Overview

overview

10

Static

static

10

2026-07-06...op.exe

windows10-2004-x64

9

2026-07-06...op.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    32s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/07/2026, 03:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-06_56267690fca0c270c56b99ce8c0975a8_darkgate_elex_glassworm_remcos_stop.exe
  • Size 6.3MB
  • Sample260707-eakhgahs2z
  • SHA256 949ef6fd9cab6fd35fbfb2e5ebf0cc58bd9f9f620e8120dd5180cac60f11c4ee
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwaredefense_evasiondiscoverypersistencephishingspywarestealertrojan

Malware Config

Signatures

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 2 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 2 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • A potential corporate email address has been identified in the URL: [email protected]
    phishing
  • Executes dropped EXE 23 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 50 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • System Binary Proxy Execution: Verclsid 1 TTPs 1 IoCs

    Adversaries may abuse Verclsid to proxy execution of malicious code.

    defense_evasion
  • Drops file in System32 directory 24 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 23 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Control Panel 1 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 23 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 31 IoCs
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 40 IoCs
  • Suspicious use of FindShellTrayWindow 15 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-06_56267690fca0c270c56b99ce8c0975a8_darkgate_elex_glassworm_remcos_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-06_56267690fca0c270c56b99ce8c0975a8_darkgate_elex_glassworm_remcos_stop.exe"
    1⤵
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Installs/modifies Browser Helper Object
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1836
    • C:\Windows\system32\regsvr32.exe
      C:\Windows\Sysnative\regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
      2⤵
        PID:5544
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4952
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
          3⤵
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Checks processor information in registry
          • Modifies Control Panel
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:5468
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2000 -prefsLen 27097 -prefMapHandle 2004 -prefMapSize 270279 -ipcHandle 2084 -initialChannelId {7aaf8871-2811-4271-9eb9-8e375018fd45} -parentPid 5468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5468" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
            4⤵
            • Executes dropped EXE
            PID:2704
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2476 -prefsLen 27133 -prefMapHandle 2480 -prefMapSize 270279 -ipcHandle 2488 -initialChannelId {82e7f14f-4f63-46de-b596-c8a1d0ae8feb} -parentPid 5468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
            4⤵
            • Executes dropped EXE
            PID:6132
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3764 -prefsLen 25164 -prefMapHandle 3768 -prefMapSize 270279 -jsInitHandle 3772 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3780 -initialChannelId {157a9d22-a8cf-4a54-9349-1abc75817236} -parentPid 5468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:1804
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3932 -prefsLen 27274 -prefMapHandle 3936 -prefMapSize 270279 -ipcHandle 3940 -initialChannelId {2c61a601-ee76-44c4-b052-830fa5699409} -parentPid 5468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5468" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
            4⤵
            • Executes dropped EXE
            PID:2000
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4524 -prefsLen 34822 -prefMapHandle 4528 -prefMapSize 270279 -jsInitHandle 4532 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4548 -initialChannelId {9504ea0c-ed4c-4650-87a8-7d151730c0f7} -parentPid 5468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:2732
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5116 -prefsLen 35010 -prefMapHandle 5100 -prefMapSize 270279 -ipcHandle 5128 -initialChannelId {76939d1a-1ff0-4535-aea0-672e9f826ccf} -parentPid 5468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:1636
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4996 -prefsLen 35062 -prefMapHandle 2748 -prefMapSize 270279 -jsInitHandle 1652 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1664 -initialChannelId {51322116-c368-439b-b07d-1d1f81ec4444} -parentPid 5468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:1216
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5760 -prefsLen 32952 -prefMapHandle 5740 -prefMapSize 270279 -jsInitHandle 5744 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4800 -initialChannelId {16960c14-2949-458d-861a-958bd95ed8bf} -parentPid 5468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:5928
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5768 -prefsLen 32952 -prefMapHandle 5628 -prefMapSize 270279 -jsInitHandle 5644 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5648 -initialChannelId {cdaa04ac-199e-4807-a2e0-c4e6d4807db2} -parentPid 5468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:2976
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5964 -prefsLen 32952 -prefMapHandle 5960 -prefMapSize 270279 -jsInitHandle 5956 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5948 -initialChannelId {a280593c-a3b5-4290-bce8-0c56e94a8252} -parentPid 5468 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5468" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:2616
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2824
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:4068
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:4800
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:1412
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.internetdownloadmanager.com/welcome.html?v=642b64
        2⤵
        • Drops file in Windows directory
        • Enumerates system info in registry
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4736
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x314,0x7ffccce6c188,0x7ffccce6c194,0x7ffccce6c1a0
          3⤵
            PID:1672
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,8950307193679783658,1057051511973890897,262144 --field-trial-handle=2376,i,3035476799841544383,10995673443163804987,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:2
            3⤵
              PID:1140
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,10369142144669065658,14672583302606691024,524288 --field-trial-handle=2376,i,3035476799841544383,10995673443163804987,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:11
              3⤵
              • System Time Discovery
              PID:1768
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,9014966686919071329,13217609831546722570,524288 --field-trial-handle=2376,i,3035476799841544383,10995673443163804987,262144 --variations-seed-version --mojo-platform-channel-handle=3332 /prefetch:13
              3⤵
                PID:5656
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3532,i,18305303283597867614,8855992397163513272,2097152 --field-trial-handle=2376,i,3035476799841544383,10995673443163804987,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
                3⤵
                  PID:772
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3536,i,12270486859140197054,4963099780622714847,2097152 --field-trial-handle=2376,i,3035476799841544383,10995673443163804987,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
                  3⤵
                    PID:4256
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,4162651502875991512,9422895138414100089,2097152 --field-trial-handle=2376,i,3035476799841544383,10995673443163804987,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:1
                    3⤵
                      PID:5024
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4084,i,10856263101725441717,11261340178587747117,2097152 --field-trial-handle=2376,i,3035476799841544383,10995673443163804987,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:9
                      3⤵
                        PID:5760
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,12323407015869198889,18079415242868411497,524288 --field-trial-handle=2376,i,3035476799841544383,10995673443163804987,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:14
                        3⤵
                          PID:6432
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,9772753389047480266,17805545832521768856,524288 --field-trial-handle=2376,i,3035476799841544383,10995673443163804987,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
                          3⤵
                            PID:6348
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,8138493545902612346,2381566576036184223,524288 --field-trial-handle=2376,i,3035476799841544383,10995673443163804987,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
                            3⤵
                              PID:6336
                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,6137340728871908960,4768923859824644665,524288 --field-trial-handle=2376,i,3035476799841544383,10995673443163804987,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
                              3⤵
                                PID:7204
                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,6137340728871908960,4768923859824644665,524288 --field-trial-handle=2376,i,3035476799841544383,10995673443163804987,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
                                3⤵
                                  PID:1080
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,10922597729382216208,9390344422390569786,524288 --field-trial-handle=2376,i,3035476799841544383,10995673443163804987,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:14
                                  3⤵
                                    PID:6732
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,7626799886867782180,14947857796492755559,524288 --field-trial-handle=2376,i,3035476799841544383,10995673443163804987,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:14
