Overview

overview

10

Static

static

10

2026-08-06...op.exe

windows10-2004-x64

9

2026-08-06...op.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    07/08/2026, 00:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-06_b0263fed3aa82df7f3f447d6212589b5_darkgate_elex_glassworm_remcos_stop.exe
  • Size 6.3MB
  • Sample260807-apavcsdk71
  • SHA256 93788c4fa5d26f784e23e7acb6a0bcdc7d4a8dbacfd110dc6c3db7af9a47c1cc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwaredefense_evasiondiscoverypersistencephishingransomwarespywarestealertrojan

Malware Config

Signatures

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 2 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 2 IoCs
  • A potential corporate email address has been identified in the URL: [email protected]
    phishing
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 34 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Drops desktop.ini file(s) 3 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Control Panel 1 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 22 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: EnumeratesProcesses 42 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 49 IoCs
  • Suspicious use of FindShellTrayWindow 10 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-06_b0263fed3aa82df7f3f447d6212589b5_darkgate_elex_glassworm_remcos_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b0263fed3aa82df7f3f447d6212589b5_darkgate_elex_glassworm_remcos_stop.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Installs/modifies Browser Helper Object
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1668
    • C:\Windows\SysWOW64\regsvr32.exe
      regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1196
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2100
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Drops desktop.ini file(s)
        • Checks processor information in registry
        • Modifies Control Panel
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1064
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2060 -prefsLen 27099 -prefMapHandle 2064 -prefMapSize 270279 -ipcHandle 2148 -initialChannelId {f97e99d8-92f4-4f69-b87d-3faa5265ba23} -parentPid 1064 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1064" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
          4⤵
          • Executes dropped EXE
          PID:4372
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2532 -prefsLen 27135 -prefMapHandle 2536 -prefMapSize 270279 -ipcHandle 2560 -initialChannelId {08c2b63e-1a28-4d28-9c8c-e82510bec49c} -parentPid 1064 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1064" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
          4⤵
          • Executes dropped EXE
          PID:4164
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3876 -prefsLen 25164 -prefMapHandle 3880 -prefMapSize 270279 -jsInitHandle 3884 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3892 -initialChannelId {9e3288f0-3419-49c7-a32e-9f7bb40114a3} -parentPid 1064 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1064" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
          4⤵
          • Executes dropped EXE
          • Checks processor information in registry
          PID:3852
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4048 -prefsLen 27276 -prefMapHandle 4052 -prefMapSize 270279 -ipcHandle 4116 -initialChannelId {115f43ed-cf20-4568-9989-a86076f6be18} -parentPid 1064 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1064" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
          4⤵
          • Executes dropped EXE
          PID:3820
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4372 -prefsLen 34775 -prefMapHandle 4376 -prefMapSize 270279 -jsInitHandle 4380 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4388 -initialChannelId {c2263de3-ad3b-4c55-b26a-dc53a8c83975} -parentPid 1064 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1064" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
          4⤵
          • Executes dropped EXE
          • Checks processor information in registry
          PID:5296
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4908 -prefsLen 35012 -prefMapHandle 4912 -prefMapSize 270279 -ipcHandle 4840 -initialChannelId {402adf9b-543a-4a83-95f5-0e5525d3a4a2} -parentPid 1064 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1064" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
          4⤵
          • Executes dropped EXE
          • Checks processor information in registry
          PID:5572
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5048 -prefsLen 32900 -prefMapHandle 5052 -prefMapSize 270279 -jsInitHandle 5056 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5064 -initialChannelId {aec14cab-3870-4029-829a-00d6e0d9fdfc} -parentPid 1064 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1064" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Checks processor information in registry
          PID:5588
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5160 -prefsLen 32952 -prefMapHandle 5176 -prefMapSize 270279 -jsInitHandle 5180 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5188 -initialChannelId {2ca37551-3b08-4069-bc18-e2d2a27c0322} -parentPid 1064 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1064" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
          4⤵
          • Executes dropped EXE
          • Checks processor information in registry
          PID:5748
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5528 -prefsLen 32952 -prefMapHandle 5532 -prefMapSize 270279 -jsInitHandle 5536 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5056 -initialChannelId {ff95757e-6afa-4de8-b9de-17d60b974d7c} -parentPid 1064 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1064" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
          4⤵
          • Executes dropped EXE
          • Checks processor information in registry
          PID:5780
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5396 -prefsLen 32952 -prefMapHandle 5040 -prefMapSize 270279 -jsInitHandle 5044 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5720 -initialChannelId {2dad018a-425b-4d69-8989-110babad7213} -parentPid 1064 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1064" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
          4⤵
          • Executes dropped EXE
          • Checks processor information in registry
          PID:2172
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3220
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3216
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1580
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1124
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" http://www.internetdownloadmanager.com/download2.html
      2⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:5928
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d4,0x7ffc2033c188,0x7ffc2033c194,0x7ffc2033c1a0
        3⤵
          PID:1676
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,14828883601804292673,5018591753901961675,524288 --field-trial-handle=2324,i,16760890377833600181,17149358251547064617,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:3
          3⤵
          • System Time Discovery
          PID:4308
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,13693698316929153480,9966578012006096888,262144 --field-trial-handle=2324,i,16760890377833600181,17149358251547064617,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
          3⤵
            PID:1428
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,13863142225337087980,18227750837128333217,524288 --field-trial-handle=2324,i,16760890377833600181,17149358251547064617,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:8
            3⤵
              PID:5620
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,5129848081143536748,1804814995348336433,2097152 --field-trial-handle=2324,i,16760890377833600181,17149358251547064617,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
              3⤵
                PID:6152
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,16980260052498834168,2008744375165064814,2097152 --field-trial-handle=2324,i,16760890377833600181,17149358251547064617,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
                3⤵
                  PID:6160
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,1034166577294980229,14748329412986306200,2097152 --field-trial-handle=2324,i,16760890377833600181,17149358251547064617,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
                  3⤵
                    PID:6284
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,4395626124133935272,15097069868886923209,2097152 --field-trial-handle=2324,i,16760890377833600181,17149358251547064617,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:2
                    3⤵
                      PID:6292
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,2878024388489969980,13125100663768535157,524288 --field-trial-handle=2324,i,16760890377833600181,17149358251547064617,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:8
                      3⤵
                        PID:6720
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5260,i,6097816159754545178,5896487645298065479,2097152 --field-trial-handle=2324,i,16760890377833600181,17149358251547064617,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:1
                        3⤵
                          PID:6768
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3492,i,14240692841303805242,6379641900118275161,524288 --field-trial-handle=2324,i,16760890377833600181,17149358251547064617,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:8
                          3⤵
                            PID:6940
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,3074444208288731362,14314266075223051262,524288 --field-trial-handle=2324,i,16760890377833600181,17149358251547064617,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:8
                            3⤵
                              PID:5008
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,14593519983501604730,7553609850002399298,524288 --field-trial-handle=2324,i,16760890377833600181,17149358251547064617,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:8
                              3⤵
                                PID:6028
                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3444,i,12497612264588578220,13575064505820161846,524288 --field-trial-handle=2324,i,16760890377833600181,17149358251547064617,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
                                3⤵
                                  PID:6424
                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3444,i,12497612264588578220,13575064505820161846,524288 --field-trial-handle=2324,i,16760890377833600181,17149358251547064617,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
                                  3⤵
                                    PID:6496
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,11465952734551569292,14974099477812730981,524288 --field-trial-handle=2324,i,16760890377833600181,17149358251547064617,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:8
                                    3⤵
                                      PID:7128
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,17137150271722837751,18395059486400335848,524288 --field-trial-handle=2324,i,16760890377833600181,17149358251547064617,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:8
                                      3⤵
                                        PID:6752
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,8831896100144679818,5386479035845667005,524288 --field-trial-handle=2324,i,16760890377833600181,17149358251547064617,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:8
                                        3⤵
                                          PID:6744
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,8374606555324630203,10404612676368838514,524288 --field-trial-handle=2324,i,16760890377833600181,17149358251547064617,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:8
                                          3⤵
                                            PID:6736
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6660,i,7364786560518365621,16279395723366003756,524288 --field-trial-handle=2324,i,16760890377833600181,17149358251547064617,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:8
                                            3⤵
                                              PID:6756
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,16298941906043290133,5370607883658992117,524288 --field-trial-handle=2324,i,16760890377833600181,17149358251547064617,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:8
