Overview

overview

10

Static

static

10

2026-07-01...op.exe

windows10-2004-x64

9

2026-07-01...op.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    87s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/07/2026, 07:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-01_cc8791d946fc80de9442ec4a06fb9e19_darkgate_elex_glassworm_remcos_stop.exe
  • Size 6.3MB
  • Sample260701-jf7bmsg14n
  • SHA256 89ccd69dab4df59c9f25bbf1dae18a299f77182604173e7c8df704a54ee90928
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwaredefense_evasiondiscoverypersistencephishingspywarestealertrojan

Malware Config

Signatures

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 3 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 3 IoCs
  • A potential corporate email address has been identified in the URL: [email protected]
    phishing
  • Executes dropped EXE 23 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Drops desktop.ini file(s) 3 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • System Binary Proxy Execution: Verclsid 1 TTPs 1 IoCs

    Adversaries may abuse Verclsid to proxy execution of malicious code.

    defense_evasion
  • Drops file in System32 directory 41 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 36 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 23 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Control Panel 1 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 22 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 19 IoCs
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-01_cc8791d946fc80de9442ec4a06fb9e19_darkgate_elex_glassworm_remcos_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-01_cc8791d946fc80de9442ec4a06fb9e19_darkgate_elex_glassworm_remcos_stop.exe"
    1⤵
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Installs/modifies Browser Helper Object
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3156
    • C:\Windows\system32\regsvr32.exe
      C:\Windows\Sysnative\regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
      2⤵
        PID:3320
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2004
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
          3⤵
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Drops desktop.ini file(s)
          • Checks processor information in registry
          • Modifies Control Panel
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3404
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1996 -prefsLen 27097 -prefMapHandle 2000 -prefMapSize 270279 -ipcHandle 2068 -initialChannelId {511241c3-c29e-40d9-abc1-7a5fe88a4803} -parentPid 3404 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3404" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
            4⤵
            • Executes dropped EXE
            PID:1348
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2468 -prefsLen 27133 -prefMapHandle 2472 -prefMapSize 270279 -ipcHandle 2480 -initialChannelId {609f909a-d619-4856-ac7e-bc1c900f4c86} -parentPid 3404 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3404" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
            4⤵
            • Executes dropped EXE
            PID:1360
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3892 -prefsLen 25164 -prefMapHandle 3896 -prefMapSize 270279 -jsInitHandle 3900 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3908 -initialChannelId {8bf5053f-abe3-4d14-8224-3e34651d39eb} -parentPid 3404 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3404" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:4504
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4084 -prefsLen 27274 -prefMapHandle 4088 -prefMapSize 270279 -ipcHandle 4156 -initialChannelId {e1961ada-6d6b-4cd5-881b-9c5d20eef56a} -parentPid 3404 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3404" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
            4⤵
            • Executes dropped EXE
            PID:5396
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3180 -prefsLen 34773 -prefMapHandle 2988 -prefMapSize 270279 -jsInitHandle 2992 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3204 -initialChannelId {50084ce8-4819-4dc1-b581-ab9ce136c134} -parentPid 3404 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3404" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:1852
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5040 -prefsLen 35010 -prefMapHandle 3420 -prefMapSize 270279 -ipcHandle 5052 -initialChannelId {b5397d0f-1a5c-41c4-87d8-c2705f4c7056} -parentPid 3404 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3404" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:360
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3192 -prefsLen 35062 -prefMapHandle 1652 -prefMapSize 270279 -jsInitHandle 1668 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3196 -initialChannelId {1a8926ec-a631-4b05-b994-ab0e2b7ceb2c} -parentPid 3404 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3404" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:4576
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5620 -prefsLen 32952 -prefMapHandle 5692 -prefMapSize 270279 -jsInitHandle 1652 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5720 -initialChannelId {ce1328b0-b569-4052-9190-9960d0eaab9f} -parentPid 3404 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3404" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:4116
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5732 -prefsLen 32952 -prefMapHandle 5736 -prefMapSize 270279 -jsInitHandle 5740 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5780 -initialChannelId {1eebecf9-978e-430f-9241-1ca012c282e4} -parentPid 3404 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3404" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:5388
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5752 -prefsLen 32952 -prefMapHandle 5756 -prefMapSize 270279 -jsInitHandle 5760 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5788 -initialChannelId {771ed60b-97f5-4e4c-bf88-0a449093cd04} -parentPid 3404 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3404" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:6060
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2568
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:3712
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:4892
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:5656
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" http://www.internetdownloadmanager.com/download2.html
        2⤵
        • Drops file in Windows directory
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:3532
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x308,0x7ffa273ec188,0x7ffa273ec194,0x7ffa273ec1a0
          3⤵
            PID:5860
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,4555055944539475472,1606567637855879314,262144 --field-trial-handle=2216,i,18195715470847358529,1474999473688543194,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:2
            3⤵
              PID:5772
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,8298712556986158964,3546304420431028749,524288 --field-trial-handle=2216,i,18195715470847358529,1474999473688543194,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:11
              3⤵
              • System Time Discovery
              PID:5852
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,15708488121903444114,13141569413650645448,524288 --field-trial-handle=2216,i,18195715470847358529,1474999473688543194,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:13
              3⤵
                PID:5904
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3532,i,8374859487724927138,6153538389486882477,2097152 --field-trial-handle=2216,i,18195715470847358529,1474999473688543194,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
                3⤵
                  PID:4964
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3536,i,3418067059798438372,13898478731037021750,2097152 --field-trial-handle=2216,i,18195715470847358529,1474999473688543194,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
                  3⤵
                    PID:4644
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,12171941033499927706,14510179420260226275,2097152 --field-trial-handle=2216,i,18195715470847358529,1474999473688543194,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:1
                    3⤵
                      PID:3516
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,14020849956087365071,253535050353365237,2097152 --field-trial-handle=2216,i,18195715470847358529,1474999473688543194,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:9
                      3⤵
                        PID:2580
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,16691230553781436939,8699706896758498471,524288 --field-trial-handle=2216,i,18195715470847358529,1474999473688543194,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14
                        3⤵
                          PID:3284
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5264,i,4818379898196015630,598215723492973820,2097152 --field-trial-handle=2216,i,18195715470847358529,1474999473688543194,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:1
                          3⤵
                            PID:6308
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3812,i,11444594263594413378,13356433073902410377,524288 --field-trial-handle=2216,i,18195715470847358529,1474999473688543194,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:14
                            3⤵
                              PID:6708
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3576,i,7197941941586597907,15752065586060638027,524288 --field-trial-handle=2216,i,18195715470847358529,1474999473688543194,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
                              3⤵
                                PID:6700
                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,2738932947285946435,4762596296994580933,524288 --field-trial-handle=2216,i,18195715470847358529,1474999473688543194,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
                                3⤵
                                  PID:6824
                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,2738932947285946435,4762596296994580933,524288 --field-trial-handle=2216,i,18195715470847358529,1474999473688543194,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
                                  3⤵
                                    PID:6832