                                    3⤵
                                      PID:7456
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,18038999275099074491,7309229430084487927,524288 --field-trial-handle=2376,i,3035476799841544383,10995673443163804987,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
                                      3⤵
                                        PID:7304
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,16292004005470341497,10490817828285960169,524288 --field-trial-handle=2376,i,3035476799841544383,10995673443163804987,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:14
                                        3⤵
                                          PID:7296
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,11154297385846272032,3537648964485566231,524288 --field-trial-handle=2376,i,3035476799841544383,10995673443163804987,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:14
                                          3⤵
                                            PID:7988
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,6117665416448860499,2316549301969485741,524288 --field-trial-handle=2376,i,3035476799841544383,10995673443163804987,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:14
                                            3⤵
                                              PID:4488
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,13386218115097046984,4927394128190573356,524288 --field-trial-handle=2376,i,3035476799841544383,10995673443163804987,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
                                              3⤵
                                                PID:4792
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5180,i,4403367706758078342,16787518605631977128,262144 --field-trial-handle=2376,i,3035476799841544383,10995673443163804987,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:10
                                                3⤵
                                                  PID:7656
                                            • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                              "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                              1⤵
                                              • Executes dropped EXE
                                              • Drops file in System32 directory
                                              PID:5332
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                              1⤵
                                              • Executes dropped EXE
                                              PID:5004
                                            • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                              "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                                              1⤵
                                              • Executes dropped EXE
                                              • Drops file in Program Files directory
                                              PID:4828
                                            • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                                              "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                                              1⤵
                                              • Executes dropped EXE
                                              PID:2296
                                            • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                                              C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                                              1⤵
                                              • Executes dropped EXE
                                              PID:5064
                                            • C:\Windows\SysWow64\perfhost.exe
                                              C:\Windows\SysWow64\perfhost.exe
                                              1⤵
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              PID:2328
                                            • C:\Windows\System32\ReFsDedupSvc.exe
                                              C:\Windows\System32\ReFsDedupSvc.exe
                                              1⤵
                                              • Executes dropped EXE
                                              • Checks processor information in registry
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:2964
                                            • C:\Windows\System32\SensorDataService.exe
                                              C:\Windows\System32\SensorDataService.exe
                                              1⤵
                                              • Executes dropped EXE
                                              • Drops file in System32 directory
                                              • Checks SCSI registry key(s)
                                              PID:3320
                                            • C:\Windows\System32\OpenSSH\ssh-agent.exe
                                              C:\Windows\System32\OpenSSH\ssh-agent.exe
                                              1⤵
                                              • Executes dropped EXE
                                              PID:4936
                                            • C:\Windows\system32\AgentService.exe
                                              C:\Windows\system32\AgentService.exe
                                              1⤵
                                              • Executes dropped EXE
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:2944
                                            • C:\Windows\system32\SearchIndexer.exe
                                              C:\Windows\system32\SearchIndexer.exe /Embedding
                                              1⤵
                                              • Executes dropped EXE
                                              • Enumerates connected drives
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of WriteProcessMemory
                                              PID:4912
                                              • C:\Windows\System32\SearchProtocolHost.exe
                                                "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2532687178-1633831978-1202193935-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2532687178-1633831978-1202193935-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
                                                2⤵
                                                  PID:2684
                                                • C:\Windows\System32\SearchProtocolHost.exe
                                                  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                                  2⤵
                                                  • Modifies data under HKEY_USERS
                                                  PID:4280
                                                • C:\Windows\System32\SearchFilterHost.exe
                                                  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
                                                  2⤵
                                                  • Modifies data under HKEY_USERS
                                                  PID:1368
                                                • C:\Windows\System32\SearchFilterHost.exe
                                                  "C:\Windows\System32\SearchFilterHost.exe" 944 3004 2984 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
                                                  2⤵
                                                  • Modifies data under HKEY_USERS
                                                  PID:2376
                                              • C:\Windows\system32\sihost.exe
                                                sihost.exe
                                                1⤵
                                                • Suspicious use of FindShellTrayWindow
                                                PID:6600
                                                • C:\Windows\explorer.exe
                                                  explorer.exe /LOADSAVEDWINDOWS
                                                  2⤵
                                                  • Boot or Logon Autostart Execution: Active Setup
                                                  • Enumerates connected drives
                                                  • Checks SCSI registry key(s)
                                                  • Modifies Internet Explorer settings
                                                  • Modifies registry class
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • Suspicious use of FindShellTrayWindow
                                                  • Suspicious use of SendNotifyMessage
                                                  PID:7044
                                              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                1⤵
                                                • Suspicious use of SetWindowsHookEx
                                                PID:6704
                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                1⤵
                                                • Modifies registry class
                                                • Suspicious use of SetWindowsHookEx
                                                PID:6712
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                1⤵
                                                  PID:7452
                                                • C:\Windows\system32\verclsid.exe
                                                  "C:\Windows\system32\verclsid.exe" /S /C {9E175B8B-F52A-11D8-B9A5-505054503030} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x401
                                                  1⤵
                                                  • System Binary Proxy Execution: Verclsid
                                                  PID:4432