                                              3⤵
                                                PID:4204
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4772,i,5037181195365902981,3139603143811441064,524288 --field-trial-handle=2324,i,16760890377833600181,17149358251547064617,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
                                                3⤵
                                                  PID:4172
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4776,i,6037843196862920241,11052224253769020688,524288 --field-trial-handle=2324,i,16760890377833600181,17149358251547064617,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:8
                                                  3⤵
                                                    PID:1716
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,9533508490933187499,2377123444523189749,524288 --field-trial-handle=2324,i,16760890377833600181,17149358251547064617,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:8
                                                    3⤵
                                                      PID:6028
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,5730720861157532752,12165636444741097883,524288 --field-trial-handle=2324,i,16760890377833600181,17149358251547064617,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
                                                      3⤵
                                                        PID:6676
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,11979051917501524323,17922335192662030167,524288 --field-trial-handle=2324,i,16760890377833600181,17149358251547064617,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:8
                                                        3⤵
                                                          PID:2348
                                                    • C:\Windows\System32\alg.exe
                                                      C:\Windows\System32\alg.exe
                                                      1⤵
                                                      • Executes dropped EXE
                                                      PID:4544
                                                    • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                                                      C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                                                      1⤵
                                                      • Executes dropped EXE
                                                      • Drops file in System32 directory
                                                      • Drops file in Program Files directory
                                                      • Drops file in Windows directory
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:4008
                                                    • C:\Windows\System32\svchost.exe
                                                      C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
                                                      1⤵
                                                        PID:2060
                                                      • C:\Windows\system32\fxssvc.exe
                                                        C:\Windows\system32\fxssvc.exe
                                                        1⤵
                                                        • Executes dropped EXE
                                                        • Modifies data under HKEY_USERS
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:3468
                                                      • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                        1⤵
                                                        • Executes dropped EXE
                                                        PID:4480
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                        1⤵
                                                        • Executes dropped EXE
                                                        PID:3000
                                                      • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                        "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                                                        1⤵
                                                        • Executes dropped EXE
                                                        PID:1240
                                                      • C:\Windows\System32\msdtc.exe
                                                        C:\Windows\System32\msdtc.exe
                                                        1⤵
                                                        • Executes dropped EXE
                                                        • Drops file in System32 directory
                                                        • Drops file in Windows directory
                                                        PID:3228
                                                      • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                                                        "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                                                        1⤵
                                                        • Executes dropped EXE
                                                        PID:2288
                                                      • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                                                        C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                                                        1⤵
                                                        • Executes dropped EXE
                                                        PID:1756
                                                      • C:\Windows\SysWow64\perfhost.exe
                                                        C:\Windows\SysWow64\perfhost.exe
                                                        1⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        PID:3056
                                                      • C:\Windows\system32\locator.exe
                                                        C:\Windows\system32\locator.exe
                                                        1⤵
                                                        • Executes dropped EXE
                                                        PID:1568
                                                      • C:\Windows\System32\SensorDataService.exe
                                                        C:\Windows\System32\SensorDataService.exe
                                                        1⤵
                                                        • Executes dropped EXE
                                                        • Checks SCSI registry key(s)
                                                        PID:3844
                                                      • C:\Windows\System32\snmptrap.exe
                                                        C:\Windows\System32\snmptrap.exe
                                                        1⤵
                                                        • Executes dropped EXE
                                                        PID:2260
                                                      • C:\Windows\system32\spectrum.exe
                                                        C:\Windows\system32\spectrum.exe
                                                        1⤵
                                                        • Executes dropped EXE
                                                        • Checks SCSI registry key(s)
                                                        PID:2304
                                                      • C:\Windows\System32\OpenSSH\ssh-agent.exe
                                                        C:\Windows\System32\OpenSSH\ssh-agent.exe
                                                        1⤵
                                                        • Executes dropped EXE
                                                        PID:3496
                                                      • C:\Windows\system32\svchost.exe
                                                        C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
                                                        1⤵
                                                          PID:2900
                                                        • C:\Windows\system32\TieringEngineService.exe
                                                          C:\Windows\system32\TieringEngineService.exe
                                                          1⤵
                                                          • Executes dropped EXE
                                                          • Checks processor information in registry
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:376
                                                        • C:\Windows\system32\AgentService.exe
                                                          C:\Windows\system32\AgentService.exe
                                                          1⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:1136
                                                        • C:\Windows\System32\vds.exe
                                                          C:\Windows\System32\vds.exe
                                                          1⤵
                                                          • Executes dropped EXE
                                                          PID:4560
                                                        • C:\Windows\system32\vssvc.exe
                                                          C:\Windows\system32\vssvc.exe
                                                          1⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:1680
                                                        • C:\Windows\system32\wbengine.exe
                                                          "C:\Windows\system32\wbengine.exe"
                                                          1⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:4492
                                                        • C:\Windows\system32\wbem\WmiApSrv.exe
                                                          C:\Windows\system32\wbem\WmiApSrv.exe
                                                          1⤵
                                                          • Executes dropped EXE
                                                          PID:1608
                                                        • C:\Windows\system32\SearchIndexer.exe
                                                          C:\Windows\system32\SearchIndexer.exe /Embedding
                                                          1⤵
                                                          • Executes dropped EXE
                                                          • Modifies data under HKEY_USERS
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:532
                                                          • C:\Windows\system32\SearchProtocolHost.exe
                                                            "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                                            2⤵
                                                            • Modifies data under HKEY_USERS
                                                            PID:3140
                                                          • C:\Windows\system32\SearchFilterHost.exe
                                                            "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
                                                            2⤵
                                                            • Modifies data under HKEY_USERS
                                                            PID:4408
                                                          • C:\Windows\system32\SearchProtocolHost.exe
                                                            "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1788976790-1541110888-1636651838-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1788976790-1541110888-1636651838-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
                                                            2⤵
                                                              PID:4204