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,10876478641100024007,12596177606002216011,524288 --field-trial-handle=2216,i,18195715470847358529,1474999473688543194,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
                                    3⤵
                                      PID:7040
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,5907633636327988806,5608576409894898297,524288 --field-trial-handle=2216,i,18195715470847358529,1474999473688543194,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
                                      3⤵
                                        PID:2472
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4952,i,16540234853150095744,2919318290005692636,2097152 --field-trial-handle=2216,i,18195715470847358529,1474999473688543194,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:1
                                        3⤵
                                          PID:6252
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,13818682637544223466,7100649974481444492,524288 --field-trial-handle=2216,i,18195715470847358529,1474999473688543194,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:14
                                          3⤵
                                            PID:6216
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,7727623674776183373,2561513444772995928,524288 --field-trial-handle=2216,i,18195715470847358529,1474999473688543194,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:14
                                            3⤵
                                              PID:6940
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,646681950884362752,13073720448845059310,524288 --field-trial-handle=2216,i,18195715470847358529,1474999473688543194,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:14
                                              3⤵
                                                PID:832
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,18442045819134009613,9485848255730568014,524288 --field-trial-handle=2216,i,18195715470847358529,1474999473688543194,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:14
                                                3⤵
                                                  PID:1140
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,8575922241329469411,8745849323888339479,524288 --field-trial-handle=2216,i,18195715470847358529,1474999473688543194,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:14
                                                  3⤵
                                                    PID:5924
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6944,i,11605804601915227010,3985017292408711370,262144 --field-trial-handle=2216,i,18195715470847358529,1474999473688543194,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:10
                                                    3⤵
                                                      PID:6828
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.internetdownloadmanager.com/welcome.html?v=643b01
                                                    2⤵
                                                      PID:6228
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 2560
                                                      2⤵
                                                      • Program crash
                                                      PID:4224
                                                  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                    1⤵
                                                    • Executes dropped EXE
                                                    • Drops file in System32 directory
                                                    • Drops file in Program Files directory
                                                    • Drops file in Windows directory
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:6040
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                    1⤵
                                                    • Executes dropped EXE
                                                    PID:2564
                                                  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                                                    1⤵
                                                    • Executes dropped EXE
                                                    PID:5228
                                                  • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                                                    "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                                                    1⤵
                                                    • Executes dropped EXE
                                                    PID:6064
                                                  • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                                                    C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                                                    1⤵
                                                    • Executes dropped EXE
                                                    PID:4156
                                                  • C:\Windows\SysWow64\perfhost.exe
                                                    C:\Windows\SysWow64\perfhost.exe
                                                    1⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    PID:5760
                                                  • C:\Windows\System32\ReFsDedupSvc.exe
                                                    C:\Windows\System32\ReFsDedupSvc.exe
                                                    1⤵
                                                    • Executes dropped EXE
                                                    • Checks processor information in registry
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:5052
                                                  • C:\Windows\System32\SensorDataService.exe
                                                    C:\Windows\System32\SensorDataService.exe
                                                    1⤵
                                                    • Executes dropped EXE
                                                    • Drops file in System32 directory
                                                    • Checks SCSI registry key(s)
                                                    PID:1044
                                                  • C:\Windows\System32\OpenSSH\ssh-agent.exe
                                                    C:\Windows\System32\OpenSSH\ssh-agent.exe
                                                    1⤵
                                                    • Executes dropped EXE
                                                    PID:5240
                                                  • C:\Windows\system32\AgentService.exe
                                                    C:\Windows\system32\AgentService.exe
                                                    1⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:5612
                                                  • C:\Windows\system32\SearchIndexer.exe
                                                    C:\Windows\system32\SearchIndexer.exe /Embedding
                                                    1⤵
                                                    • Executes dropped EXE
                                                    • Enumerates connected drives
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4616
                                                    • C:\Windows\System32\SearchProtocolHost.exe
                                                      "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                                      2⤵
                                                      • Modifies data under HKEY_USERS
                                                      PID:5876
                                                    • C:\Windows\System32\SearchProtocolHost.exe
                                                      "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3047816590-610495838-277027736-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3047816590-610495838-277027736-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
                                                      2⤵
                                                        PID:1524
                                                      • C:\Windows\System32\SearchFilterHost.exe
                                                        "C:\Windows\System32\SearchFilterHost.exe" 944 3064 2544 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
                                                        2⤵
                                                        • Modifies data under HKEY_USERS
                                                        PID:5560
                                                      • C:\Windows\System32\SearchFilterHost.exe
                                                        "C:\Windows\System32\SearchFilterHost.exe" 944 3012 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
                                                        2⤵
                                                        • Modifies data under HKEY_USERS
                                                        PID:2792
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                      1⤵
                                                        PID:6468
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 3156 -ip 3156
                                                        1⤵
                                                          PID:2920
                                                        • C:\Windows\System32\RuntimeBroker.exe
                                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                          1⤵
                                                            PID:7040
                                                            • C:\Windows\system32\verclsid.exe
                                                              "C:\Windows\system32\verclsid.exe" /S /C {9E175B8B-F52A-11D8-B9A5-505054503030} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x401
                                                              2⤵
                                                              • System Binary Proxy Execution: Verclsid
                                                              PID:6704