                                                Network

                                                      MITRE ATT&CK Enterprise v16

                                                      Reconnaissance

                                                      Resource Development

                                                      Initial Access

                                                      Execution

                                                      Persistence

                                                      Boot or Logon Autostart Execution

                                                      2
                                                      T1547

                                                      Active Setup

                                                      1
                                                      T1547.014

                                                      Registry Run Keys / Startup Folder

                                                      1
                                                      T1547.001

                                                      Browser Extensions

                                                      1
                                                      T1176

                                                      Privilege Escalation

                                                      Boot or Logon Autostart Execution

                                                      2
                                                      T1547

                                                      Active Setup

                                                      1
                                                      T1547.014

                                                      Registry Run Keys / Startup Folder

                                                      1
                                                      T1547.001

                                                      Defense Evasion

                                                      Modify Registry

                                                      4
                                                      T1112

                                                      System Binary Proxy Execution

                                                      1
                                                      T1218

                                                      Verclsid

                                                      1
                                                      T1218.012

                                                      Credential Access

                                                      Credentials from Password Stores

                                                      1
                                                      T1555

                                                      Credentials from Web Browsers

                                                      1
                                                      T1555.003

                                                      Unsecured Credentials

                                                      1
                                                      T1552

                                                      Credentials In Files

                                                      1
                                                      T1552.001

                                                      Discovery

                                                      Browser Information Discovery

                                                      1
                                                      T1217

                                                      Peripheral Device Discovery

                                                      2
                                                      T1120

                                                      Query Registry

                                                      5
                                                      T1012

                                                      System Information Discovery

                                                      6
                                                      T1082

                                                      System Location Discovery

                                                      1
                                                      T1614

                                                      System Language Discovery

                                                      1
                                                      T1614.001

                                                      System Time Discovery

                                                      1
                                                      T1124

                                                      Lateral Movement

                                                      Collection

                                                      Data from Local System

                                                      1
                                                      T1005

                                                      Command and Control

                                                      Exfiltration

                                                      Impact

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      elevation_service.exe
                                                      • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                      • Size 2.7MB
                                                      • SHA256 f5dded4ee517bf4bc132e47d291870525fbf26a73b0012b3630af6e525d70920
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      maintenanceservice.exe
                                                      • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                      • Size 1.5MB
                                                      • SHA256 b9a0b03c6e35fe6f42e5cac94341d8c9c25eb3f18c1d778d23b338123b8b65dc
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      7z.exe
                                                      • Path C:\Program Files\7-Zip\7z.exe
                                                      • Size 1.8MB
                                                      • SHA256 122d585eac9f7670ef51a5f5e097eb7f1ff428e635e8c61fce2d6c4a2cfa0804
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      7zFM.exe
                                                      • Path C:\Program Files\7-Zip\7zFM.exe
                                                      • Size 1.5MB
                                                      • SHA256 2f293d38f417d2dbfa9302c63d54160d07ba774e0f2b39d9e0ba460d9ee9867d
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      7zG.exe
                                                      • Path C:\Program Files\7-Zip\7zG.exe
                                                      • Size 1.2MB
                                                      • SHA256 ec249f93327cc34d19d6efa7789adb45f68db82c784b2dee061253411b44a1e9
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      Uninstall.exe
                                                      • Path C:\Program Files\7-Zip\Uninstall.exe
                                                      • Size 1.2MB
                                                      • SHA256 630fe1ced19c83a951576b3b554b6a30ce6e644cc5f1b9c922d9d34f25414ab4
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      AppVShNotify.exe
                                                      • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
                                                      • Size 1.5MB
                                                      • SHA256 e33929916428aacf9ac579a7d7866b1a153a47475424449a944ce67599058d62
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      IntegratedOffice.exe
                                                      • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
                                                      • Size 4.6MB
                                                      • SHA256 98b3af2dcd3833aeaec5071924678d7b4af70eb79acdad9b2bf69df86c943026
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      MavInject32.exe
                                                      • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