                                                          Network

                                                                MITRE ATT&CK Enterprise v16

                                                                Reconnaissance

                                                                Resource Development

                                                                Initial Access

                                                                Execution

                                                                Persistence

                                                                Boot or Logon Autostart Execution

                                                                1
                                                                T1547

                                                                Registry Run Keys / Startup Folder

                                                                1
                                                                T1547.001

                                                                Browser Extensions

                                                                1
                                                                T1176

                                                                Privilege Escalation

                                                                Boot or Logon Autostart Execution

                                                                1
                                                                T1547

                                                                Registry Run Keys / Startup Folder

                                                                1
                                                                T1547.001

                                                                Defense Evasion

                                                                Modify Registry

                                                                3
                                                                T1112

                                                                Credential Access

                                                                Credentials from Password Stores

                                                                1
                                                                T1555

                                                                Credentials from Web Browsers

                                                                1
                                                                T1555.003

                                                                Unsecured Credentials

                                                                1
                                                                T1552

                                                                Credentials In Files

                                                                1
                                                                T1552.001

                                                                Discovery

                                                                Browser Information Discovery

                                                                1
                                                                T1217

                                                                Peripheral Device Discovery

                                                                1
                                                                T1120

                                                                Query Registry

                                                                5
                                                                T1012

                                                                System Information Discovery

                                                                6
                                                                T1082

                                                                System Location Discovery

                                                                1
                                                                T1614

                                                                System Language Discovery

                                                                1
                                                                T1614.001

                                                                System Time Discovery

                                                                1
                                                                T1124

                                                                Lateral Movement

                                                                Collection

                                                                Data from Local System

                                                                1
                                                                T1005

                                                                Command and Control

                                                                Exfiltration

                                                                Impact

                                                                Replay Monitor

                                                                Loading Replay Monitor...