                                                          Network

                                                                MITRE ATT&CK Enterprise v16

                                                                Reconnaissance

                                                                Resource Development

                                                                Initial Access

                                                                Execution

                                                                Persistence

                                                                Boot or Logon Autostart Execution

                                                                1
                                                                T1547

                                                                Registry Run Keys / Startup Folder

                                                                1
                                                                T1547.001

                                                                Browser Extensions

                                                                1
                                                                T1176

                                                                Privilege Escalation

                                                                Boot or Logon Autostart Execution

                                                                1
                                                                T1547

                                                                Registry Run Keys / Startup Folder

                                                                1
                                                                T1547.001

                                                                Defense Evasion

                                                                Modify Registry

                                                                3
                                                                T1112

                                                                System Binary Proxy Execution

                                                                1
                                                                T1218

                                                                Verclsid

                                                                1
                                                                T1218.012

                                                                Credential Access

                                                                Credentials from Password Stores

                                                                1
                                                                T1555

                                                                Credentials from Web Browsers

                                                                1
                                                                T1555.003

                                                                Unsecured Credentials

                                                                1
                                                                T1552

                                                                Credentials In Files

                                                                1
                                                                T1552.001

                                                                Discovery

                                                                Browser Information Discovery

                                                                1
                                                                T1217

                                                                Peripheral Device Discovery

                                                                2
                                                                T1120

                                                                Query Registry

                                                                5
                                                                T1012

                                                                System Information Discovery

                                                                6
                                                                T1082

                                                                System Location Discovery

                                                                1
                                                                T1614

                                                                System Language Discovery

                                                                1
                                                                T1614.001

                                                                System Time Discovery

                                                                1
                                                                T1124

                                                                Lateral Movement

                                                                Collection

                                                                Data from Local System

                                                                1
                                                                T1005

                                                                Command and Control

                                                                Exfiltration

                                                                Impact

                                                                Replay Monitor

                                                                Loading Replay Monitor...