                                                      • Size 1.6MB
                                                      • SHA256 d9a5ae13837a7f34e65b1a5330797a34a876fe354d86a8ba676a4375580098ff
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      OfficeC2RClient.exe
                                                      • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
                                                      • Size 24.0MB
                                                      • SHA256 0fecf5261d1a17d5b5adeeee3784224042e5de20d76952beab05b0c53b3ff6e7
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      appvcleaner.exe
                                                      • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
                                                      • Size 2.7MB
                                                      • SHA256 a7f4c59dc26215182426900846fbbb3f01247f747ec03209ea5723a9150f3581
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      LICLUA.EXE
                                                      • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
                                                      • Size 1.1MB
                                                      • SHA256 a21aeddcc64db2b7a51f0e0072544232a1da6329a7c02c28cfed51dd3fb58d9d
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      OSE.EXE
                                                      • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                                                      • Size 1.5MB
                                                      • SHA256 6c42d72b6c4d6005fc872ca1b792d01704ae852ee6d32f14986b537449a44452
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      VSTOInstaller.exe
                                                      • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
                                                      • Size 1.3MB
                                                      • SHA256 bf95421c2bf28724c254e099cf4c890cf75b1c7bf638d6e577d635580d94bf70
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      elevation_service.exe
                                                      • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                      • Size 2.8MB
                                                      • SHA256 e0195fa6580f94acf2ffb43b5778b6faf56124e47fbb9d00ac86be7dd9d71cfe
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      firefox.exe
                                                      • Path C:\Program Files\Mozilla Firefox\firefox.exe
                                                      • Size 1.2MB
                                                      • SHA256 727f2fdc3de371e72b73b6bc7f39e9eb49fb49aef3f5073b637877e95a5b06cd
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      MsSense.exe
                                                      • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
                                                      • Size 1.7MB
                                                      • SHA256 aebe0600fbcc6bd09ee21b83ff67fcba4b1bddd9650f52f5fc71ddcd9da1dc30
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      NisSrv.exe
                                                      • Path C:\Program Files\Windows Defender\NisSrv.exe
                                                      • Size 3.5MB
                                                      • SHA256 256ddbb9e3eefc5486f8059f992fc0d4018d19fa2f034a7cf9614ee15504b197
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      wmpnetwk.exe
                                                      • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
                                                      • Size 1.4MB
                                                      • SHA256 bcbb2297d4f7b93ab8563e40392dc905662fc9fed48257954d8a0073cddc7bdb
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      dotnet.exe
                                                      • Path C:\Program Files\dotnet\dotnet.exe
                                                      • Size 1.4MB
                                                      • SHA256 29677772878ca742252e466e4b327e0fb7e1b5e105d3159f7ed162a04caf69d4
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      Windows.db
                                                      • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
                                                      • Size 1.3MB
                                                      • SHA256 21ed2ecee7af2c5320b54ade0cee3aaf8fa6da4804b8eff65c25d5c48a52d0c1
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      Windows.db-wal
                                                      • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
                                                      • Size 8KB
                                                      • SHA256 955ed1d576139fc9886563ccdc04e820647fe930e583c8c18b5705ebe45e0c60
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      Windows.db-wal
                                                      • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
                                                      • Size 321KB
                                                      • SHA256 672318ddd18e9e40bf4ea4a2ef59bd6dfcee6df18f9966b1c4d7ed5a9952592b
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      settings.dat
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                      • Size 280B
                                                      • SHA256 f2f36159b1a73a0ea0e59f51f1f373932375016885fcf17933887e7d1b2c3016
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      settings.dat
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                      • Size 280B
                                                      • SHA256 99348710dfa24f06e3cc9e5d66d99b450d2606932193b821d1cccbb1b0382494
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      the-real-index
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                      • Size 3KB
                                                      • SHA256 0942806cb6ad401f890bd1fc7b83e3cf5a75171b0c4b00d677a0e99f8baf8bb4
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      the-real-index~RFe5a1f03.TMP
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a1f03.TMP
                                                      • Size 3KB
                                                      • SHA256 49f14ebb6d3668bcb56dae66aec568e30ab978e44900961c6615123844b2df14
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      SiteList-Enterprise.json
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                      • Size 2B
                                                      • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      Edge Profile.ico
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                      • Size 70KB
                                                      • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      Network Persistent State
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                      • Size 2KB
                                                      • SHA256 78db6b51ed2b2947b714cb56a9976170d1cea55445eea3b6f8d71b8d0950eed0
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      SCT Auditing Pending Reports
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                      • Size 2B
                                                      • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      Sdch Dictionaries
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                      • Size 40B
                                                      • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      Preferences
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                      • Size 14KB
                                                      • SHA256 817c5c5902d6e9c7a30186fc54ff6b10274f78e90e592f4e206246bac1914bae
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      Preferences
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                      • Size 14KB
                                                      • SHA256 cabf447e1245e3ff404153a1450fb580d48bcbb141e9618aee3127a93607e210
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      Secure Preferences
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                      • Size 32KB
