A61000-memory.dmp
                                                                Download

                                                                memory/3896-7-0x0000000000400000-0x0000000000A61000-memory.dmp
                                                                Download

                                                                memory/4108-983-0x0000000140000000-0x00000001402D4000-memory.dmp
                                                                Download

                                                                memory/4108-41-0x0000000000890000-0x00000000008F0000-memory.dmp
                                                                Download

                                                                memory/4108-47-0x0000000000890000-0x00000000008F0000-memory.dmp
                                                                Download

                                                                memory/4108-143-0x0000000140000000-0x00000001402D4000-memory.dmp
                                                                Download

                                                                memory/4108-51-0x0000000140000000-0x00000001402D4000-memory.dmp
                                                                Download

                                                                memory/4228-167-0x0000000140000000-0x0000000140161000-memory.dmp
                                                                Download

                                                                memory/4228-112-0x0000000140000000-0x0000000140161000-memory.dmp
                                                                Download

                                                                memory/4244-11-0x0000000140000000-0x0000000140176000-memory.dmp
                                                                Download

                                                                memory/4244-107-0x0000000140000000-0x0000000140176000-memory.dmp
                                                                Download

                                                                memory/4284-70-0x0000000140000000-0x0000000140185000-memory.dmp
                                                                Download

                                                                memory/4284-149-0x0000000140000000-0x0000000140185000-memory.dmp
                                                                Download

                                                                memory/5032-15-0x00000000006B0000-0x0000000000710000-memory.dmp
                                                                Download

                                                                memory/5032-111-0x0000000140000000-0x0000000140175000-memory.dmp
                                                                Download

                                                                memory/5032-23-0x0000000140000000-0x0000000140175000-memory.dmp
                                                                Download

                                                                memory/5032-24-0x00000000006B0000-0x0000000000710000-memory.dmp
                                                                Download

                                                                memory/5040-122-0x0000000000700000-0x0000000000760000-memory.dmp
                                                                Download

                                                                memory/5040-345-0x0000000140000000-0x0000000140169000-memory.dmp
                                                                Download

                                                                memory/5040-130-0x0000000140000000-0x0000000140169000-memory.dmp
                                                                Download

                                                                memory/5040-128-0x0000000000700000-0x0000000000760000-memory.dmp
                                                                Download

                                                                memory/5060-361-0x0000000140000000-0x00000001401AE000-memory.dmp
                                                                Download

                                                                memory/5060-147-0x0000000140000000-0x00000001401AE000-memory.dmp
                                                                Download