                                                                Downloads

                                                                elevation_service.exe
                                                                • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                • Size 2.7MB
                                                                • SHA256 fc5657420fa491e74d89a704643c768b091157706f0dde459640936df6446f38
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                maintenanceservice.exe
                                                                • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                • Size 1.6MB
                                                                • SHA256 bf93b3a86db9fd26c61b5fd0dfb3e63aa59a56615d22318b4e682e8446b0b007
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                7z.exe
                                                                • Path C:\Program Files\7-Zip\7z.exe
                                                                • Size 1.9MB
                                                                • SHA256 13e4b7d1fd916c4456a65a7f5ff3f43fe7cd22e46f1e1d6343e9312b58a8f57c
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                7zFM.exe
                                                                • Path C:\Program Files\7-Zip\7zFM.exe
                                                                • Size 1.5MB
                                                                • SHA256 f7fbae4d61de4cd695281f5ce2bcf27d1434bb23c71c9d26234c351013f65536
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                7zG.exe
                                                                • Path C:\Program Files\7-Zip\7zG.exe
                                                                • Size 1.2MB
                                                                • SHA256 56e8587c6d409503a5f11566f684f2763efda6e4db5fe9ce7ae2d793bb751a94
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Uninstall.exe
                                                                • Path C:\Program Files\7-Zip\Uninstall.exe
                                                                • Size 1.4MB
                                                                • SHA256 d66dd8014998e89e4a804332f3521751bae1de28af3028f31510dc13852ded68
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                AppVShNotify.exe
                                                                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
                                                                • Size 1.6MB
                                                                • SHA256 824ea85f368f8d52d4f14420211044225328310b7609f3abf21a76739a1bf140
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                IntegratedOffice.exe
                                                                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
                                                                • Size 4.6MB
                                                                • SHA256 fe6d7b9a027fff527190bc46098628f3c1f42d485ed5de71308fc268fc2aca7a
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                MavInject32.exe
                                                                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
                                                                • Size 1.7MB
                                                                • SHA256 d50e286fa8a37646d7a0eddcc9b28d22ae6d33f434160ef25e6f43bcfcc3cb82
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                OfficeC2RClient.exe
                                                                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
                                                                • Size 24.0MB
                                                                • SHA256 b2ff10220445d671fa74ba74597434851e35b4326fa79144f778efac89d34e77
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                appvcleaner.exe
                                                                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
                                                                • Size 2.7MB
                                                                • SHA256 03397038056ba95c8821265a35646e863e448901a84a7e5e0ea9000c3635c965
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                LICLUA.EXE
                                                                • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
                                                                • Size 1.1MB
                                                                • SHA256 6922a66fdca035c822d67ff4f9386aec54a1841eff5882fd136842c872481fe9
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                OSE.EXE
                                                                • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                                                                • Size 1.6MB
                                                                • SHA256 5ae4d7e4a4550655085339a68ab5c07ee6a0996c89bc8ade9ebc470882b5dc62
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                VSTOInstaller.exe
                                                                • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
                                                                • Size 1.4MB
                                                                • SHA256 43da11d66e8154e7d8a71dafd59aec918c90ac30c1b2b8044f7b409c2beee6d2
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                chrome_pwa_launcher.exe
                                                                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
                                                                • Size 2.3MB
                                                                • SHA256 4885b5afbce50a7e3e81839c3a03d3e161ef14253b3009b4d3e6fd3f9f218cbe
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                elevation_service.exe
                                                                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                • Size 2.8MB
                                                                • SHA256 0e3311537aa7d8ab8eb18052b313194aae8d63fe415d9464b171abb8be5164a8
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                firefox.exe
                                                                • Path C:\Program Files\Mozilla Firefox\firefox.exe
                                                                • Size 1.2MB
                                                                • SHA256 c3e4776a9c90eb6e84ca58ce64b911399f017bfa77533125ae98eb5d86c3ff3d
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                MsSense.exe
                                                                • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
                                                                • Size 1.8MB
                                                                • SHA256 ac997c1fa55cea584dc362d5f01b443404c5798329dbe2730e497aa3ffea2c73
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                NisSrv.exe
                                                                • Path C:\Program Files\Windows Defender\NisSrv.exe
                                                                • Size 3.5MB
                                                                • SHA256 7a44030af16465f3af4e311126d26eb992e87ac1ffe8eecd42f8b26e728690de
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                wmpnetwk.exe
                                                                • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
                                                                • Size 1.4MB
                                                                • SHA256 3489f73455e16ec25c727f42164aceaa250b09c3dfdb30ae00d79f9acd7b8d05
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                dotnet.exe
                                                                • Path C:\Program Files\dotnet\dotnet.exe
                                                                • Size 1.5MB
                                                                • SHA256 5fed8279068ee1929c87a6dbbc3819e640486c47b5cad49327a7e6af7c21d403
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Windows.db
                                                                • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
                                                                • Size 1.2MB
                                                                • SHA256 71af60c884d9abbc093ce69f59616a12d3dd2f62e6cfde75a4e39e15690cb6ac
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Windows.db-wal
                                                                • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
                                                                • Size 325KB
                                                                • SHA256 b09315b8511df2e3a1f0d4bc59b126bea8dfdb06c32f6579f427267acdb35859
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                blocklist
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                                • Size 105KB
                                                                • SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                settings.dat
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                • Size 280B
                                                                • SHA256 233c07bfff48b5fbad30cd7d90579abd0886400017cd6e7fb037e5626abb1a4d
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                settings.dat
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                • Size 280B
                                                                • SHA256 2fd9384e79508a77111bb6310e9414898358885ca508610502ff6f1a15ad704f
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                BookmarkMergedSurfaceOrdering
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                • Size 6B
                                                                • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                the-real-index
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                • Size 3KB
                                                                • SHA256 d58530e6a73d79d5f77eef5cbb4d90a97daa050d2a8d0da2a93de68f21109b11
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                the-real-index~RFe59bd5b.TMP
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59bd5b.TMP
                                                                • Size 3KB
                                                                • SHA256 27fc825811fa62eb93ed56f2864635634e63a6d13e7b5539093f04b636e54fc4
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                SiteList-Enterprise.json
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                • Size 2B
                                                                • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                Edge Profile.ico
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                • Size 70KB