                                                      • SHA256 75b9ec6d3ac657319f66e82a7099a1a1eae1c07fa6730631e0432b6d55f4cf39
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      98743c10-26ba-40a2-ad27-57b472029cab.tmp
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\98743c10-26ba-40a2-ad27-57b472029cab.tmp
                                                      • Size 22KB
                                                      • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      Local State
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                      • Size 35KB
                                                      • SHA256 0711b392d5e90cfdb1dcd444d6da76b4ae3df09ecee4c8c06a39cf4121fef074
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      Local State
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                      • Size 38KB
                                                      • SHA256 7b8049fe38c1d02d0fe031b1e1b6da7091992de718e73412fd41d367dd8dbc69
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      Local State
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                      • Size 43KB
                                                      • SHA256 90e0081edbf8fe17c72295fb265682f2e0161dd9d4e5ad2b7a4f8806fc323dd3
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      metadata.json
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                      • Size 132B
                                                      • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      a3d5594b-0607-454e-8413-3bd695e87ebc.tmp
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a3d5594b-0607-454e-8413-3bd695e87ebc.tmp
                                                      • Size 13B
                                                      • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      6DED9FE7A50E8290358DC1D8C755B05692CB9E36
                                                      • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6088y0oq.default-release\cache2\entries\6DED9FE7A50E8290358DC1D8C755B05692CB9E36
                                                      • Size 512KB
                                                      • SHA256 be08b631a32a4cbe74d6024c64d74b60906fa9e86aced3c0d9747b73cae7270b
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      9512A4488B00CC053350DAC32D417B4A35C11513
                                                      • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6088y0oq.default-release\cache2\entries\9512A4488B00CC053350DAC32D417B4A35C11513
                                                      • Size 13KB
                                                      • SHA256 97fc87d781695b25dc102c7634793705d57427e8d1560aa94b7c52339c7e7e7c
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      webext.sc.lz4
                                                      • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\6088y0oq.default-release\startupCache\webext.sc.lz4
                                                      • Size 105KB
                                                      • SHA256 1ad911c76494dde8e647ffe1e7cb7ab5649d7888a7ec3e4044d39b8174a6ee9b
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      prep_Activatable Class_Hermes_perf.cache
                                                      • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                      • Size 599B
                                                      • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      0295db94-d330-418e-afce-c4ac753693c1.zip
                                                      • Path C:\Users\Admin\AppData\Local\Temp\0295db94-d330-418e-afce-c4ac753693c1.zip
                                                      • Size 3.7MB
                                                      • SHA256 fa4bb42248df1a52130e8be56d582f50e1ab0bdc25c23f6d9f7e828a1f4045a8
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      content_new.js
                                                      • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4736_680126218\CRX_INSTALL\content_new.js
                                                      • Size 10KB
                                                      • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      tmpaddon
                                                      • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                      • Size 21.6MB
                                                      • SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      tmpaddon
                                                      • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                      • Size 11KB
                                                      • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      compatibility.ini
                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\compatibility.ini
                                                      • Size 198B
                                                      • SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      data.safe.bin
                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\datareporting\glean\db\data.safe.bin
                                                      • Size 29KB
                                                      • SHA256 490f1f4acbd81f3b9b8a6e2fad7a07683aec01798a2ae25e9d427c04bb4b6a3c
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      data.safe.tmp
                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\datareporting\glean\db\data.safe.tmp
                                                      • Size 29KB
                                                      • SHA256 a6f6fce5ed069c239174437d771751f128353d75eac24901d51ddb59654044d2
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      data.safe.tmp
                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\datareporting\glean\db\data.safe.tmp
                                                      • Size 5KB
                                                      • SHA256 ac4a246ce0cd571da97c975e167d2484da59a64a76b6bd23a86cacbe1008ad04
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      data.safe.tmp
                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\datareporting\glean\db\data.safe.tmp
                                                      • Size 7KB
                                                      • SHA256 c53c786898f13be2e8096a0322f2f2c3ff73d8ac57e076f57479d2002b9ed677
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      events
                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\datareporting\glean\events\events
                                                      • Size 1KB
                                                      • SHA256 31279ee7b77af5b8e1f105b1182e4ff430632a876a5728fd77c800ea01a2eb10
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      240fd9b2-3ace-4013-8686-e07ebe32658f
                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\datareporting\glean\pending_pings\240fd9b2-3ace-4013-8686-e07ebe32658f
                                                      • Size 883B
                                                      • SHA256 b257a1eff48a41024c66e9f22b6dcb753b9cfaf3e9dd2d377981fe07f70a0fa8
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      7ff36d25-593a-4704-a572-f5fe0ff87a6e
                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\datareporting\glean\pending_pings\7ff36d25-593a-4704-a572-f5fe0ff87a6e
                                                      • Size 16KB
                                                      • SHA256 4eda4ccc012d5afb977f1dbc8930db4cf2f7de6486ade19bc35ed089084b01d1
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      bf08d318-e896-40ac-bda7-6bc004785a71
                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\datareporting\glean\pending_pings\bf08d318-e896-40ac-bda7-6bc004785a71
                                                      • Size 886B
                                                      • SHA256 ed4740b9c3e569e4a20a75200cde829ef8f11c6f46f032b4a7556d0d4b294871
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      cefb54b4-1358-486c-8349-70e136b8d4d2
                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\datareporting\glean\pending_pings\cefb54b4-1358-486c-8349-70e136b8d4d2
                                                      • Size 2KB
                                                      • SHA256 ab2b1e8f0af4f7708bf69742e24591e0a4562dff13c5ed707c10f20adb8b69f9