                                                                Downloads

                                                                elevation_service.exe
                                                                • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                • Size 2.7MB
                                                                • SHA256 34919ce92bdce353636f0c2abfbbc69f16550895473103e7ca6cb5dfaaedd9aa
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                maintenanceservice.exe
                                                                • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                • Size 1.6MB
                                                                • SHA256 3ac1da8600e21435466e0b0ecce5d4def8a0fc4760c74438f2262a641376d999
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                OSE.EXE
                                                                • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                                                                • Size 1.5MB
                                                                • SHA256 a71d133da6d1042c8c6a83a73c5ff0c469f47f5054b519680fde8dfb9a4e2d1a
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                elevation_service.exe
                                                                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                • Size 2.8MB
                                                                • SHA256 caf8b29cd458ff66793c54264a326aa71f50a1a08cc2421219119855a5c93e40
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                firefox.exe
                                                                • Path C:\Program Files\Mozilla Firefox\firefox.exe
                                                                • Size 1.2MB
                                                                • SHA256 0654f483612baee20db6d24797425d15ffdba06a98aebb7746defe130431a447
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                manifest.json
                                                                • Path C:\Program Files\chrome_Unpacker_BeginUnzipping5928_2135346215\manifest.json
                                                                • Size 135B
                                                                • SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                manifest.json
                                                                • Path C:\Program Files\chrome_Unpacker_BeginUnzipping5928_860939793\manifest.json
                                                                • Size 43B
                                                                • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                blocklist
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                                • Size 105KB
                                                                • SHA256 acf2ca2fd979c7d8ae7b74bb0af4308e4abd3e42e1f32fd1a04b0ca1a2b166c8
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                protocols.json
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
                                                                • Size 3KB
                                                                • SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                settings.dat
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                • Size 280B
                                                                • SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                BookmarkMergedSurfaceOrdering
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                • Size 6B
                                                                • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                the-real-index
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                • Size 2KB
                                                                • SHA256 d1b6f4fd9cbabbefacb64452d16fec8bf87d111549c5d29cc30235458b70705d
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                SiteList-Enterprise.json
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                • Size 2B
                                                                • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                Edge Profile.ico
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                • Size 70KB
                                                                • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Network Persistent State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                • Size 2KB
                                                                • SHA256 dc54e5b1fd46a65a82f355abc57c4fa4b44286510a64345b60c09a9b7af0ebf9
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                Network Persistent State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                • Size 111B
                                                                • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                SCT Auditing Pending Reports
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                • Size 2B
                                                                • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                Preferences
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                • Size 13KB
                                                                • SHA256 eff3a92f7a72ad9afae6968e48bd07cc84ece764bf1741f9b91e95de05216456
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Secure Preferences
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                • Size 35KB
                                                                • SHA256 205325554a3c25493a72f7e77dbf542e1ec3e993585f4c623e64275a6f78637b
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                sync_diagnostic.log
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                • Size 7KB
                                                                • SHA256 c9def50cd40dc85db1ad2857504d529f21ee21f290bba1fbd82c9e0faf8acf43
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                OperationConfig
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                • Size 22KB
                                                                • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                OperationConfig~RFe5995be.TMP
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5995be.TMP
                                                                • Size 3KB
                                                                • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                Local State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                • Size 15KB
                                                                • SHA256 9a9913bfccc11b3e76e604d588e0f4438a2a241fde93af73aa1626ba8410abac
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Local State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                • Size 25KB
                                                                • SHA256 1b49c8da863d351f2cb50cad4a2118e548ae11f62fa021e02ad5a62d941721b9
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Local State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                • Size 8KB
                                                                • SHA256 35af7c1b6bb3d8898b927e0d5e49521dafe7b7e80c2aa3b0a49b898a9e6073f7
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Local State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                • Size 15KB
                                                                • SHA256 e743bbc7006576f31713cc15ef70da5ffd6aef8c0445c87ab0f78c7d22e63cf2
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Local State
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                • Size 9KB
                                                                • SHA256 aae259ae882568834724d4685aa888b9e129031bf26e84662e6647b7f4d233d5
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                metadata.json
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                • Size 132B
                                                                • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                metadata.json
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                • Size 252B
                                                                • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                metadata.json
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                • Size 13B
                                                                • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                • Size 2KB
                                                                • SHA256 dedb919d31310890c883daa4e6cdf601c9faf70d9b47d1926e96f60d6fe3e43c
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
                                                                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nxqdpovk.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
                                                                • Size 16KB
                                                                • SHA256 75e0fb213660b1aca5ff49b1c62990982c7e95700e9ceb15d08f1919e88609dc
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                webext.sc.lz4
                                                                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nxqdpovk.default-release\startupCache\webext.sc.lz4
                                                                • Size 104KB
                                                                • SHA256 9b3f7d34eb9d52080ea17ec346e4fd9078e30db3c4e68812996ce766fd3b2270
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                233be040-b4de-4767-b73a-ee48ebf01094.zip
                                                                • Path C:\Users\Admin\AppData\Local\Temp\233be040-b4de-4767-b73a-ee48ebf01094.zip
                                                                • Size 3.7MB
                                                                • SHA256 e9c028f3f7c77b2fcc2c8a280e20a862eb5cf106c8a7ffcfb5c278dc8f9b5875