                                                                • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                HubApps
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
                                                                • Size 106KB
                                                                • SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Network Persistent State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                • Size 2KB
                                                                • SHA256 3022cc440769e763ab7c7aeef4ba201465eedcd7955c79cd3e16d0250323ea9e
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                SCT Auditing Pending Reports
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                • Size 2B
                                                                • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                a65d2320-875d-4462-ba28-bc0b578e8c75.tmp
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a65d2320-875d-4462-ba28-bc0b578e8c75.tmp
                                                                • Size 40B
                                                                • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                Preferences
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                • Size 14KB
                                                                • SHA256 f4fde10c48472220ec4908695719688b79a6568fdddab0ecd0eb84db663bce45
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Preferences
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                • Size 14KB
                                                                • SHA256 3ff7c2b661c58512ca8a6d943cc2a72987b74851bb086de72538f35bebfb83b9
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Secure Preferences
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                • Size 32KB
                                                                • SHA256 3e9aa5dbbd734cc34c4965ca4961ae2db92c38e46672af6e4a0abe4ec95b7485
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                sync_diagnostic.log
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                • Size 4KB
                                                                • SHA256 20649b3abee6ac5909eac611bf6db1690d12384c5c54f569cfe16cd26fcec4dd
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                OperationConfig
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                • Size 22KB
                                                                • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                OperationConfig~RFe5a0ddc.TMP
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a0ddc.TMP
                                                                • Size 3KB
                                                                • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                Local State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                • Size 43KB
                                                                • SHA256 7e6b05de1da2a059aa93819d7654392d36239bf8d0f329a1ef26d5fccf733899
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Local State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                • Size 38KB
                                                                • SHA256 9434615b9318623f9195c3f863f44e9f765f801582e2039c7d7e971d4224f302
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Local State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                • Size 41KB
                                                                • SHA256 1ed01885661bc773e5bac75b8a62c1ae75559eda8c84006a3c7a69b9212a2656
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                metadata.json
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                • Size 132B
                                                                • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                d78e1554-d646-41da-b488-60db57894c50.tmp
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d78e1554-d646-41da-b488-60db57894c50.tmp
                                                                • Size 35KB
                                                                • SHA256 93e2d37a4762f5bb378b1317868836ae3436b7e70146422dbdecaaa053921923
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                31cf4333-0994-4037-815f-16703723c5b4.tmp
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\31cf4333-0994-4037-815f-16703723c5b4.tmp
                                                                • Size 13B
                                                                • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                03100235E7AEBB25C597DD91664A8F544DDFC529
                                                                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cyjywaoz.default-release\cache2\entries\03100235E7AEBB25C597DD91664A8F544DDFC529
                                                                • Size 13KB
                                                                • SHA256 5c13e769d761218faffcf39c7796108beb27372447559819a96dc3446a31e05b
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                4DDF99D0461C50BB47DC9EC040A8AD4C9355497C
                                                                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cyjywaoz.default-release\cache2\entries\4DDF99D0461C50BB47DC9EC040A8AD4C9355497C
                                                                • Size 3.7MB
                                                                • SHA256 ba46d5d00e8c30695d0454a40c0473e389a8eb02287e9f0a02d6e7b7be240f93
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                6DED9FE7A50E8290358DC1D8C755B05692CB9E36
                                                                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cyjywaoz.default-release\cache2\entries\6DED9FE7A50E8290358DC1D8C755B05692CB9E36
                                                                • Size 512KB
                                                                • SHA256 ab732e44e8dcabfd99a12516e660a650d56c42554600796a5988dca12ecd4bfa
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                9512A4488B00CC053350DAC32D417B4A35C11513
                                                                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cyjywaoz.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
                                                                • Size 13KB
                                                                • SHA256 78dccfc4ce1dfeeb2e0e05182d39630ef658e90a1da6b42930021b68bc703b4a
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                webext.sc.lz4
                                                                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\cyjywaoz.default-release\startupCache\webext.sc.lz4
                                                                • Size 105KB
                                                                • SHA256 07d7abc09be118edd8eb29ffa940d4ee018bb0e5699bb40034419a3095704a71
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                content_new.js
                                                                • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3532_580113612\CRX_INSTALL\content_new.js
                                                                • Size 10KB
                                                                • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                tmpaddon
                                                                • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                                • Size 11KB
                                                                • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                tmpaddon
                                                                • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                                • Size 21.6MB
                                                                • SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                compatibility.ini
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cyjywaoz.default-release\compatibility.ini
                                                                • Size 198B
                                                                • SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                data.safe.bin
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cyjywaoz.default-release\datareporting\glean\db\data.safe.bin
                                                                • Size 30KB
                                                                • SHA256 53852b61e2e0a0a272ab4c66f97efbf0f7527836ca572cc0e8c68757e40a5c54
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                data.safe.bin
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cyjywaoz.default-release\datareporting\glean\db\data.safe.bin
                                                                • Size 30KB
                                                                • SHA256 91bd116b273c48760c3acbf5a2fadd79105f74bdb130a058f54c250ced339609
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                data.safe.tmp
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cyjywaoz.default-release\datareporting\glean\db\data.safe.tmp
                                                                • Size 7KB
                                                                • SHA256 f580232b17c0cc117fe22a3029b319588f300f208c6227f82f0f31acca1b70d6
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                data.safe.tmp
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cyjywaoz.default-release\datareporting\glean\db\data.safe.tmp
                                                                • Size 30KB
                                                                • SHA256 71e8d4584041fc53f7aca93f2ba384eeca58a478b73bc2f00cd2496a2506595b
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                data.safe.tmp
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cyjywaoz.default-release\datareporting\glean\db\data.safe.tmp
                                                                • Size 5KB
                                                                • SHA256 322d928ef6a2a9ab29e238b870eca3ebf92619e22386ad7d3d0687d8eff371dc
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                events
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cyjywaoz.default-release\datareporting\glean\events\events
                                                                • Size 1KB
                                                                • SHA256 38b877e336b38111bad10c0b0923080e3927ba1049649789f3f611c08954787a
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                0ed4f813-8a2c-406b-abe8-71bb7afcd8a7
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cyjywaoz.default-release\datareporting\glean\pending_pings\0ed4f813-8a2c-406b-abe8-71bb7afcd8a7
                                                                • Size 886B