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      e2567ee3-4a36-4320-8f12-ba214880850e
                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\datareporting\glean\pending_pings\e2567ee3-4a36-4320-8f12-ba214880850e
                                                      • Size 235B
                                                      • SHA256 eb22d732c8960420c0c4371f2de84f0062a33c7dca51c15a3e7a967363c155a3
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      ef50f6fe-68e3-4af1-9446-fdcc54154e9e
                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\datareporting\glean\pending_pings\ef50f6fe-68e3-4af1-9446-fdcc54154e9e
                                                      • Size 235B
                                                      • SHA256 6998d67b750124c628f5b1e3361252c26435328cf875b1a59491c15fe6de2f4f
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      extensions.json
                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\extensions.json
                                                      • Size 16KB
                                                      • SHA256 c699a145f2e6dac9a6226a23d5367cf060cfb4a62a7cf8035920b8d693755fea
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      gmpopenh264.dll
                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                                                      • Size 1.1MB
                                                      • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      gmpopenh264.info
                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                                                      • Size 116B
                                                      • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      LICENSE.tmp
                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE.tmp
                                                      • Size 473B
                                                      • SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      manifest.json
                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
                                                      • Size 1002B
                                                      • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      widevinecdm.dll
                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
                                                      • Size 21.6MB
                                                      • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      prefs-1.js
                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\prefs-1.js
                                                      • Size 6KB
                                                      • SHA256 bb7ed34afe4230e1b142557ad3feabc5e4ce85bb70a480f33ecbb53f939f598c
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      prefs-1.js
                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\prefs-1.js
                                                      • Size 7KB
                                                      • SHA256 f0dcc543804b2b842b4f6da17f7aaaa2d82cd620968bb7c7b507622c9a5f1b19
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      prefs.js
                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\prefs.js
                                                      • Size 6KB
                                                      • SHA256 37b3ba0785157709448732ee2401835e63b371c9e06614d21b7c6bc255190f45
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      prefs.js
                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\prefs.js
                                                      • Size 6KB
                                                      • SHA256 020a9d2b82d845629914f08184225c71446847acba0d6601d68141e30cec5a51
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      recovery.jsonlz4
                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\sessionstore-backups\recovery.jsonlz4
                                                      • Size 4KB
                                                      • SHA256 ac265ca5f6ac9ca516549424f59038ee51412cee41f5d90ad3fdbcf91c6eb7ac
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      3870112724rsegmnoittet-es.sqlite
                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                      • Size 13.0MB
                                                      • SHA256 dd7b0709fb80f4bdb514509a079c01e8db684609a001a0e36c59aa3102d85016
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      3870112724rsegmnoittet-es.sqlite
                                                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                      • Size 14.1MB
                                                      • SHA256 e9d4995cb72319bfb4ce124f6d207203fb23b52b11a7b36b1d54c30e96253102
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      perfhost.exe
                                                      • Path C:\Windows\SysWOW64\perfhost.exe
                                                      • Size 1.2MB
                                                      • SHA256 5663a1f6ac913c5944b5c05280fe0756b8b5cb2e56797e9a8e986edd9782eee7
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      AgentService.exe
                                                      • Path C:\Windows\System32\AgentService.exe
                                                      • Size 1.4MB
                                                      • SHA256 35b61b6f4813407db6b0556fb294096c8a4eb84466362c734c95f3ae75a2a47c
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      ssh-agent.exe
                                                      • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                                                      • Size 1.8MB
                                                      • SHA256 b11db8af1e32d6922251e33c1f6883d6215b9485293775dd9552cd3cc6d218dd
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      PerceptionSimulationService.exe
                                                      • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                                                      • Size 1.5MB
                                                      • SHA256 d55abbfcb3adc0207aa47613047607b4c20c7fee930d85cca5c96baf6e7d37e7
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      ReFsDedupSvc.exe
                                                      • Path C:\Windows\System32\ReFsDedupSvc.exe
                                                      • Size 2.6MB
                                                      • SHA256 df39cf1029ad33f334f3d0dc33b6988c09d06959cbcc6f92f017a438a43c3022
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      SearchIndexer.exe
                                                      • Path C:\Windows\System32\SearchIndexer.exe
                                                      • Size 1.4MB
                                                      • SHA256 df7262d1ffa3856d777aa64e55896f8e38975db88ce4763084fdca50188343a0
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      SensorDataService.exe
                                                      • Path C:\Windows\System32\SensorDataService.exe
                                                      • Size 1.7MB
                                                      • SHA256 dae8c91be47e8ad0348f1e6a0925ebbf416836348175644e1a2b1f9b32d94482
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      AppVClient.exe
                                                      • Path C:\Windows\system32\AppVClient.exe
                                                      • Size 1.3MB
                                                      • SHA256 28e02fc30b3e5ffed9ca23716b328352b0858d30ec6ec1595ef8626fd6df58f4
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      SgrmBroker.exe
                                                      • Path C:\Windows\system32\Sgrm\SgrmBroker.exe
                                                      • Size 1.6MB
                                                      • SHA256 40813ee7ad217f06939622fbd22f610e17e02743c8ccb14e82c4e78534794d13
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      memory/1836-1-0x0000000002E10000-0x0000000002E76000-memory.dmp
                                                      Download