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                5768c5f5-eacc-43cf-8a41-9db611b3b69c.tmp
                                                                • Path C:\Users\Admin\AppData\Local\Temp\5768c5f5-eacc-43cf-8a41-9db611b3b69c.tmp
                                                                • Size 10KB
                                                                • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                90859ebe-017e-46d3-8d66-e5e0b8f7001e.tmp
                                                                • Path C:\Users\Admin\AppData\Local\Temp\90859ebe-017e-46d3-8d66-e5e0b8f7001e.tmp
                                                                • Size 1B
                                                                • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                content_new.js
                                                                • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5928_193921276\CRX_INSTALL\content_new.js
                                                                • Size 10KB
                                                                • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                9837f542-a48f-4740-9e04-2a6c7975e01f.tmp
                                                                • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5928_37583353\9837f542-a48f-4740-9e04-2a6c7975e01f.tmp
                                                                • Size 153KB
                                                                • SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                tmpaddon
                                                                • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                                • Size 11KB
                                                                • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                tmpaddon
                                                                • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                                • Size 502KB
                                                                • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                compatibility.ini
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\compatibility.ini
                                                                • Size 198B
                                                                • SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                data.safe.tmp
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
                                                                • Size 5KB
                                                                • SHA256 a456736312b0c9d82c67b5a1552c371c1567cac0ac7e329726ec1ce4e6a74d7a
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                data.safe.tmp
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
                                                                • Size 29KB
                                                                • SHA256 35e5bd604dc19f4b42c7f1cb7489323984f69a626f768020c8b69102be231d5a
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                data.safe.tmp
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
                                                                • Size 29KB
                                                                • SHA256 accc6936c4ee74ef3fa7d10c359c0543c34199426219e8e65f5de0907bd733b2
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                data.safe.tmp
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
                                                                • Size 3KB
                                                                • SHA256 94e3f156631bdf482ad03004fc3bd7b2e15c74ee8586957041efa8bd763863b6
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                data.safe.tmp
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
                                                                • Size 7KB
                                                                • SHA256 2b72a1e2f743f0204b6a7dcfa4e4b3a65019470a87491d1a55a12c412f583a27
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                data.safe.tmp
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\db\data.safe.tmp
                                                                • Size 29KB
                                                                • SHA256 cd3c24598084571096445a63c0b90fa28c88a3fcaa4ed5a6fef858956e5af531
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                events
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\events\events
                                                                • Size 1KB
                                                                • SHA256 a5c5caf1b13026b6266009114929019e877c71e988bc585211106cbf3f125b2e
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                3ac287e5-2a0c-4aca-afa4-2bc36937e1e6
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\3ac287e5-2a0c-4aca-afa4-2bc36937e1e6
                                                                • Size 235B
                                                                • SHA256 7ec176737405efcaf2d1c390022304139b1fffbf1f912636979cf32c4d7c5898
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                7300adaf-1db3-4a9d-adfc-deefc6ed3047
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\7300adaf-1db3-4a9d-adfc-deefc6ed3047
                                                                • Size 15KB
                                                                • SHA256 ec97f64e295c86cef0fbe435c4057714f4c0c01a315d87dfd6fdcd78bd83e187
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                73285e54-2921-4d2f-9686-26533b838908
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\73285e54-2921-4d2f-9686-26533b838908
                                                                • Size 235B
                                                                • SHA256 505c27b073d4ceacc418efde4aad979507de791d2bf97af849f9bb5718169907
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                7e4f8b85-4c7c-48cb-ac55-6efe439a0512
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\7e4f8b85-4c7c-48cb-ac55-6efe439a0512
                                                                • Size 886B
                                                                • SHA256 4d526fd447e81bce06fd7ee07458964b610c6ea3b5850e1beeb9342f309f11c7
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                9e6c2117-cf6b-411c-a254-884d42f7ccd1
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\9e6c2117-cf6b-411c-a254-884d42f7ccd1
                                                                • Size 2KB
                                                                • SHA256 011bb30751dc4cd1ae145f49ec3c3b8c1a7c4e2978984f81288826ffcc6d88e1
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                e4702133-a46e-4d7e-8084-4053e9c80377
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\datareporting\glean\pending_pings\e4702133-a46e-4d7e-8084-4053e9c80377
                                                                • Size 883B
                                                                • SHA256 0fdac60c4f932932e3da9260b6a8af22e652c739c41418b72a23645fbc308d2c
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                extensions.json
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\extensions.json
                                                                • Size 16KB
                                                                • SHA256 4ecbcefc9ddcf854b6ef91be713930ae19f8ad715c2776f0f8a0c91e0393eaf7
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                gmpopenh264.dll
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                                                                • Size 1.1MB
                                                                • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                gmpopenh264.info
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                                                                • Size 116B
                                                                • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                manifest.json
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
                                                                • Size 1002B
                                                                • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                widevinecdm.dll
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
                                                                • Size 21.6MB
                                                                • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                prefs-1.js
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs-1.js
                                                                • Size 12KB
                                                                • SHA256 5ba47ac034c514f8eca19b189c6b0bb7d0a89cfefb2c4c7b24ae2b96c99bc968
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                prefs-1.js
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs-1.js
                                                                • Size 6KB
                                                                • SHA256 fb0b656b8f5ef58a3fd8504cec0ac15baaa74683e8eae95b38764dcfe040a756
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                prefs-1.js
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs-1.js
                                                                • Size 7KB
                                                                • SHA256 7d5ff66dff057a40f75108246283b29c89e4b0d6dd4d3bb6bd2391389afb66ad
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                prefs-1.js
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs-1.js
                                                                • Size 8KB
                                                                • SHA256 ba1a26fc267233e52fd616fc8432fe4ff0a94f7fb7445e6ea4edca655f47fe72
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                prefs.js