                                                                • SHA256 057f0868db2d378a1a62cb1a859a8f01afa50af855a20b5d503eba751ede4819
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                1443d56b-adde-4557-bc91-8f7c07ca1463
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cyjywaoz.default-release\datareporting\glean\pending_pings\1443d56b-adde-4557-bc91-8f7c07ca1463
                                                                • Size 235B
                                                                • SHA256 6f015477bfe9f29b1e9f0e83b706d7448419c55686eaba4a667ed5e1b81d985a
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                422927af-6a49-4bb6-84fc-a9d1f8f95e8f
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cyjywaoz.default-release\datareporting\glean\pending_pings\422927af-6a49-4bb6-84fc-a9d1f8f95e8f
                                                                • Size 2KB
                                                                • SHA256 68dad1b93964fe6fd45508cbf4ecb43f6d84637f6d23e4823d8f623d0712a878
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                668e0986-ef17-4db7-8a80-81bbdd201330
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cyjywaoz.default-release\datareporting\glean\pending_pings\668e0986-ef17-4db7-8a80-81bbdd201330
                                                                • Size 883B
                                                                • SHA256 289e96dcab0ef8a55fa66243f0135f37a19a2feb2f629b9f92e4ef7372f88d23
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                d6644106-5b28-472a-9c3c-6d52d80b1c5f
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cyjywaoz.default-release\datareporting\glean\pending_pings\d6644106-5b28-472a-9c3c-6d52d80b1c5f
                                                                • Size 235B
                                                                • SHA256 9a68bc161bee61d799766df3cbb666e166451c88db9863b8eaf5b1039499961a
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                e5897c6e-0acf-4602-af13-5a77585270d8
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cyjywaoz.default-release\datareporting\glean\pending_pings\e5897c6e-0acf-4602-af13-5a77585270d8
                                                                • Size 16KB
                                                                • SHA256 8f0c75ec6a53a3656e9391fa0642d95707adb819c91b5a3a51b9ff5d52f7f0b7
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                extensions.json
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cyjywaoz.default-release\extensions.json
                                                                • Size 16KB
                                                                • SHA256 fe792ff2d809ef334737e609e4c43b91c5915de0eb1f6b35a9e3a8cb2c162741
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                gmpopenh264.dll
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cyjywaoz.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                                                                • Size 1.1MB
                                                                • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                gmpopenh264.info
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cyjywaoz.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                                                                • Size 116B
                                                                • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                LICENSE.tmp
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cyjywaoz.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE.tmp
                                                                • Size 473B
                                                                • SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                manifest.json
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cyjywaoz.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
                                                                • Size 1002B
                                                                • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                widevinecdm.dll
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cyjywaoz.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
                                                                • Size 21.6MB
                                                                • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                prefs.js
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cyjywaoz.default-release\prefs.js
                                                                • Size 6KB
                                                                • SHA256 433951631bbf5f602c896d218c7eaa7fefae5e7a9e097ffc31b7516915353d2e
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                prefs.js
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cyjywaoz.default-release\prefs.js
                                                                • Size 6KB
                                                                • SHA256 29d6c013b841713fa752c973f13a096f0409791d172e1ade2384a24f12f65faf
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                prefs.js
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cyjywaoz.default-release\prefs.js
                                                                • Size 7KB
                                                                • SHA256 bfc356135ed4ef04265e854a928c8cb49f3fe07cd5329fdb1b312442dd22ef2f
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                prefs.js
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cyjywaoz.default-release\prefs.js
                                                                • Size 6KB
                                                                • SHA256 24efa11196df6d15aea0609241044301bb29a1e0681d2ed7dc61e081c79374e8
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                recovery.jsonlz4
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cyjywaoz.default-release\sessionstore-backups\recovery.jsonlz4
                                                                • Size 4KB
                                                                • SHA256 4ef95999f3c9ec3310ea887751e31209e245261b671f62c362e70597e090095c
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                3870112724rsegmnoittet-es.sqlite
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cyjywaoz.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                • Size 13.9MB
                                                                • SHA256 1dccceaa72264abcac260d3f55e0d1c394366148cf4018c59093c38b208912ee
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                3870112724rsegmnoittet-es.sqlite
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cyjywaoz.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                • Size 13.9MB
                                                                • SHA256 088ab699b5fc620b9f4b8e143946f9ee7f837abf38c211070a864bd701279ef0
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                3870112724rsegmnoittet-es.sqlite
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cyjywaoz.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                • Size 13.9MB
                                                                • SHA256 904305fdfc509a3757025a9a46d27ab502c5cd7c69c06ab58d38fd4ab479f67d
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                perfhost.exe
                                                                • Path C:\Windows\SysWOW64\perfhost.exe
                                                                • Size 1.4MB
                                                                • SHA256 8decd8c8d13f93a50d128d25655092ce66b90c40b080821c0410164f27e928a2
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                AgentService.exe
                                                                • Path C:\Windows\System32\AgentService.exe
                                                                • Size 1.4MB
                                                                • SHA256 5a1f46715b9519e32c475797024940b767b75266ece6936be0b878193241c070
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                ssh-agent.exe
                                                                • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                                                                • Size 1.9MB
                                                                • SHA256 30785e4121a2861171216d9c47511983047a5dba39ff619880cc7336b4b7557b
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                PerceptionSimulationService.exe
                                                                • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                                                                • Size 1.6MB
                                                                • SHA256 720bdac616465a3f0c6ee6d4ecaa544e0561c87a9ec46c0cb10e33f9200bb097
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                ReFsDedupSvc.exe
                                                                • Path C:\Windows\System32\ReFsDedupSvc.exe
                                                                • Size 2.6MB
                                                                • SHA256 034de6070ba92fb516d2713a050cd5ddd39861873b90e99099b1784dea2ce6b6
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                SearchIndexer.exe
                                                                • Path C:\Windows\System32\SearchIndexer.exe
                                                                • Size 1.4MB
                                                                • SHA256 a4a256c3ad7f3633708e2a2e5f13fc227aecf77c2e9a5653061560b33a925c63
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                SensorDataService.exe
                                                                • Path C:\Windows\System32\SensorDataService.exe
                                                                • Size 1.7MB
                                                                • SHA256 2d8746533b2481ef3c0362db38fee06dee98ea9145ae49bebd47b655d658c6a6
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                AppVClient.exe
                                                                • Path C:\Windows\system32\AppVClient.exe
                                                                • Size 1.3MB
                                                                • SHA256 26b380faf28d2644a152722fa4d4003ef57919e3d9677624b86588713b766e5e
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                SgrmBroker.exe
                                                                • Path C:\Windows\system32\Sgrm\SgrmBroker.exe
                                                                • Size 1.7MB
                                                                • SHA256 0bc7cfaa12402d74a9bcd67f9e66bd31cd51f69553eb3ad851ae1a4ba7353b6c
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                memory/1044-106-0x0000000140000000-0x00000001401BA000-memory.dmp
                                                                Download