                                                      memory/1836-83-0x0000000000400000-0x0000000000A5F000-memory.dmp
                                                      Download

                                                      memory/1836-8-0x0000000002E10000-0x0000000002E76000-memory.dmp
                                                      Download

                                                      memory/1836-0-0x0000000000400000-0x0000000000A5F000-memory.dmp
                                                      Download

                                                      memory/2296-53-0x00000000008C0000-0x0000000000920000-memory.dmp
                                                      Download

                                                      memory/2296-172-0x0000000140000000-0x0000000140226000-memory.dmp
                                                      Download

                                                      memory/2296-49-0x0000000140000000-0x0000000140226000-memory.dmp
                                                      Download

                                                      memory/2296-59-0x00000000008C0000-0x0000000000920000-memory.dmp
                                                      Download

                                                      memory/2328-76-0x00000000009F0000-0x0000000000A56000-memory.dmp
                                                      Download

                                                      memory/2328-81-0x00000000009F0000-0x0000000000A56000-memory.dmp
                                                      Download

                                                      memory/2328-310-0x0000000000400000-0x00000000005EE000-memory.dmp
                                                      Download

                                                      memory/2328-84-0x0000000000400000-0x00000000005EE000-memory.dmp
                                                      Download

                                                      memory/2376-1053-0x0000022A98360000-0x0000022A985EB000-memory.dmp
                                                      Download

                                                      memory/2944-127-0x0000000000CF0000-0x0000000000D50000-memory.dmp
                                                      Download

                                                      memory/2944-126-0x0000000140000000-0x0000000140168000-memory.dmp
                                                      Download

                                                      memory/2944-153-0x0000000140000000-0x0000000140168000-memory.dmp
                                                      Download

                                                      memory/2944-136-0x0000000000CF0000-0x0000000000D50000-memory.dmp
                                                      Download

                                                      memory/2944-133-0x0000000000CF0000-0x0000000000D50000-memory.dmp
                                                      Download

                                                      memory/2964-94-0x0000000000730000-0x0000000000790000-memory.dmp
                                                      Download

                                                      memory/2964-88-0x0000000000730000-0x0000000000790000-memory.dmp
                                                      Download

                                                      memory/2964-992-0x0000000140000000-0x00000001402C9000-memory.dmp
                                                      Download

                                                      memory/2964-991-0x0000000000730000-0x0000000000790000-memory.dmp
                                                      Download