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs.js
                                                                • Size 6KB
                                                                • SHA256 0a4c4a82c8f3ba932b363d30030fad48f61db0903dcab683efdcc44b776f0418
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                prefs.js
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\prefs.js
                                                                • Size 6KB
                                                                • SHA256 891a53ef5e6e8c4071f06a190d62cbed7e12e7f48c6261cd4a9df918a43f3219
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                recovery.baklz4
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\sessionstore-backups\recovery.baklz4
                                                                • Size 4KB
                                                                • SHA256 cc0e853bbbaf88cbc1155a6278e49108b68082b71745fc7b3b45f21803cf3b01
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                recovery.jsonlz4
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\sessionstore-backups\recovery.jsonlz4
                                                                • Size 4KB
                                                                • SHA256 eea228c99c5a15806bd9e2684fcd22cf209de0f725b960b18e0991746f5d3cde
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                3870112724rsegmnoittet-es.sqlite
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nxqdpovk.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                • Size 4.5MB
                                                                • SHA256 0b86f768218eb393706da08afdd5b54494a8a60ad51cf152f4310174dce95f9e
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                perfhost.exe
                                                                • Path C:\Windows\SysWOW64\perfhost.exe
                                                                • Size 1.3MB
                                                                • SHA256 146aa22a20fec59ebee4e7fc0a619ded06ad7626df7c0529ee87a468e3df104a
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                AgentService.exe
                                                                • Path C:\Windows\System32\AgentService.exe
                                                                • Size 1.7MB
                                                                • SHA256 2f65477c985381f7a7e8988011980067204a7795d3faefe32ae5442eac88cd9f
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                DiagnosticsHub.StandardCollector.Service.exe
                                                                • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                                                                • Size 1.4MB
                                                                • SHA256 707a968150b5cc17e960e00d58d3b735b8adafa2e81490fa76b71fdf0ba52f0d
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                FXSSVC.exe
                                                                • Path C:\Windows\System32\FXSSVC.exe
                                                                • Size 1.2MB
                                                                • SHA256 7e139eddef41357cd63d358e258a1089d9b6bea062b4f53e24afb3f322e99945
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Locator.exe
                                                                • Path C:\Windows\System32\Locator.exe
                                                                • Size 1.3MB
                                                                • SHA256 03a3f54fba80c4ce059bbd9fc437458f80f0ccb04b82bd8ef42354b71b7cb956
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                ssh-agent.exe
                                                                • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                                                                • Size 1.7MB
                                                                • SHA256 9c343a6286fbf87f16f72987db511f2db7fa0f46b28fdb59cf3f82e9b29b9e71
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                PerceptionSimulationService.exe
                                                                • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                                                                • Size 1.4MB
                                                                • SHA256 606f1e4c1f8cf33b2031a97788dbadbe711a73eef8ea63f031a5c648af57ee69
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                SearchIndexer.exe
                                                                • Path C:\Windows\System32\SearchIndexer.exe
                                                                • Size 1.4MB
                                                                • SHA256 378e48fbe9e222f69c308f4605d1f5a8885ef80540ea0b51e7f495820c89de8e
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                SensorDataService.exe
                                                                • Path C:\Windows\System32\SensorDataService.exe
                                                                • Size 1.8MB
                                                                • SHA256 e0b86d5694227fd62d967dc08a9a02f15eff3b01adbce2fe6a642968ed5751a1
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Spectrum.exe
                                                                • Path C:\Windows\System32\Spectrum.exe
                                                                • Size 1.4MB
                                                                • SHA256 bf208c1991562e8e041ec2244b3575397149d203bde27dbeab0ef1e134d70ce7
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                TieringEngineService.exe
                                                                • Path C:\Windows\System32\TieringEngineService.exe
                                                                • Size 1.6MB
                                                                • SHA256 4bc471a0da2d4011a40fa322e3f93e1c225757c77570e11a104c9e1d2eb4cb71
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                VSSVC.exe
                                                                • Path C:\Windows\System32\VSSVC.exe
                                                                • Size 2.0MB
                                                                • SHA256 6c1e29b5034d62c4c2056a9d2936913dd139d2c142c4e2a8b64d5343490b2c83
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                alg.exe
                                                                • Path C:\Windows\System32\alg.exe
                                                                • Size 1.4MB
                                                                • SHA256 17fa7ed7d98f4d28bbaa0ff961bde309cb18cd103fa5fdcd76016278f921af4d
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                msdtc.exe
                                                                • Path C:\Windows\System32\msdtc.exe
                                                                • Size 1.4MB
                                                                • SHA256 32b149412cf07dbdac80aaf25835d7dba8b5857438a820014f78237c661c2cc1
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                snmptrap.exe
                                                                • Path C:\Windows\System32\snmptrap.exe
                                                                • Size 1.3MB
                                                                • SHA256 2136bb76a9305474a87f5f25dfdc74c0cf007b5a81be00452c8011dc7aac8948
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                vds.exe
                                                                • Path C:\Windows\System32\vds.exe
                                                                • Size 1.3MB
                                                                • SHA256 551c841bfabeb784cfb6f0ec1f5a30c2972761a700c599e9e18c696c45a69b7f
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                WmiApSrv.exe
                                                                • Path C:\Windows\System32\wbem\WmiApSrv.exe
                                                                • Size 1.5MB
                                                                • SHA256 e82204fa0f07556c5a7b52bebca515be6c866d41f2cd59f2c20cda922f92ed12
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                wbengine.exe
                                                                • Path C:\Windows\System32\wbengine.exe
                                                                • Size 2.1MB
                                                                • SHA256 5ef8069826e1c0119a4e117ccd5c401231e18c591164acf23dc51bf74e5f800f
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                AppVClient.exe
                                                                • Path C:\Windows\system32\AppVClient.exe
                                                                • Size 1.3MB
                                                                • SHA256 26dac854a9dc4693d049b2e682c3bd9d4c3eb6a157ce66f55777bc9f219a1434
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                SgrmBroker.exe
                                                                • Path C:\Windows\system32\SgrmBroker.exe
                                                                • Size 1.6MB
                                                                • SHA256 7946319d6ab9ba5455904cf8aa0f73453bd41c6857ddf7e8e7db90e8aa56dfcf
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                msiexec.exe
                                                                • Path C:\Windows\system32\msiexec.exe
                                                                • Size 1.4MB
                                                                • SHA256 428e30dd40abba8a93cf8378a623d8765f0b74da9d9ed36dd58a1b7c0630f547
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                memory/376-247-0x0000000140000000-0x00000001401A3000-memory.dmp
                                                                Download