                                                                memory/1044-107-0x00000000007B0000-0x0000000000810000-memory.dmp
                                                                Download

                                                                memory/1044-315-0x0000000140000000-0x00000001401BA000-memory.dmp
                                                                Download

                                                                memory/1044-317-0x00000000007B0000-0x0000000000810000-memory.dmp
                                                                Download

                                                                memory/1044-319-0x0000000140000000-0x00000001401BA000-memory.dmp
                                                                Download

                                                                memory/2564-33-0x00000000006E0000-0x0000000000740000-memory.dmp
                                                                Download

                                                                memory/2564-751-0x00000000006E0000-0x0000000000740000-memory.dmp
                                                                Download

                                                                memory/2564-34-0x00000000006E0000-0x0000000000740000-memory.dmp
                                                                Download

                                                                memory/2564-27-0x00000000006E0000-0x0000000000740000-memory.dmp
                                                                Download

                                                                memory/2564-125-0x0000000140000000-0x00000001402D4000-memory.dmp
                                                                Download

                                                                memory/2564-26-0x0000000140000000-0x00000001402D4000-memory.dmp
                                                                Download

                                                                memory/2564-756-0x0000000140000000-0x00000001402D4000-memory.dmp
                                                                Download

                                                                memory/3156-0-0x0000000002D30000-0x0000000002D96000-memory.dmp
                                                                Download