                                                      memory/2964-315-0x0000000140000000-0x00000001402C9000-memory.dmp
                                                      Download

                                                      memory/2964-87-0x0000000140000000-0x00000001402C9000-memory.dmp
                                                      Download

                                                      memory/3320-101-0x0000000000780000-0x00000000007E0000-memory.dmp
                                                      Download

                                                      memory/3320-100-0x0000000140000000-0x00000001401BA000-memory.dmp
                                                      Download

                                                      memory/3320-320-0x0000000140000000-0x00000001401BA000-memory.dmp
                                                      Download

                                                      memory/3320-318-0x0000000000780000-0x00000000007E0000-memory.dmp
                                                      Download

                                                      memory/3320-316-0x0000000140000000-0x00000001401BA000-memory.dmp
                                                      Download

                                                      memory/3320-107-0x0000000000780000-0x00000000007E0000-memory.dmp
                                                      Download

                                                      memory/4828-38-0x0000000140000000-0x000000014022C000-memory.dmp
                                                      Download

                                                      memory/4828-39-0x00000000016F0000-0x0000000001750000-memory.dmp
                                                      Download

                                                      memory/4828-51-0x00000000016F0000-0x0000000001750000-memory.dmp
                                                      Download

                                                      memory/4828-45-0x00000000016F0000-0x0000000001750000-memory.dmp
                                                      Download

                                                      memory/4828-64-0x0000000140000000-0x000000014022C000-memory.dmp
                                                      Download

                                                      memory/4912-322-0x0000000140000000-0x0000000140172000-memory.dmp
                                                      Download

                                                      memory/4912-141-0x0000000140000000-0x0000000140172000-memory.dmp
                                                      Download

                                                      memory/4912-321-0x0000000002F30000-0x00000000031CE000-memory.dmp
                                                      Download

                                                      memory/4912-148-0x00000000006A0000-0x0000000000700000-memory.dmp
                                                      Download

                                                      memory/4912-142-0x00000000006A0000-0x0000000000700000-memory.dmp
                                                      Download

                                                      memory/4936-317-0x0000000140000000-0x0000000140295000-memory.dmp
                                                      Download

                                                      memory/4936-115-0x0000000000D80000-0x0000000000DE0000-memory.dmp
                                                      Download

                                                      memory/4936-121-0x0000000000D80000-0x0000000000DE0000-memory.dmp
                                                      Download

                                                      memory/4936-114-0x0000000140000000-0x0000000140295000-memory.dmp
                                                      Download

                                                      memory/5004-784-0x00000000006E0000-0x0000000000740000-memory.dmp
                                                      Download

                                                      memory/5004-786-0x0000000140000000-0x00000001402D4000-memory.dmp
                                                      Download

                                                      memory/5004-28-0x00000000006E0000-0x0000000000740000-memory.dmp
                                                      Download

                                                      memory/5004-26-0x0000000140000000-0x00000001402D4000-memory.dmp
                                                      Download

                                                      memory/5004-35-0x00000000006E0000-0x0000000000740000-memory.dmp
                                                      Download

                                                      memory/5004-113-0x0000000140000000-0x00000001402D4000-memory.dmp
                                                      Download

                                                      memory/5064-260-0x0000000140000000-0x0000000140222000-memory.dmp
                                                      Download

                                                      memory/5064-72-0x0000000000CD0000-0x0000000000D30000-memory.dmp
                                                      Download

                                                      memory/5064-66-0x0000000000CD0000-0x0000000000D30000-memory.dmp
                                                      Download

                                                      memory/5064-63-0x0000000140000000-0x0000000140222000-memory.dmp
                                                      Download

                                                      memory/5332-98-0x0000000140000000-0x00000001402E9000-memory.dmp
                                                      Download

                                                      memory/5332-13-0x0000000140000000-0x00000001402E9000-memory.dmp
                                                      Download

                                                      memory/5332-14-0x00000000007B0000-0x0000000000810000-memory.dmp
                                                      Download

                                                      memory/5332-22-0x00000000007B0000-0x0000000000810000-memory.dmp
                                                      Download

                                                      memory/6704-2472-0x0000021596BC0000-0x0000021596E5E000-memory.dmp
                                                      Download

                                                      memory/6704-840-0x0000021581A10000-0x0000021581A30000-memory.dmp
                                                      Download

                                                      memory/6704-841-0x0000021581E30000-0x0000021581F30000-memory.dmp
                                                      Download

                                                      memory/6704-875-0x0000021594230000-0x0000021594250000-memory.dmp
                                                      Download

                                                      memory/6704-861-0x0000021581DF0000-0x0000021581E10000-memory.dmp
                                                      Download

                                                      memory/6704-830-0x00000215801E0000-0x00000215802E0000-memory.dmp
                                                      Download

                                                      memory/6712-3738-0x00000231FF9D0000-0x00000231FFC6E000-memory.dmp
                                                      Download