                                                                memory/532-166-0x0000000001780000-0x0000000001790000-memory.dmp
                                                                Download

                                                                memory/532-182-0x0000000001A30000-0x0000000001A40000-memory.dmp
                                                                Download

                                                                memory/532-222-0x0000000009E70000-0x0000000009E78000-memory.dmp
                                                                Download

                                                                memory/532-257-0x0000000140000000-0x0000000140179000-memory.dmp
                                                                Download

                                                                memory/532-388-0x0000000140000000-0x0000000140179000-memory.dmp
                                                                Download

                                                                memory/1136-135-0x0000000140000000-0x00000001401C0000-memory.dmp
                                                                Download

                                                                memory/1240-62-0x0000000140000000-0x0000000140196000-memory.dmp
                                                                Download

                                                                memory/1240-53-0x0000000000CD0000-0x0000000000D30000-memory.dmp
                                                                Download

                                                                memory/1240-59-0x0000000000CD0000-0x0000000000D30000-memory.dmp
                                                                Download

                                                                memory/1240-64-0x0000000000CD0000-0x0000000000D30000-memory.dmp
                                                                Download

                                                                memory/1240-66-0x0000000140000000-0x0000000140196000-memory.dmp
                                                                Download

                                                                memory/1568-239-0x0000000140000000-0x0000000140156000-memory.dmp
                                                                Download

                                                                memory/1608-255-0x0000000140000000-0x0000000140187000-memory.dmp
                                                                Download

                                                                memory/1668-227-0x0000000000400000-0x0000000000A61000-memory.dmp
                                                                Download

                                                                memory/1668-5-0x0000000001170000-0x00000000011D6000-memory.dmp
                                                                Download

                                                                memory/1668-9-0x0000000000400000-0x0000000000A61000-memory.dmp
                                                                Download

                                                                memory/1668-0-0x0000000001170000-0x00000000011D6000-memory.dmp
                                                                Download

                                                                memory/1680-252-0x0000000140000000-0x00000001401FC000-memory.dmp
                                                                Download

                                                                memory/1756-82-0x0000000000B40000-0x0000000000BA0000-memory.dmp
                                                                Download

                                                                memory/1756-234-0x0000000140000000-0x000000014016C000-memory.dmp
                                                                Download

                                                                memory/1756-88-0x0000000000B40000-0x0000000000BA0000-memory.dmp
                                                                Download

                                                                memory/2260-242-0x0000000140000000-0x0000000140157000-memory.dmp
                                                                Download

                                                                memory/2288-259-0x0000000140000000-0x0000000140191000-memory.dmp
                                                                Download

                                                                memory/2288-72-0x00000000007D0000-0x0000000000830000-memory.dmp
                                                                Download

                                                                memory/2288-78-0x00000000007D0000-0x0000000000830000-memory.dmp
                                                                Download

                                                                memory/2304-117-0x00000000004E0000-0x0000000000540000-memory.dmp
                                                                Download

                                                                memory/2304-244-0x0000000140000000-0x0000000140169000-memory.dmp
                                                                Download

                                                                memory/2304-111-0x00000000004E0000-0x0000000000540000-memory.dmp
                                                                Download

                                                                memory/3000-51-0x0000000140000000-0x00000001402D4000-memory.dmp
                                                                Download

                                                                memory/3000-42-0x0000000000890000-0x00000000008F0000-memory.dmp
                                                                Download

                                                                memory/3000-888-0x0000000140000000-0x00000001402D4000-memory.dmp
                                                                Download

                                                                memory/3000-48-0x0000000000890000-0x00000000008F0000-memory.dmp
                                                                Download

                                                                memory/3000-355-0x0000000140000000-0x00000001402D4000-memory.dmp
                                                                Download

                                                                memory/3056-95-0x0000000000720000-0x0000000000786000-memory.dmp
                                                                Download

                                                                memory/3056-238-0x0000000000400000-0x0000000000558000-memory.dmp
                                                                Download

                                                                memory/3056-100-0x0000000000720000-0x0000000000786000-memory.dmp
                                                                Download

                                                                memory/3228-229-0x0000000140000000-0x000000014017A000-memory.dmp
                                                                Download

                                                                memory/3468-67-0x0000000140000000-0x0000000140135000-memory.dmp
                                                                Download

                                                                memory/3468-28-0x0000000140000000-0x0000000140135000-memory.dmp
                                                                Download

                                                                memory/3496-246-0x0000000140000000-0x00000001401C3000-memory.dmp
                                                                Download

                                                                memory/3496-128-0x0000000000DB0000-0x0000000000E10000-memory.dmp
                                                                Download

                                                                memory/3496-122-0x0000000000DB0000-0x0000000000E10000-memory.dmp
                                                                Download

                                                                memory/3844-241-0x0000000140000000-0x00000001401D7000-memory.dmp
                                                                Download

                                                                memory/3844-349-0x0000000140000000-0x00000001401D7000-memory.dmp
                                                                Download

                                                                memory/4008-24-0x0000000000730000-0x0000000000790000-memory.dmp
                                                                Download

                                                                memory/4008-16-0x0000000000730000-0x0000000000790000-memory.dmp
                                                                Download

                                                                memory/4008-334-0x0000000140000000-0x000000014016A000-memory.dmp
                                                                Download

                                                                memory/4008-15-0x0000000140000000-0x000000014016A000-memory.dmp
                                                                Download