                                                                memory/3156-76-0x0000000000400000-0x0000000000A61000-memory.dmp
                                                                Download

                                                                memory/3156-5-0x0000000000400000-0x0000000000A61000-memory.dmp
                                                                Download

                                                                memory/3156-1213-0x0000000000400000-0x0000000000A61000-memory.dmp
                                                                Download

                                                                memory/3156-6-0x0000000002D30000-0x0000000002D96000-memory.dmp
                                                                Download

                                                                memory/3156-7-0x0000000002D30000-0x0000000002D96000-memory.dmp
                                                                Download

                                                                memory/4156-71-0x0000000140000000-0x0000000140197000-memory.dmp
                                                                Download

                                                                memory/4156-65-0x0000000000CC0000-0x0000000000D20000-memory.dmp
                                                                Download

                                                                memory/4156-291-0x0000000140000000-0x0000000140197000-memory.dmp
                                                                Download

                                                                memory/4156-72-0x0000000000CC0000-0x0000000000D20000-memory.dmp
                                                                Download

                                                                memory/4616-142-0x0000000140000000-0x0000000140172000-memory.dmp
                                                                Download

                                                                memory/4616-149-0x0000000000620000-0x0000000000680000-memory.dmp
                                                                Download

                                                                memory/4616-143-0x0000000000620000-0x0000000000680000-memory.dmp
                                                                Download

                                                                memory/4616-320-0x0000000140000000-0x0000000140172000-memory.dmp
                                                                Download

                                                                memory/5052-931-0x0000000000560000-0x00000000005C0000-memory.dmp
                                                                Download

                                                                memory/5052-94-0x0000000000560000-0x00000000005C0000-memory.dmp
                                                                Download

                                                                memory/5052-89-0x0000000140000000-0x00000001402C9000-memory.dmp
                                                                Download

                                                                memory/5052-314-0x0000000140000000-0x00000001402C9000-memory.dmp
                                                                Download

                                                                memory/5052-87-0x0000000000560000-0x00000000005C0000-memory.dmp
                                                                Download

                                                                memory/5052-932-0x0000000140000000-0x00000001402C9000-memory.dmp
                                                                Download

                                                                memory/5228-38-0x0000000140000000-0x00000001401A1000-memory.dmp
                                                                Download

                                                                memory/5228-39-0x0000000001B10000-0x0000000001B70000-memory.dmp
                                                                Download

                                                                memory/5228-45-0x0000000001B10000-0x0000000001B70000-memory.dmp
                                                                Download

                                                                memory/5228-49-0x0000000001B10000-0x0000000001B70000-memory.dmp
                                                                Download

                                                                memory/5228-53-0x0000000140000000-0x00000001401A1000-memory.dmp
                                                                Download

                                                                memory/5240-316-0x0000000140000000-0x000000014020B000-memory.dmp
                                                                Download

                                                                memory/5240-113-0x0000000140000000-0x000000014020B000-memory.dmp
                                                                Download

                                                                memory/5240-114-0x0000000000CF0000-0x0000000000D50000-memory.dmp
                                                                Download

                                                                memory/5240-120-0x0000000000CF0000-0x0000000000D50000-memory.dmp
                                                                Download

                                                                memory/5612-126-0x0000000140000000-0x0000000140168000-memory.dmp
                                                                Download

                                                                memory/5612-140-0x0000000140000000-0x0000000140168000-memory.dmp
                                                                Download

                                                                memory/5612-127-0x0000000000C90000-0x0000000000CF0000-memory.dmp
                                                                Download

                                                                memory/5612-133-0x0000000000C90000-0x0000000000CF0000-memory.dmp
                                                                Download

                                                                memory/5612-138-0x0000000000C90000-0x0000000000CF0000-memory.dmp
                                                                Download

                                                                memory/5760-83-0x0000000000820000-0x0000000000886000-memory.dmp
                                                                Download

                                                                memory/5760-78-0x0000000000820000-0x0000000000886000-memory.dmp
                                                                Download

                                                                memory/5760-308-0x0000000000400000-0x0000000000563000-memory.dmp
                                                                Download

                                                                memory/5760-77-0x0000000000400000-0x0000000000563000-memory.dmp
                                                                Download

                                                                memory/6040-13-0x0000000140000000-0x00000001402E9000-memory.dmp
                                                                Download

                                                                memory/6040-14-0x0000000000D10000-0x0000000000D70000-memory.dmp
                                                                Download

                                                                memory/6040-22-0x0000000000D10000-0x0000000000D70000-memory.dmp
                                                                Download

                                                                memory/6040-102-0x0000000140000000-0x00000001402E9000-memory.dmp
                                                                Download

                                                                memory/6064-239-0x0000000140000000-0x000000014019C000-memory.dmp
                                                                Download

                                                                memory/6064-60-0x00000000007B0000-0x0000000000810000-memory.dmp
                                                                Download

                                                                memory/6064-54-0x00000000007B0000-0x0000000000810000-memory.dmp
                                                                Download

                                                                memory/6064-52-0x0000000140000000-0x000000014019C000-memory.dmp
                                                                Download