                                                                memory/4408-381-0x000002199C590000-0x000002199C5A0000-memory.dmp
                                                                Download

                                                                memory/4408-372-0x000002199C590000-0x000002199C5A0000-memory.dmp
                                                                Download

                                                                memory/4408-360-0x000002199C590000-0x000002199C5A0000-memory.dmp
                                                                Download

                                                                memory/4408-361-0x000002199C590000-0x000002199C5A0000-memory.dmp
                                                                Download

                                                                memory/4408-359-0x000002199C590000-0x000002199C5A0000-memory.dmp
                                                                Download

                                                                memory/4408-358-0x000002199C590000-0x000002199C5A0000-memory.dmp
                                                                Download

                                                                memory/4408-357-0x000002199C590000-0x000002199C5A0000-memory.dmp
                                                                Download

                                                                memory/4408-356-0x000002199C590000-0x000002199C5A0000-memory.dmp
                                                                Download

                                                                memory/4408-365-0x000002199C590000-0x000002199C5A0000-memory.dmp
                                                                Download

                                                                memory/4408-367-0x000002199C590000-0x000002199C5A0000-memory.dmp
                                                                Download

                                                                memory/4408-368-0x000002199C590000-0x000002199C5A0000-memory.dmp
                                                                Download

                                                                memory/4408-369-0x000002199C590000-0x000002199C5A0000-memory.dmp
                                                                Download

                                                                memory/4408-366-0x000002199C590000-0x000002199C5A0000-memory.dmp
                                                                Download

                                                                memory/4408-371-0x000002199C590000-0x000002199C5A0000-memory.dmp
                                                                Download

                                                                memory/4408-364-0x000002199C590000-0x000002199C5A0000-memory.dmp
                                                                Download

                                                                memory/4408-370-0x000002199C590000-0x000002199C5A0000-memory.dmp
                                                                Download

                                                                memory/4408-363-0x000002199C590000-0x000002199C5A0000-memory.dmp
                                                                Download

                                                                memory/4408-377-0x000002199C590000-0x000002199C5A0000-memory.dmp
                                                                Download

                                                                memory/4408-376-0x000002199C590000-0x000002199C5A0000-memory.dmp
                                                                Download

                                                                memory/4408-384-0x000002199C590000-0x000002199C5A0000-memory.dmp
                                                                Download

                                                                memory/4408-387-0x000002199C590000-0x000002199C5A0000-memory.dmp
                                                                Download

                                                                memory/4408-386-0x000002199C590000-0x000002199C5A0000-memory.dmp
                                                                Download

                                                                memory/4408-385-0x000002199C590000-0x000002199C5A0000-memory.dmp
                                                                Download

                                                                memory/4408-383-0x000002199C590000-0x000002199C5A0000-memory.dmp
                                                                Download

                                                                memory/4408-382-0x000002199C590000-0x000002199C5A0000-memory.dmp
                                                                Download

                                                                memory/4408-362-0x000002199C590000-0x000002199C5A0000-memory.dmp
                                                                Download

                                                                memory/4408-380-0x000002199C590000-0x000002199C5A0000-memory.dmp
                                                                Download

                                                                memory/4408-379-0x000002199C590000-0x000002199C5A0000-memory.dmp
                                                                Download

                                                                memory/4408-378-0x000002199C590000-0x000002199C5A0000-memory.dmp
                                                                Download

                                                                memory/4408-375-0x000002199C590000-0x000002199C5A0000-memory.dmp
                                                                Download

                                                                memory/4408-374-0x000002199C590000-0x000002199C5A0000-memory.dmp
                                                                Download

                                                                memory/4408-389-0x000002199C590000-0x000002199C5A0000-memory.dmp
                                                                Download

                                                                memory/4408-391-0x000002199C590000-0x000002199C5A0000-memory.dmp
                                                                Download

                                                                memory/4408-395-0x000002199C590000-0x000002199C5A0000-memory.dmp
                                                                Download

                                                                memory/4408-396-0x000002199C590000-0x000002199C5A0000-memory.dmp
                                                                Download

                                                                memory/4408-397-0x000002199C590000-0x000002199C5A0000-memory.dmp
                                                                Download

                                                                memory/4408-392-0x000002199C590000-0x000002199C5A0000-memory.dmp
                                                                Download

                                                                memory/4408-393-0x000002199C590000-0x000002199C5A0000-memory.dmp
                                                                Download

                                                                memory/4408-394-0x000002199C590000-0x000002199C5A0000-memory.dmp
                                                                Download

                                                                memory/4408-373-0x000002199C590000-0x000002199C5A0000-memory.dmp
                                                                Download

                                                                memory/4408-390-0x000002199C590000-0x000002199C5A0000-memory.dmp
                                                                Download

                                                                memory/4480-37-0x0000000000C70000-0x0000000000CD0000-memory.dmp
                                                                Download

                                                                memory/4480-39-0x0000000140000000-0x00000001402E9000-memory.dmp
                                                                Download

                                                                memory/4480-31-0x0000000000C70000-0x0000000000CD0000-memory.dmp
                                                                Download

                                                                memory/4480-354-0x0000000140000000-0x00000001402E9000-memory.dmp
                                                                Download

                                                                memory/4492-254-0x0000000140000000-0x0000000140216000-memory.dmp
                                                                Download

                                                                memory/4544-11-0x0000000140000000-0x000000014016B000-memory.dmp
                                                                Download

                                                                memory/4544-316-0x0000000140000000-0x000000014016B000-memory.dmp
                                                                Download

                                                                memory/4560-249-0x0000000140000000-0x0000000140147000-memory.dmp
                                                                Download